The website glossary.

227 terms you will hear when planning, building and securing a website, explained in plain English. Includes 56 cybersecurity terms every business owner should know.

Search 227 terms

Cybersecurity 56SEO & AEO 31Hosting & infrastructure 19Design & UX 19AI 9Platforms & CMS 25Development 22Analytics & marketing tech 15Performance 16Ecommerce 15

#

3-2-1 backup rule Cybersecurity

Keep three copies of your data, on two different types of storage, with one copy offsite.

The 3-2-1 rule protects you if a server fails, a provider has an outage or ransomware hits your main systems. Many teams add an offline or immutable copy that attackers cannot change. It is simple to follow and widely recommended.

301 redirect SEO & AEO

A permanent redirect that sends visitors and search engines from an old URL to a new one.

When URLs change during a redesign or migration, 301 redirects keep visitors from hitting dead ends and carry most ranking value to the new page. Skipping a redirect plan is one of the fastest ways to lose search traffic after a relaunch. Map every important old URL before launch.

302 redirect SEO & AEO

A temporary redirect that sends visitors to another URL while signaling the original will return.

302s are for short-term moves, like a seasonal promotion. Using one when a move is permanent can confuse search engines about which page to rank. When in doubt about a permanent change, use a 301.

Related:301 redirect 404 error

404 error SEO & AEO

The "page not found" response a server returns when a URL does not exist.

A few 404s are normal, but broken links from your own pages or from popular old URLs waste visitors and lost link value. Redirect valuable old URLs and make your 404 page helpful with search and key links. Search Console reports the ones Google finds.

A

A record Hosting & infrastructure

A DNS record that points a domain or subdomain to a specific IPv4 server address.

The A record is usually what sends visitors from your domain to your web server. Updating it is a key step when moving hosts. Lowering the TTL before a move helps the change take effect faster.

A/B test Design & UX

Showing two versions of a page or element to different visitors to see which performs better.

A/B tests replace opinions with evidence. They need enough traffic and a clear goal to give reliable answers, so low-traffic sites may get more from user research. Test one meaningful change at a time.

Above the fold Design & UX

The part of a page visible before scrolling.

This area sets the first impression, so it should say what you do and offer a clear next step. People do scroll, so not everything needs to be crammed in. Heavy media here can hurt loading speed.

Access control Cybersecurity

The rules and roles that decide who can see or change what in a system.

Role-based access lets you give writers, editors, store managers and developers just the permissions they need. Clear roles make audits easier and reduce accidental damage. Remove access promptly when someone leaves.

Accessibility Design & UX

Designing and building a site so people with disabilities can use it, including with screen readers and keyboards.

Accessible sites serve more customers, reduce legal risk and are usually easier for everyone to use. It covers color contrast, alt text, keyboard navigation, captions and clear forms. Building it in from the start is far cheaper than retrofitting.

ADA (Americans with Disabilities Act) Design & UX

A US civil rights law that courts have applied to websites, making inaccessible sites a legal risk.

Businesses have faced demand letters and lawsuits over websites that people with disabilities cannot use. There is no single checklist in the law for private business sites, so WCAG AA is the usual benchmark. Accessibility overlay widgets alone do not reliably fix the underlying problems.

Related:Accessibility WCAG Alt text

AI agent AI

An AI system that can take actions, such as searching, filling forms or calling APIs, to complete a task.

Agents go beyond answering questions to actually doing work, which makes them powerful and riskier. Give them only the access they need and keep a human in the loop for anything consequential. They are also starting to browse and buy on behalf of users, which affects how sites are built.

AI chatbot AI

A chat assistant on a website that uses an LLM to answer visitor questions in natural language.

A well-built chatbot can answer common questions, qualify leads and book appointments at any hour. Grounding it in your own approved content reduces wrong answers. It needs guardrails, clear handoff to a human, and care with personal data.

AI Overviews SEO & AEO

AI-generated summaries Google shows at the top of some search results, with links to sources.

AI Overviews can answer a question before anyone clicks, which changes how search traffic flows. Being cited as a source keeps your brand visible even when clicks drop. Clear, well-structured, trustworthy content gives you the best chance.

AI website builder Platforms & CMS

A tool that generates a working website or app from a text prompt, such as Bolt or Lovable.

AI builders can produce a site quickly, which is great for prototypes and small launches. The output still needs care: security, SEO, analytics, accessibility and ongoing fixes do not take care of themselves. Plan for someone to own and maintain the site after launch.

Related:Vibe coding Wix Framer

Alt text Design & UX

A short written description of an image that screen readers read aloud and search engines use.

Alt text makes images understandable to people who cannot see them and helps search engines and AI tools understand your content. Describe what matters in the image in context. Purely decorative images should have empty alt text so they are skipped.

Answer engine optimization (AEO) SEO & AEO

Structuring content so AI assistants and search features can pull it as a direct answer to a question.

People increasingly get answers from AI tools and search summaries instead of clicking ten blue links. AEO means answering questions clearly up front, using structured data and building trust signals so your business is the source quoted. It builds on good SEO rather than replacing it.

API Development

A defined way for two pieces of software to request and exchange data with each other.

APIs let your website talk to your CRM, payment gateway, inventory system or headless CMS. Good integrations remove manual copy-and-paste work and data errors. When choosing tools, the quality of their API often matters as much as their features.

Astra Platforms & CMS

A lightweight, fast WordPress theme often paired with Gutenberg or a page builder.

Astra is designed to load quickly and stay out of the way, giving you a lean base to build on. It is a common choice when a WordPress site needs good speed without a fully custom theme. The overall result still depends on which plugins and builders are layered on top.

Attribution Analytics & marketing tech

Deciding which marketing touchpoints get credit for a lead or sale.

Most customers interact with several channels before buying. Attribution models, from last click to data-driven, assign credit differently, which changes how you judge channels. No model is perfect, so use it alongside common sense and CRM data.

AVIF Performance

A newer image format that often compresses even smaller than WebP at similar quality.

AVIF can produce very small files, which helps image-heavy sites load faster. Encoding takes more processing, and support in some tools is still catching up. Many sites serve AVIF where supported and fall back to WebP or JPEG.

B

B2B pricing Ecommerce

Customer-specific prices, volume tiers, quotes and payment terms for business buyers.

Wholesale and B2B buyers expect their negotiated prices, purchase orders and net terms online. Not every platform supports this well out of the box. Getting it right lets sales reps spend less time on routine orders.

