Security glossary
Plain-English definitions of the web-security terms that decide whether your site is safe: unsafe-inline, script-src, SPF, DKIM, DMARC, CAA, CSP, XSS, clickjacking, HSTS and more. Every term here also appears as a hover explainer throughout the field manual.
- 'unsafe-eval'CSP keyword
- A CSP value permitting eval() and other string-to-code execution. It lets an attacker turn plain data into running code, keep it out of script-src.
- 'unsafe-inline'CSP keyword
- A Content-Security-Policy value that lets the browser run inline scripts or styles written directly in the page. In script-src it's the danger switch, it re-enables exactly the inline execution that injected XSS needs. Replace it with per-script hashes or a nonce.
- ~allSPF qualifier
- The SPF 'soft fail' qualifier: mail from servers not on your list is marked suspicious rather than hard-rejected, the recommended starting posture.
- base-uriCSP directive
- Restricts the page's <base> tag so an attacker can't silently rewrite every relative URL on the page.
- CAATLS / PKI
- Certification Authority Authorization: a DNS record naming which certificate authorities may issue TLS certificates for your domain, blocking rogue or mistaken issuance.
- clickjackingAttack
- An attack that invisibly frames your real site over a decoy, so victims click genuine buttons without knowing. Blocked by frame-ancestors or X-Frame-Options.
- connect-srcCSP directive
- Controls fetch(), XHR and WebSocket destinations, it limits where injected script could phone home or exfiltrate data.
- CSPHTTP header
- Content-Security-Policy: a response header that whitelists exactly which scripts, styles, images and connections a page may use, so an injected payload simply has no permission to run.
- default-srcCSP directive
- The CSP fallback directive, any resource type without its own rule (script, style, image, font…) inherits this one.
- DKIMEmail auth
- DomainKeys Identified Mail: a cryptographic signature added to your outgoing email and verified against a public key in your DNS. Unlike SPF, it survives forwarding.
- DMARCEmail auth
- Domain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you.
- DNSInfrastructure
- The Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain.
- form-actionCSP directive
- Limits where forms are allowed to submit, so a hijacked form cannot POST credentials to an attacker-controlled server.
- frame-ancestorsCSP directive
- The CSP directive deciding who may embed your page in an <iframe>. Set to 'none' to make clickjacking impossible.
- HSTSHTTP header
- HTTP Strict Transport Security: a header that forces browsers to always use HTTPS for your domain, defeating downgrade and SSL-strip attacks.
- nonceCSP technique
- A one-time random token placed in your CSP and on each allowed inline script per page load, it proves the script is yours without opening up all inline scripts.
- p=noneDMARC policy
- DMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes.
- p=quarantineDMARC policy
- DMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox.
- p=rejectDMARC policy
- The strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes.
- script-srcCSP directive
- The CSP directive that controls which scripts a page may load and execute. It is the single most important directive for stopping cross-site scripting (XSS).
- security.txtDisclosure
- An RFC 9116 standard file at /.well-known/security.txt that publishes how a researcher should report a vulnerability to you.
- sha256 hashCSP technique
- A fingerprint of an inline script's exact contents. Listing the hash in script-src authorizes that one specific script without needing 'unsafe-inline'.
- SPFEmail auth
- Sender Policy Framework: a DNS record listing which mail servers are allowed to send email as your domain, so spoofed senders get flagged.
- style-srcCSP directive
- The CSP directive for stylesheets and inline styles. 'unsafe-inline' here is low-risk because inline style attributes can't be hashed, and CSS injection is far less dangerous than script injection.
- X-XSS-ProtectionLegacy header
- A deprecated header for a long-removed browser XSS filter that could itself introduce bugs. The correct modern value is 0 (off); rely on CSP instead.
- XSSAttack
- Cross-Site Scripting: an attack that injects attacker-controlled JavaScript into your page to steal sessions, keylog, or act as the user. A strong CSP is the primary defense.