Web security & performance glossary

Every term you are likely to meet in a ScanOpsPro report or guide, defined in one or two plain sentences. Terms with a deeper write-up link to the relevant guide.

Encryption & certificates

SSL

Secure Sockets Layer, the original protocol for encrypting traffic between a browser and a server. It is now obsolete and has been replaced by TLS, though “SSL” survives as a colloquial name for the certificates involved. See What is SSL/TLS?

TLS

Transport Layer Security, the modern protocol that encrypts data in transit so it cannot be read or tampered with between the visitor and the site. TLS 1.2 and 1.3 are the versions in current use.

Cipher suite

The specific combination of algorithms a server and browser agree to use for a TLS connection, covering key exchange, encryption and integrity. Modern suites favour forward secrecy and strong ciphers like AES-GCM.

Certificate authority (CA)

A trusted organisation that issues TLS certificates after verifying the requester controls the domain (and sometimes the organisation behind it). Browsers ship with a list of CAs they trust.

DV / OV / EV

The three validation levels of a TLS certificate: Domain Validated (proves domain control), Organization Validated and Extended Validation (which additionally verify the legal entity). See SSL certificate types compared.

Mixed content

When an HTTPS page loads some resources — images, scripts or styles — over insecure HTTP. Browsers block or warn about it because it undermines the security of the whole page. See Fix mixed content warnings.

MITM (man-in-the-middle)

An attack where a third party secretly intercepts traffic between a visitor and a site, potentially reading or altering it. Properly configured TLS is the primary defence against it.

Security headers

HSTS

HTTP Strict-Transport-Security, a response header that tells browsers to only ever connect to the site over HTTPS, defeating downgrade attacks. See HSTS explained.

CSP

Content-Security-Policy, a header that lists which sources of scripts, styles and other content a page is allowed to load, sharply reducing the impact of cross-site scripting. See Content Security Policy for beginners.

XSS (cross-site scripting)

A vulnerability where an attacker injects malicious JavaScript that runs in other visitors’ browsers. A well-built Content-Security-Policy is one of the strongest mitigations.

Clickjacking

An attack that loads your site invisibly inside another page to trick users into clicking things they did not intend. Blocked with X-Frame-Options or CSP frame-ancestors. See X-Frame-Options and clickjacking.

MIME sniffing

When a browser guesses a file’s type instead of trusting the declared Content-Type, which can turn an uploaded file into executable script. See X-Content-Type-Options and MIME sniffing.

nosniff

The value of the X-Content-Type-Options header that tells browsers not to MIME-sniff, forcing them to honour the declared content type.

Referrer-Policy

A header controlling how much of the current URL is sent to other sites when a visitor follows a link, limiting accidental leakage of sensitive paths or parameters.

Permissions-Policy

A header that restricts which powerful browser features — camera, microphone, geolocation and others — a page and its embedded content may use.

Performance

TTFB

Time to First Byte, how long after a request the server sends the first byte of the response. It reflects server and network responsiveness. See What is TTFB?

Core Web Vitals

Google’s set of user-experience metrics — LCP, INP and CLS — used to gauge loading, responsiveness and visual stability, and factored into search rankings. See Core Web Vitals explained.

LCP (Largest Contentful Paint)

The time it takes for the largest visible element — usually a hero image or headline — to render. A good LCP is under 2.5 seconds.

INP (Interaction to Next Paint)

A Core Web Vital measuring how quickly a page responds visually to user interactions such as taps and clicks across the whole visit. Lower is better.

CLS (Cumulative Layout Shift)

A measure of how much page content unexpectedly moves around while loading. Lower scores mean a more stable, less frustrating layout.

Brotli

A modern text-compression algorithm that typically shrinks HTML, CSS and JavaScript more than Gzip, so pages transfer faster. See Brotli vs Gzip.

Cache-Control

A response header that tells browsers and proxies how long they may reuse a stored copy of a resource before fetching it again, cutting repeat load times.

Infrastructure & protocols

DNS

The Domain Name System, the internet’s directory that translates a human-readable domain into the IP address of the server that hosts it. See How DNS works.

CDN

A Content Delivery Network, a distributed set of servers that caches your site closer to visitors for faster loading and greater resilience. See What is a CDN?

HTTP/2

A major revision of the HTTP protocol that lets a browser fetch many resources over a single connection at once, improving load performance over HTTP/1.1.

HTTP/3

The newest version of HTTP, built on QUIC instead of TCP, which reduces connection setup time and handles unreliable networks more gracefully.

QUIC

A modern transport protocol running over UDP that underpins HTTP/3, combining encryption and faster connection establishment into one step.

Privacy & compliance

GDPR

The EU’s General Data Protection Regulation, which governs how organisations collect, use and protect the personal data of people in the EU. See GDPR website checklist.

NIS2

An EU directive raising baseline cybersecurity requirements for a broad range of essential and important organisations across the bloc. See The NIS2 directive explained.