Back end Development

The server-side part of a website that stores data, runs business logic and connects to other systems.

The back end handles things like user accounts, form processing, orders and integrations with your CRM or ERP. You rarely see it, but it decides how reliable and secure the site is. Headless setups split the back end from the front end entirely.

Related:Front end API Headless CMS

Backlink SEO & AEO

A link from another website to yours.

Links from reputable, relevant sites remain an important signal of trust for search engines and, increasingly, for AI tools. Buying links or using link schemes risks penalties. Earned mentions from partners, press and industry groups are the safe route.

Backups Cybersecurity

Copies of your website files, database and settings that let you restore the site after a problem.

Backups are your safety net against hacks, bad updates and human error. They must be automatic, stored somewhere separate from the site, and tested by actually restoring them. A backup you have never restored is only a hope.

BigCommerce Ecommerce

A hosted ecommerce platform strong in B2B features, large catalogs and running several storefronts.

BigCommerce is our pick for B2B sellers, large catalogs and multi-storefront setups. It includes features like customer-specific pricing and works well headless. Its app ecosystem is smaller than Shopify's, so check that the integrations you need exist.

Bot protection Cybersecurity

Tools that detect and block automated traffic like spam bots, scrapers and login attackers.

Bots fill forms with spam, scrape content and hammer login pages. Bot protection uses behavior, reputation and challenges to separate people from scripts. Many CDNs include it, and it reduces load on your server too.

Browser caching Performance

Telling visitors' browsers to keep copies of files like images and stylesheets so repeat visits load faster.

When files are cached in the browser, returning visitors do not download them again. It is set with server headers and costs nothing to run. It mainly speeds up second and later page views.

Brute force attack Cybersecurity

Guessing a password by automatically trying huge numbers of combinations.

Login pages, especially well-known ones like the WordPress admin, are constantly hit by brute force bots. Strong unique passwords, MFA, login limits and a WAF stop most of them. Weak admin passwords remain a common cause of hacked sites.

Business email compromise (BEC) Cybersecurity

A scam where criminals impersonate or take over a business email account to redirect payments or steal data.

BEC often looks like a vendor changing bank details or an executive urgently requesting a wire. It causes some of the largest financial losses of any cybercrime. MFA, DMARC and a rule to verify payment changes by phone are strong defenses.

C

Caching Performance

Storing ready-made copies of pages or files so they can be delivered faster the next time.

Caching happens at several levels: in the browser, on the server and on a CDN. Good caching makes sites faster and reduces server load during traffic spikes. Poorly configured caching can show visitors outdated content, so it needs thoughtful setup.

Call to action (CTA) Design & UX

A prompt that tells visitors the next step to take, such as "Book a call" or "Get a quote."

Clear CTAs turn interest into leads. Each page should make its main action obvious and easy to complete. Vague or competing CTAs leave visitors unsure what to do.

Canonical tag SEO & AEO

A tag that tells search engines which URL is the main version when similar or duplicate pages exist.

Duplicate versions of a page (from filters, tracking codes or http vs. https) can split ranking signals. A canonical tag points search engines to the preferred URL. It is especially important on ecommerce sites with product variations.

CAPTCHA Cybersecurity

A challenge, such as clicking a box or picking images, used to tell humans from bots on forms and logins.

CAPTCHAs cut form spam and automated logins. Old-style puzzles frustrate people and can hurt accessibility, so many sites now use invisible or low-friction checks. Use them where spam or abuse is a real problem.

Cart abandonment Ecommerce

When shoppers add items to a cart but leave without completing the purchase.

Some abandonment is normal, but high rates often point to unexpected shipping costs, slow pages or a clunky checkout. Fixing those issues and sending reminder emails can recover lost sales. Track it in your analytics to see where people drop off.

Checkout Ecommerce

The steps a shopper takes to enter shipping and payment details and complete an order.

Checkout is where sales are won or lost. Extra steps, surprise costs and forced account creation are common reasons people leave. Fast, mobile-friendly checkout with familiar payment options usually pays for itself.

Child theme Platforms & CMS

A WordPress theme that inherits a parent theme and holds your customizations so updates do not overwrite them.

If you edit a theme directly, the next theme update can erase your changes. A child theme keeps those changes separate, so the parent can be updated safely for security fixes. It is a small setup step that prevents a common and expensive mistake.

Client-side rendering (CSR) Development

Sending a mostly empty page and letting JavaScript in the browser build the content.

CSR works well for app-like tools behind a login. For public marketing pages it can slow the first view and make content harder for some crawlers and AI tools to read. We usually pair it with server or static rendering for anything that needs to rank.

Cloud hosting Hosting & infrastructure

Hosting that runs on large pools of servers so resources can scale up or down as traffic changes.

Cloud hosting handles traffic spikes better than a single server and can be very reliable when set up well. Pricing is often usage-based, so costs need monitoring. Platforms built for modern frameworks hide much of the complexity.

CNAME record Hosting & infrastructure

A DNS record that points one domain name to another name instead of to an IP address.

CNAMEs are common for subdomains, such as pointing www to your hosting platform or a shop subdomain to an ecommerce provider. They let the provider change server addresses without you editing DNS. They are often required when connecting third-party services.

Code splitting Performance

Breaking a site's JavaScript into smaller pieces so each page loads only the code it needs.

Without code splitting, visitors may download code for the whole site just to read one page. Splitting keeps pages lighter and more responsive. Frameworks like Next.js do much of this automatically.

Color contrast Design & UX

The difference in brightness between text and its background, which affects readability.

Low-contrast text is hard to read for many people, especially on phones in sunlight or for those with low vision. WCAG sets minimum contrast ratios. Checking brand colors early avoids painful redesigns later.

Related:WCAG Accessibility Style guide

Composable architecture Platforms & CMS

Building a digital stack from separate best-of-breed services (CMS, commerce, search) connected through APIs.

Instead of one platform doing everything, a composable setup lets you swap or upgrade individual pieces as needs change. It offers flexibility and performance, but more moving parts means more integration work and vendor management. It is most useful for growing businesses with real complexity.

Content block Platforms & CMS

A reusable component of content, such as a hero, testimonial or FAQ section, that editors can arrange on a page.

Content blocks let your team build new pages from approved, on-brand pieces. Update a block once and every page that uses it can change with it. Blocks are the bridge between a design system and a CMS.

