The jargon, in plain English.

A Content-Security-Policy is a rule your website sends to the browser listing which scripts, styles and images are allowed to load. Anything not on the list is blocked, so a script an attacker manages to inject never runs.

Security headers are short instructions your server sends with every page, telling the browser how to treat it — whether other sites may embed it, whether to insist on HTTPS, whether to guess at file types. Nothing breaks when they are missing, which is why they usually are.

HSTS is a header that tells a browser to only ever reach your site over HTTPS, even if a link says http. Once the browser has seen it, it upgrades the connection itself rather than making the insecure request first.

A TLS certificate is the file that proves your website is really yours and encrypts the connection to it. It is what puts HTTPS and the padlock in the address bar, and it expires on a fixed date.

An API key is a password your website uses to identify itself to another service — Stripe, a database, an email provider. Anyone holding it can act as you on that service, which is why a key in your page source is the most serious thing an audit can find.

An environment variable is a setting stored outside your code — a database password, an API key — so it never gets committed or published. Whether it stays private depends entirely on how it is named and where it is read.

Row-level security is a rule inside your database saying which rows each user may see or change. Without it, anything that can reach the database can read all of it, no matter how careful your application code is.

noindex is an instruction telling search engines to leave a page out of their results entirely. It works exactly as intended, which is the problem: on a page you wanted found, it is invisible and total.

A canonical tag tells search engines which address is the real one for a page, when the same content is reachable at several URLs. It stops your own pages competing with each other.

robots.txt is a file at the root of your site telling crawlers which parts they may fetch. It controls crawling, not indexing — a page blocked here can still appear in results if other sites link to it.

A sitemap is a file listing every page on your site you want found, so search engines are told directly rather than having to discover each one by following links.

Core Web Vitals are three measurements Google uses to judge how a page feels to a real visitor: how long the main content takes to appear, how much the layout jumps while loading, and how quickly it responds to a tap.

Layout shift is content moving on the page while it loads — a button sliding down as an image finishes arriving above it. It is measured because it is the thing that makes people tap what they did not mean to tap.

Alt text is a short written description attached to an image, read aloud by screen readers and shown if the image fails to load. Without it, someone using a screen reader hears only the word "image".

Mixed content is a secure HTTPS page loading something over insecure HTTP. Browsers block most of it outright, so the usual symptom is part of your page silently not working.

llms.txt is a plain-text file at the root of a site summarising what it is and does, in a form AI assistants can read and quote cheaply. It is a proposed convention rather than an official standard.

Structured data is machine-readable information embedded in a page saying what it is — a product, an FAQ, an article — so search engines can show it as more than a blue link.

Cross-site scripting is when someone gets their own JavaScript to run on your pages, usually by submitting it somewhere your site later displays without escaping it. Their code then has the same access to your visitors as your own.