Security & Privacy
Keeping sites and visitors safe: attacks, defences, logins and privacy law.
Backups
Backups are regular copies of a website's files and data kept separately, so the site can be restored after a mistake, failure or attack.
CCPA
The CCPA, amended by the CPRA, is California's privacy law giving residents rights to know, delete and opt out of the sale or sharing of their personal information.
Content Security Policy
A Content Security Policy is a response header that tells the browser which sources of scripts, styles, images and frames a page may load, blocking injected code.
Cookie consent
Cookie consent is asking visitors' permission before setting non-essential cookies, such as analytics and advertising trackers, as privacy laws require in many regions.
CORS
CORS is the browser rule that controls whether a page on one domain may request data from another domain, enforced through response headers the server sends.
Cross-site request forgery
Cross-site request forgery tricks a logged-in user's browser into sending an unwanted request, such as changing an email address, to a site they trust.
Cross-site scripting
Cross-site scripting is an attack where malicious code is injected into a page and runs in other visitors' browsers, stealing sessions or data.
DDoS attack
A DDoS attack floods a website with traffic from many machines at once to overwhelm it and knock it offline.
GDPR
GDPR is the European Union's data protection law, governing how sites collect, use and store personal data about people in the EU, with consent and rights to access and deletion.
JWT
A JWT is a compact, signed token that carries a user's identity and permissions between a browser and server after they log in.
Malware
Malware on a website is malicious code, often injected through a vulnerable plugin, that redirects visitors, spams search results or steals data.
OAuth
OAuth is the standard behind sign in with Google, Apple or GitHub, letting a site verify a user through another provider without handling their password.
Passkeys
Passkeys replace passwords with cryptographic keys stored on a device and unlocked by fingerprint, face or PIN, and cannot be phished or reused.
Privacy policy
A privacy policy is a public page explaining what personal data a website collects, why, who it is shared with and how visitors can exercise their rights.
Rate limiting
Rate limiting caps how many requests one visitor or IP can make in a period, protecting logins, forms and APIs from abuse and brute-force attacks.
SQL injection
SQL injection is an attack that slips database commands into form fields or URLs, letting an attacker read or change data the site never meant to expose.
Two-factor authentication
Two-factor authentication requires a second proof of identity, such as an app code or security key, in addition to a password to log in.
Web application firewall
A web application firewall filters incoming requests to a website and blocks known attack patterns before they reach the application.
Website security
Website security is protecting a site, its data and its visitors from attacks, through HTTPS, updated software, careful input handling, strong logins and backups.