Content delivery network (CDN) Hosting & infrastructure

A network of servers around the world that stores copies of your site's files and serves them from the closest location.

A CDN makes pages load faster for visitors far from your main server and absorbs traffic spikes. Many CDNs also provide security features like a web application firewall and DDoS protection. For most business sites it is one of the easiest speed wins.

Content management system (CMS) Platforms & CMS

Software that lets non-developers create, edit and publish website content without touching code.

A CMS separates your content (pages, posts, products, images) from the code that displays it, so your team can update the site through an admin screen. The right CMS decides how easy daily edits are, how far the site can grow, and how much you depend on a developer. WordPress, Webflow, Contentful and Sanity are all content management systems, built for very different jobs.

Content model Platforms & CMS

The blueprint that defines what types of content a site has and which fields each one contains.

A content model spells out, for example, that a "location" has an address, hours, photos and a phone number. Getting it right makes content reusable, consistent and easy to edit, and it feeds schema markup and AI search. A poor content model is one of the most common reasons a site becomes hard to manage.

Content Security Policy (CSP) Cybersecurity

A security header that tells browsers which sources of scripts, styles and other content a page may load.

A CSP limits the damage from XSS and compromised third-party scripts by blocking anything not on your approved list. It takes careful setup, since a strict policy can break legitimate tools. Starting in report-only mode helps you tune it safely.

Content type Platforms & CMS

One kind of structured content in a CMS, such as a blog post, product, event or team member.

Each content type has its own fields and templates, so editors fill in a form instead of designing from scratch. Clear content types keep pages consistent and make it easy to list, filter and reuse content around the site.

Contentful Platforms & CMS

A popular headless CMS built around structured content models and reusable content blocks.

Contentful stores content as structured entries that any site or app can request through an API. Teams define content models once and reuse components across pages and channels. It fits organizations with several sites, regions or apps that need consistent content.

Conversion rate optimization (CRO) Design & UX

Systematically improving a site so a larger share of visitors take a desired action, like calling or buying.

CRO uses analytics, user research and testing to find and fix what stops people from converting. Small improvements on key pages can add up to meaningful revenue without more traffic. It works best as an ongoing habit, not a one-time project.

Conversion tracking Analytics & marketing tech

Measuring when visitors complete valuable actions so you can tie results back to marketing.

Without conversion tracking, you cannot tell which ads, pages or campaigns bring in leads and sales. It connects your site to analytics and ad platforms. Accurate tracking is the difference between guessing and managing a marketing budget.

Conversions API (server-side tracking) Analytics & marketing tech

Sending conversion data from your server directly to ad platforms instead of relying only on browser tags.

Server-side tracking is more resilient to ad blockers and browser restrictions, which helps ad platforms optimize. It must respect user consent and privacy laws. It takes more setup than a simple browser pixel.

Core Web Vitals Performance

Google's three user-experience metrics for loading speed (LCP), responsiveness (INP) and visual stability (CLS).

Core Web Vitals measure how real visitors experience your pages and are part of Google's page experience signals. More importantly, slow or jumpy pages frustrate people and cost conversions. Google reports them in Search Console and PageSpeed Insights using real-user data.

Crawl budget SEO & AEO

Roughly how many pages a search engine is willing to crawl on a site in a given period.

Crawl budget mostly matters for large sites with thousands of URLs, like big catalogs. Wasting it on duplicate, filtered or broken pages can delay important pages from being found. Small sites rarely need to worry about it.

Related:Crawling Indexing Canonical tag

Crawling SEO & AEO

How search engine bots discover pages by following links and reading sitemaps.

If a page cannot be crawled, it cannot be ranked. Broken links, blocked resources and orphan pages with no internal links all get in the way. Good internal linking and a clean sitemap make crawling easy.

Credential stuffing Cybersecurity

Using usernames and passwords stolen from one breach to log in to other sites.

Because people reuse passwords, a leak from an unrelated service can unlock your site, email or bank. Unique passwords from a password manager and MFA shut this down. Sites with customer logins should also watch for unusual login patterns.

CRM Analytics & marketing tech

Customer relationship management software that stores contacts, leads, deals and conversations in one place.

Connecting your website forms to a CRM like HubSpot or Salesforce means no lead gets lost in an inbox. It lets sales follow up quickly and lets you see which marketing produces revenue, not just form fills. It is often the most valuable integration a business site has.

Cross-site request forgery (CSRF) Cybersecurity

An attack that tricks a logged-in user's browser into making an unwanted request, like changing a setting.

CSRF abuses the trust a site has in a logged-in user. Well-built applications use tokens and cookie settings to block it. It is another reason to keep CMS core and plugins updated.

Cross-site scripting (XSS) Cybersecurity

An attack that injects malicious scripts into a web page so they run in other visitors' browsers.

XSS can steal sessions, deface pages or redirect users. It usually comes from code that displays user input without cleaning it, often in plugins. Secure coding, updates and a Content Security Policy reduce the risk.

CSS Development

The style language that controls a page's layout, colors, fonts and responsive behavior.

CSS turns structured HTML into your brand's visual design. Well-organized CSS keeps pages fast and makes design changes predictable. Large unused stylesheets slow pages down, which is why minification and trimming matter.

Cumulative Layout Shift (CLS) Performance

A score for how much page content unexpectedly jumps around while loading. Good is 0.1 or less.

Layout shifts make people tap the wrong button or lose their place. Common causes are images without set dimensions, late-loading ads and fonts that swap. These are usually simple to fix once identified.

Custom post type Platforms & CMS

A WordPress content type beyond posts and pages, such as team members, locations or case studies.

Custom post types let WordPress store structured content with its own fields and templates. Instead of cramming everything into pages, your team fills in a simple form and the design stays consistent. It is the WordPress version of a content model.

CVE Cybersecurity

Common Vulnerabilities and Exposures: the public catalog that gives each known security flaw a unique ID.

CVE IDs let security tools and vendors talk about the same flaw precisely. Scanners match your installed software against CVEs to flag risks. Watching CVEs for your CMS and plugins tells you when updates are urgent.

D

Data breach Cybersecurity

An incident where sensitive, protected or personal information is accessed or exposed without authorization.

Breaches bring cleanup costs, lost trust and, in many cases, legal duties to notify affected people under state and industry rules. Collect only the data you need, protect what you keep, and know your notification obligations. An incident response plan shortens the damage.

DDoS attack Cybersecurity

Distributed denial of service: flooding a site with traffic from many machines to knock it offline.

DDoS attacks can take a site down for hours and are cheap for attackers to launch. CDNs and DDoS protection services absorb and filter the flood. Any business that cannot afford downtime should have this in place.

Dedicated server Hosting & infrastructure

A physical server rented entirely to one customer.

Dedicated servers offer full control and consistent performance for heavy workloads. They cost more and require skilled administration. Today many businesses get similar results more flexibly with cloud hosting.

Design system Design & UX

A shared library of reusable components, styles and rules that keeps a brand's digital products consistent.

A design system defines buttons, forms, typography, colors and page sections once so every new page matches. It speeds up design and development and reduces one-off fixes. It pairs naturally with content blocks in a CMS.

Digital experience platform (DXP) Platforms & CMS

An enterprise software suite that manages content, personalization, commerce and analytics across many channels.

A DXP goes beyond a CMS by tying content to customer data so different visitors can see different experiences. These platforms are built for large brands with many sites, regions and teams. For most small and mid-sized businesses, a well-chosen CMS plus a few integrations does the job at far lower cost.

Divi Platforms & CMS

A WordPress theme and visual page builder made by Elegant Themes.

Divi bundles a theme and a drag-and-drop builder in one product, with many prebuilt layouts. It is approachable for owners who want to edit visually. Like other builders, content is tied closely to the tool, so switching away later usually means rebuilding pages.

DKIM Cybersecurity

DomainKeys Identified Mail: a digital signature on outgoing email that proves it was not altered and came from your domain.

DKIM adds a signature that receiving servers check against a key in your DNS. It improves deliverability and makes spoofing harder. Each service that sends mail for you should be set up with its own DKIM key.

Related:SPF DMARC TXT record

DMARC Cybersecurity

A DNS policy that tells mail servers what to do with email that fails SPF or DKIM checks, and sends you reports.

DMARC is what actually stops criminals from sending email as your domain. Start by monitoring, fix legitimate senders, then move to quarantine or reject. Major mailbox providers now require it for bulk senders, so it also protects deliverability.

DNS (Domain Name System) Hosting & infrastructure

The internet's address book, translating domain names into the server addresses computers use.

DNS records tell the world where your website, email and other services live. A wrong record can take your site or email down, so changes should be planned and documented. DNS is also where email authentication records like SPF, DKIM and DMARC are published.

DNSSEC Cybersecurity

DNS Security Extensions: digital signatures on DNS records that let resolvers detect forged answers.

DNSSEC helps stop attackers from secretly redirecting visitors to fake servers. It must be supported and set up at both your DNS provider and registrar. When changing DNS providers, it needs careful handling to avoid an outage.

Domain hijacking Cybersecurity

When an attacker takes control of a domain, often through a compromised registrar account, and redirects the site or email.

A hijacked domain can send your visitors and email to criminals. Protect the registrar account with MFA, keep contact emails current, and enable registrar lock. Make sure the domain is in an account your business owns.

Domain name Hosting & infrastructure

Your website's human-readable address, such as example.com.

Your domain is a core business asset, used for your website and usually your email. Register it in an account your business controls, not a former vendor's. Losing access to it can take your site and email offline.

Domain registrar Hosting & infrastructure

The company you buy and renew a domain name through.

The registrar holds the keys to your domain, including where its DNS points. Protect that account with strong passwords and multi-factor authentication, keep contact details current, and turn on auto-renew. Expired or hijacked domains are a painful and avoidable problem.

Duplicate content SEO & AEO

The same or very similar content appearing at more than one URL, on your site or across sites.

Duplicate content rarely causes a penalty, but it confuses search engines about which page to rank. That can dilute visibility. Canonical tags, redirects and unique copy for each page keep things clear.

E

E-E-A-T SEO & AEO

Google's shorthand for Experience, Expertise, Authoritativeness and Trustworthiness, used to judge content quality.

E-E-A-T comes from Google's search quality rater guidelines. It is not a single ranking factor, but it describes what Google wants to reward: content from people who know the subject, with clear authorship and a trustworthy business behind it. It matters most for health, finance, legal and other high-stakes topics.

Edge functions Development

Small pieces of server code that run on CDN locations close to the visitor instead of in one central data center.

Edge functions can handle redirects, personalization, A/B tests and security checks with very little delay. Because they run near the user, they help pages respond quickly worldwide. They are best for light, fast tasks rather than heavy processing.

Elementor Platforms & CMS

A popular drag-and-drop page builder plugin for WordPress.

Elementor gives editors visual control over layouts, templates and widgets inside WordPress. It works well for marketing teams who want to change pages themselves. It needs careful setup to stay fast, and its own add-on plugins should be kept updated like any other plugin.

Embeddings AI

Lists of numbers that represent the meaning of text, so software can find content with similar meaning.

Embeddings let a search tool find "cancel my plan" when your page says "end your subscription." They power smart site search and RAG chatbots. They are stored and searched in a vector database.

Encryption at rest Cybersecurity

Protecting stored data, such as databases, backups and files, so it is unreadable without the key.

If a server, laptop or backup is stolen, encryption at rest keeps the data useless to the thief. Most reputable cloud and hosting providers offer it, but it should be confirmed, especially for regulated data. Protecting the keys matters as much as the encryption.

Encryption in transit Cybersecurity

Protecting data while it moves between systems, such as from a browser to a server, so it cannot be read along the way.

TLS is the standard way to encrypt web traffic in transit. It should cover your website, forms, APIs and connections to databases and third-party services. It is a baseline expectation for any site handling personal data.

Event tracking Analytics & marketing tech

Recording specific actions on a site, such as clicks, form submissions, video plays or downloads.

Page views alone do not tell you what people did. Event tracking shows which buttons, forms and content actually drive results. It is the foundation for conversion tracking and attribution.

F

Featured snippet SEO & AEO

A highlighted answer box Google sometimes shows at the top of results, quoted from one web page.

Featured snippets give one page prime placement for a question. Pages that answer clearly and concisely, often with a short paragraph, list or table, are more likely to be chosen. The same habits help with AI answers.

File integrity monitoring Cybersecurity

Watching a site's files for unexpected changes that could signal a hack.

Attackers often modify core files or slip in hidden scripts. Integrity monitoring alerts you when files change outside planned updates. Fast detection means faster cleanup and less damage.

First Contentful Paint (FCP) Performance

The moment the browser first shows any text or image on the page.

FCP tells you when visitors first see that something is happening. A slow FCP makes people think the site is broken and leave. It is closely tied to server speed and render-blocking resources.

Framer Platforms & CMS

A design-first website builder that grew out of a prototyping tool, popular for fast, animated marketing sites.

Framer lets designers publish polished sites with motion and responsive layouts quickly. It suits startups and small marketing sites that change often. As with any hosted builder, you are tied to its platform, plans and feature limits.

Front end Development

The part of a website people see and interact with in the browser.

Front-end work covers layout, design, interactivity and speed in the browser. It is what visitors judge your business on in the first few seconds. A strong front end is fast, accessible and works well on phones.

G

Generative engine optimization (GEO) SEO & AEO

Improving how often and how accurately AI tools like ChatGPT, Gemini and Perplexity mention and cite your business.

Generative AI tools summarize the web, and GEO aims to make your content easy for them to understand and trust. That means clear facts, consistent business information across the web, expert content and mentions on reputable sites. The field is young, so be wary of anyone promising guaranteed results.

Google Analytics 4 (GA4) Analytics & marketing tech

Google's current web analytics platform, which measures visits and actions as events.

GA4 replaced Universal Analytics, which stopped processing data in 2023. It tracks how people find and use your site and which actions count as key events. It needs deliberate setup to measure what matters to your business, not just page views.

Google Business Profile SEO & AEO

Google's free business listing that appears in Maps and local search results.

Your profile shows hours, reviews, photos and directions, and is often the first thing local customers see. Keep it complete and accurate, respond to reviews and post updates. Make sure it is owned by a business account you control.

Google Search Console SEO & AEO

A free Google tool that shows how your site performs in search and flags indexing and technical issues.

Search Console shows the queries people use to find you, which pages are indexed, and problems like crawl errors or Core Web Vitals issues. It is essential during and after a redesign. It should be set up for every business site.

Google Tag Manager (GTM) Analytics & marketing tech

A free tool for adding and managing tracking codes on a site without editing code each time.

GTM lets marketers install analytics, ad pixels and conversion tags from one dashboard. It speeds up campaigns and keeps tracking organized. Too many tags can slow a site and leak data, so it needs governance.

GraphQL Development

A query language for APIs that lets the front end ask for exactly the data it needs in one request.

GraphQL can reduce the number of requests and the amount of data a page loads, which helps performance on complex sites. Many headless CMS and commerce platforms offer it. It adds some complexity, so it is used where the flexibility pays off.

Related:API REST API Headless CMS

Gutenberg (block editor) Platforms & CMS

The built-in WordPress editor that builds pages from reusable blocks such as paragraphs, images and columns.

Gutenberg replaced the old single text box in WordPress with a block-based editor. Well-built custom blocks let your team assemble on-brand pages without a heavy page builder plugin. That usually means cleaner code, faster pages and fewer things that can break during updates.

H

Hallucination AI

When an AI model states something false or made up with confidence.

Hallucinations are a real risk for customer-facing AI, especially on prices, policies or legal and medical topics. Grounding answers in your content, limiting scope and adding human review reduce the risk. Never let an AI make promises your business cannot keep.

Headless CMS Platforms & CMS

A CMS that stores and serves content through an API, with no built-in front end, so any site or app can display it.

A headless CMS lets one source of content feed a website, mobile app, kiosk or anything else. We use it when content must reach several channels or power a fast Next.js front end. It costs more to set up than a traditional CMS, and editors lose some of the instant visual preview unless it is built in.

Headless commerce Ecommerce

Running an ecommerce back end (products, cart, checkout) separately from a custom-built storefront.

Headless commerce lets brands build a fast, fully custom shopping experience while the platform handles orders and payments. It suits high-volume or content-rich brands. It costs more to build and maintain than a standard theme, so it should solve a real problem.

Heatmap Analytics & marketing tech

A visual report showing where visitors click, move and scroll on a page.

Heatmaps reveal whether people see your key content and calls to action or ignore them. They are a quick way to spot design problems. They should be configured to avoid capturing sensitive form data.

HIPAA Cybersecurity

The US law that protects patient health information and sets rules for how it is stored and shared.

Medical and health businesses must protect protected health information (PHI), including what visitors submit through website forms. Vendors handling PHI, such as form or hosting providers, typically need to sign a business associate agreement. Standard contact forms and many analytics tools are not HIPAA-ready by default.

Hreflang SEO & AEO

A tag that tells search engines which language or regional version of a page to show to which users.

If you have pages in several languages or for different countries, hreflang helps the right version appear in the right market. Mistakes are common and can cause the wrong page to rank. It needs careful, consistent setup across every version.

HSTS Cybersecurity

HTTP Strict Transport Security: a header telling browsers to only ever connect to your site over HTTPS.

HSTS closes the gap where a visitor might first reach an insecure version of your site, which attackers can exploit. Once set, browsers refuse plain HTTP connections. It should be enabled only after HTTPS works everywhere on the domain.

Related:HTTPS SSL/TLS Security headers

HTML Development

The markup language that structures web pages into headings, paragraphs, links, images and forms.

Every website ultimately sends HTML to the browser. Clean, semantic HTML helps search engines and AI tools understand your content, and helps screen readers serve people with disabilities. Messy markup from bloated tools can hurt all three.

Related:CSS JavaScript Accessibility

HTTPS Cybersecurity

The secure version of HTTP, where traffic between visitor and site is encrypted with TLS.

HTTPS protects logins, forms and payments from being read or altered in transit. Browsers flag non-HTTPS pages as not secure, and Google treats HTTPS as a ranking signal. Every page of a business site should use it.

Related:SSL/TLS HSTS Mixed content

Hydration Development

The step where JavaScript attaches interactivity to HTML that was already rendered on the server.

Hydration lets a page appear quickly and then become interactive. Heavy hydration can make a page look ready while buttons still feel sluggish, which shows up in INP scores. Good engineering keeps it light.

I

Image compression Performance

Reducing image file size while keeping visual quality acceptable.

Oversized images are one of the most common reasons business websites are slow. Compressing, resizing and serving modern formats can shrink files dramatically with little visible change. It is often the cheapest speed fix available.

Incident response plan Cybersecurity

A written plan for what to do, who to call and how to communicate when a security incident happens.

In a breach, confusion wastes hours. A plan names who decides, how to contain the problem, how to restore from backups, and who must be notified, including customers or regulators where required. Review and practice it at least once a year.

Related:Data breach Backups Ransomware

Incremental static regeneration (ISR) Development

A Next.js feature that rebuilds individual static pages in the background after they change.

ISR gives you the speed of static pages without rebuilding the whole site when one product or post is updated. It is ideal for large catalogs and content sites on a headless CMS. Editors publish, and the page refreshes shortly after.

Indexing SEO & AEO

When a search engine stores a page in its database so it can appear in search results.

Crawled pages are not always indexed: search engines skip pages they see as duplicate, low quality or blocked. Google Search Console shows which pages are indexed and why others are not. Checking it after a launch catches problems early.

Information architecture Design & UX

How a website's content is organized, labeled and connected so people can find things.

Good information architecture means visitors find services, pricing and contact details without thinking. It also shapes your URLs, navigation and internal links, which affects SEO. It is usually planned with a sitemap before design starts.

Interaction to Next Paint (INP) Performance

How quickly a page visibly responds after someone clicks, taps or types. Good is 200 milliseconds or less.

INP replaced First Input Delay as a Core Web Vital in 2024. Poor INP means buttons and menus feel laggy, usually because too much JavaScript is running. Trimming third-party scripts and heavy code usually helps most.

Internal linking SEO & AEO

Linking from one page on your site to another related page on the same site.

Internal links help visitors find more of what they need and help search engines understand which pages matter. They spread ranking value around the site. A thoughtful linking plan is one of the cheapest SEO improvements.

Inventory sync Ecommerce

Keeping stock levels consistent across your website, marketplaces, stores and warehouse systems.

Without syncing, you risk selling items you do not have or hiding items you do. Integrations through APIs or connectors keep counts current. It becomes essential once you sell in more than one place.

Related:SKU API Webhook

J

Jamstack Development

An approach that pre-builds pages and serves them from a CDN, pulling dynamic features in through APIs.

Jamstack stands for JavaScript, APIs and Markup. Pre-built pages load fast and have a smaller attack surface because there is no live database behind each page view. The idea has since blended into frameworks like Next.js that mix static and dynamic rendering.

JavaScript Development

The programming language that makes web pages interactive, from menus and forms to full web apps.

JavaScript runs in the browser and powers most interactivity online. Too much of it, especially from third-party tags, is a leading cause of slow, laggy pages. Keeping scripts lean improves speed and Core Web Vitals.

JSON-LD SEO & AEO

The format Google recommends for adding schema markup, written as a script block separate from visible content.

JSON-LD keeps structured data tidy and easy to maintain because it does not tangle with your page HTML. Most CMS SEO tools generate it, and custom builds can produce it from your content model. Test it with Google's Rich Results Test after changes.

K

Key event Analytics & marketing tech

An action in GA4 that you mark as important to your business, such as a lead form or purchase.

Google renamed GA4 conversions to key events in 2024, while Google Ads still uses the word conversions. Marking the right actions lets you see which channels and pages produce results. Too many key events blur the picture.

Keyword research SEO & AEO

Finding the words and questions your customers type into search engines and AI tools.

Keyword research tells you what people actually ask, how they phrase it, and how competitive it is. It shapes site structure, page topics and content plans. Without it, sites often target terms nobody searches.

L

Landing page Design & UX

A focused page built for one goal, often the destination for an ad or email campaign.

Landing pages remove distractions and match the promise of the ad that brought someone there. That focus usually converts better than sending traffic to a general home page. They are ideal for A/B testing.

Large language model (LLM) AI

An AI system trained on huge amounts of text to understand and generate language, such as the models behind ChatGPT, Claude and Gemini.

LLMs power AI chatbots, writing tools and AI search answers. They are increasingly how people research businesses, which is why AEO and GEO matter. They can also be built into your site for support, search or internal tools, with proper safeguards.

Largest Contentful Paint (LCP) Performance

How long it takes for the largest visible element, often a hero image or headline, to appear. Good is 2.5 seconds or less.

LCP reflects how fast a page feels like it has loaded. Large uncompressed images, slow servers and render-blocking code are the usual culprits. Fixing LCP is often the biggest perceived speed improvement you can make.

Lazy loading Performance

Delaying the loading of images, videos or other content until a visitor scrolls near it.

Lazy loading cuts the amount of data a page loads up front, making it faster on phones and slow connections. It should not be applied to the main hero image, since that delays LCP. Modern browsers support it natively.

llms.txt SEO & AEO

A proposed text file at a site's root that gives AI tools a plain summary of the site and links to key content.

llms.txt is a community proposal, similar in spirit to robots.txt, meant to help large language models find a site's most useful pages. It is not an official standard, and major AI providers have not confirmed they rely on it. It is cheap to add, but it is no substitute for clear content and structured data.

Local SEO SEO & AEO

Improving visibility in map results and "near me" searches for businesses that serve a local area.

Local SEO relies on a complete Google Business Profile, consistent name, address and phone details across the web, reviews and location pages. For service businesses it often drives the most valuable calls. It is closely tied to how AI tools recommend local businesses too.

M

Malware Cybersecurity

Malicious software designed to damage, spy on or take control of computers, websites or networks.

On websites, malware can redirect visitors to scams, inject spam links or steal checkout data. Search engines and browsers may flag an infected site, cutting traffic overnight. Updates, a WAF, scanning and clean backups keep it out and speed recovery.

Managed WordPress hosting Hosting & infrastructure

Hosting tuned specifically for WordPress, with updates, caching, backups and security handled by the host.

Managed WordPress plans cost more than shared hosting, but they include the speed tuning, staging sites, backups and malware protection most businesses need. They save developer time and reduce risk. Check what each plan includes, since features and limits vary.

Marketing automation Analytics & marketing tech

Software that sends emails and other messages automatically based on rules and customer behavior.

Automation can nurture new leads, recover abandoned carts and send timely follow-ups without manual effort. It works best with clean CRM data and clear goals. Over-automating can feel impersonal, so keep messages relevant.

Meta description SEO & AEO

A short page summary in the HTML that search engines may show under your title in results.

Meta descriptions do not directly affect rankings, but a clear one can improve how many people click. Google sometimes rewrites them using text from the page. Write them for people: what the page offers and why it is worth a click.

Meta Pixel Analytics & marketing tech

Tracking code from Meta that records site actions for measuring and targeting Facebook and Instagram ads.

The Meta Pixel connects your site to your Meta ad account so you can measure results and build audiences. Browser privacy changes and ad blockers reduce what it captures. Pairing it with the Conversions API improves accuracy.

Minification Performance

Removing spaces, comments and unneeded characters from code files to make them smaller.

Minified CSS and JavaScript download faster without changing how the site works. Most modern build tools and performance plugins do this automatically. It is a small but standard optimization.

Mixed content Cybersecurity

When a secure HTTPS page loads some images, scripts or files over insecure HTTP.

Mixed content can break the padlock, trigger browser warnings or block scripts entirely. It often appears after moving to HTTPS or from old hard-coded links. Fixing it is usually a quick cleanup.

Mobile-first design Design & UX

Designing for small screens first, then expanding the layout for larger ones.

Starting with mobile forces clear priorities: what matters most gets the space. It usually produces faster, simpler pages for everyone. It matches how Google indexes sites, using the mobile version.

Multi-factor authentication (MFA) Cybersecurity

Requiring a second proof of identity, such as a code, app prompt or security key, in addition to a password.

MFA blocks most account takeovers even when a password is stolen. Turn it on for email, hosting, domain registrar, CMS admin, payment and social accounts. App-based prompts, passkeys and security keys are stronger than text-message codes.

Multi-storefront Ecommerce

Running several branded stores, regions or audiences from one ecommerce back end.

Multi-storefront setups let you manage products and orders in one place while showing different brands, prices or languages. It is common for wholesale and retail splits or international selling. Platform support for it varies, so it should be confirmed early.

MX record Hosting & infrastructure

A DNS record that tells the internet which servers receive email for your domain.

MX records route your business email. Mistakes during a website or DNS move are a classic cause of lost mail. Always confirm MX records are carried over when changing nameservers or hosts.

N

Nameservers Hosting & infrastructure

The servers that hold a domain's DNS records and answer questions about where its services live.

Whoever controls your nameservers controls your DNS. You set them at your registrar, often pointing to your host or a DNS provider like a CDN. Changing nameservers moves all your records at once, so copy every record first or email can break.

Next.js Development

A React framework for building fast websites and apps with static, server and edge rendering built in.

Next.js is our pick when a project needs speed, custom functionality or a headless CMS front end. It can pre-build pages, render them on the server, or update them on a schedule, which helps Core Web Vitals and SEO. It needs developers to build and maintain, so it is not a DIY tool.

Noindex SEO & AEO

A directive that tells search engines not to include a page in their results.

Noindex is the right tool for thank-you pages, staging sites and thin pages you do not want in search. Left on by accident after a launch, it can wipe a site from Google. Checking for stray noindex tags is part of every launch checklist.

O

OAuth Cybersecurity

A standard that lets one app access another on your behalf without sharing your password, such as "Sign in with Google."

OAuth is how most integrations connect securely, granting specific permissions that can be revoked. Review which apps have access to your accounts and remove ones you no longer use. Over-broad permissions are a quiet security risk.

Open Graph tags SEO & AEO

Meta tags that control the title, description and image shown when a page is shared on social media or messaging apps.

Without Open Graph tags, shared links can show a random image or a cut-off title. Setting them makes every share look intentional and on-brand. They also feed previews in many chat and collaboration tools.

Optimizely Platforms & CMS

An enterprise digital experience platform combining a CMS, commerce and experimentation tools.

Optimizely (formerly Episerver) is used by larger organizations that need personalization, testing and content management in one suite. It is powerful but carries enterprise pricing and implementation effort. It makes sense when a company has the team and traffic to use those features.

P

Page builder Platforms & CMS

A drag-and-drop tool for designing web pages visually, often added to WordPress as a plugin.

Page builders such as Elementor and Divi let non-developers lay out pages visually. They are fast for getting started, but they can add extra code that slows pages down, and moving away from one later often means rebuilding pages. We weigh editing convenience against long-term speed and maintenance before choosing one.

PageSpeed Insights Performance

A free Google tool that reports a page's Core Web Vitals and suggests performance fixes.

PageSpeed Insights shows both lab test results and, when available, real-user data from Chrome. The real-user field data is what matters most for visitors and Google. Treat the score as a guide to priorities, not a goal on its own.

Passkeys Cybersecurity

A passwordless sign-in method that uses a device's unlock (fingerprint, face or PIN) and cryptographic keys.

Passkeys are built on FIDO standards and are designed to resist phishing, since there is no password to steal or type into a fake site. Major platforms and many services now support them. They are a strong option for both staff accounts and customer logins.

Password manager Cybersecurity

An app that creates, stores and fills strong, unique passwords for every account.

A password manager makes unique passwords practical, which defeats credential stuffing. Business versions let teams share access securely and remove it when someone leaves. Protect the manager itself with a strong master password and MFA.

Patch management Cybersecurity

The routine of testing and applying software updates and security fixes on a schedule.

Most website hacks exploit known flaws that already had a fix. Regular updates to the CMS, plugins, themes and server close those doors. Test on staging, keep backups, and treat critical security updates as urgent.

Payment gateway Ecommerce

The service that securely sends a customer's payment details for approval and returns the result to your store.

Gateways such as Stripe, PayPal and Shopify Payments handle the sensitive part of checkout. Using a reputable hosted gateway keeps card data off your servers, which greatly reduces your security and PCI burden. Fees and features vary, so check current pricing.

Related:PCI DSS Tokenization Checkout

PCI DSS Ecommerce

The Payment Card Industry Data Security Standard: security rules for any business that accepts card payments.

If you take card payments, you are expected to follow PCI DSS. Using a hosted payment gateway that keeps card data off your servers makes compliance much simpler. Card data stored or handled carelessly can lead to fines, lost processing ability and breaches.

Penetration testing Cybersecurity

An authorized, simulated attack by security experts to find weaknesses before real attackers do.

Pen tests go beyond automated scans by chaining issues together like a real attacker would. They are common for web apps that handle sensitive data or need compliance evidence. Fixing the findings is the point, so plan time for remediation.

Phishing Cybersecurity

Fake emails, texts or sites designed to trick people into revealing passwords, payments or data.

Phishing is one of the most common ways businesses get breached. Messages often imitate banks, vendors, shipping companies or your own IT. Training, email authentication, MFA and passkeys sharply reduce the risk.

Plugin Platforms & CMS

An add-on that extends a CMS with new features, such as forms, SEO tools or ecommerce.

Plugins are a big reason WordPress is flexible, but each one is third-party code running on your site. Too many plugins can slow the site and widen the attack surface, especially if they are abandoned by their developers. We keep plugin lists short, reputable and updated.

Plugin vulnerability Cybersecurity

A security flaw in a CMS plugin or extension that attackers can use to break into a site.

Plugins are the most common entry point for WordPress compromises. Abandoned or obscure plugins are the biggest risk. Keep the list short, remove unused plugins, update promptly and watch vulnerability alerts.

Principle of least privilege Cybersecurity

Giving each person, app or system only the access it needs to do its job, and nothing more.

If an account with limited access is compromised, the damage is limited too. On a website, that means editors are not admins and old vendor accounts are removed. Review access regularly, especially when staff or agencies change.

Product feed Ecommerce

A structured file of your product data that shopping channels like Google Merchant Center and Meta use to show your products.

A clean product feed powers shopping ads and free product listings. Errors in titles, prices or availability can get products rejected. Feeds are usually generated by your ecommerce platform or an app.

Product variant Ecommerce

A version of a product that differs by an option such as size, color or material.

Variants let shoppers choose options on one product page instead of hunting through separate listings. Each variant usually has its own SKU, price and stock level. How a platform limits variants can affect which one fits your catalog.

Related:SKU Shopify Canonical tag

Prompt AI

The instructions or question you give an AI model.

Clear prompts with context, examples and constraints get far better results than vague ones. For business tools, prompts are often written once by a developer and reused behind the scenes. They are part of how a chatbot stays on-brand and on-topic.

Prompt injection AI

An attack that hides instructions in text an AI reads, tricking it into ignoring its rules or leaking data.

If your chatbot or AI tool reads user messages, web pages or documents, someone can try to slip in commands like "ignore your instructions." This can expose data or cause harmful actions. Limit what the AI can access and do, and treat its outputs with caution.

Prototype Design & UX

A clickable mock-up of a website or app used to test flows before development.

Prototypes let stakeholders and real users try the experience early. Finding confusing steps here costs far less than fixing them in code. They range from quick clickable wireframes to near-final designs.

R

Ransomware Cybersecurity

Malware that encrypts or steals a victim's data and demands payment to restore or not leak it.

Ransomware can halt a business for days or weeks. Offline or immutable backups, MFA, patching and staff training are the core defenses. Have an incident response plan ready before you need it.

Rate limiting Cybersecurity

Capping how many requests a user or IP address can make in a set time.

Rate limiting slows brute force logins, scraping, form spam and some denial of service attempts. It is set at the server, CDN or application level. Limits should be tuned so real customers are not blocked.

React Development

A widely used JavaScript library for building interactive user interfaces from reusable components.

React lets developers build complex, fast interfaces from reusable pieces. It is the foundation of Next.js and many modern web apps. It is a strong choice for custom functionality, but a simple brochure site does not always need it.

Registrar lock Cybersecurity

A setting at your domain registrar that blocks the domain from being transferred or changed without extra steps.

Registrar lock (also called transfer lock) prevents unauthorized transfers, a common step in domain hijacking. It is usually free and takes seconds to enable. Valuable domains can also use stronger registry-level locks.

Render-blocking resources Performance

Scripts and stylesheets the browser must load before it can display the page.

If a page waits on several large files before showing anything, visitors stare at a blank screen. Deferring non-essential scripts and inlining critical styles lets content appear sooner. This is a frequent finding in speed audits.

Responsive design Design & UX

Designing a site so its layout adapts to any screen size, from phones to large monitors.

Most web traffic for many businesses comes from phones, and Google primarily evaluates the mobile version of a site. A responsive site gives every visitor a usable experience. It is a baseline requirement, not an extra.

REST API Development

A common style of API that uses standard web addresses and requests to read and change data.

REST is the most widespread way systems share data on the web, and most business tools offer one. It is simple to work with and well supported. It is the default choice for many integrations.

Related:API GraphQL Webhook

Retrieval-augmented generation (RAG) AI

A method where an AI looks up relevant documents first and uses them to write its answer.

RAG lets a chatbot answer from your own policies, services and FAQs instead of guessing from general training data. It makes answers more accurate and easier to keep current. It is the usual approach for business chatbots and internal knowledge tools.

robots.txt SEO & AEO

A text file at a site's root that tells search engine and other bots which areas they may or may not crawl.

robots.txt keeps crawlers away from areas like admin pages and search results. It is a request, not a security control, and it does not reliably keep a page out of search results. One wrong line can block an entire site, which is a surprisingly common launch mistake.

S

Sanity Platforms & CMS

A headless CMS with a customizable editing studio and real-time collaboration.

Sanity lets developers shape the editing interface around how your team actually works, and content is delivered through an API to any front end. It pairs well with Next.js for fast, flexible sites. Like other headless options, it needs a developer to set up and extend.

Related:Headless CMS Contentful Next.js

Schema markup SEO & AEO

Structured code that labels page content (business details, products, FAQs, reviews) so machines understand it.

Schema markup uses the shared Schema.org vocabulary to tell search engines and AI tools exactly what a page is about. It can make you eligible for rich results like star ratings and FAQ details, and it supports AEO. It must match what is visible on the page, or it can be ignored or penalized.

Search engine optimization (SEO) SEO & AEO

Improving a website so search engines can find, understand and rank it for relevant searches.

SEO covers technical health, content quality, site structure and reputation signals like links. Done well, it brings steady, high-intent visitors without paying for every click. It takes time, and shortcuts that try to trick search engines tend to backfire.

Security audit Cybersecurity

A structured review of a site's or company's security settings, access, software and processes.

An audit checks who has access, what is out of date, how backups work and whether email and DNS are protected. It produces a prioritized list of fixes. It is a smart step after a staff change, vendor change or relaunch.

Security headers Cybersecurity

Server settings sent with each page that tell browsers how to protect visitors, such as HSTS and CSP.

Security headers block whole classes of attacks like clickjacking and some script injection at very low cost. They are set at the server, CDN or framework level. Free online tools can show which headers your site is missing.

Server-side rendering (SSR) Development

Building a page on the server at the moment someone requests it, then sending finished HTML to the browser.

SSR is useful for pages that must always be current or personalized, like account dashboards or live inventory. Search engines receive complete HTML, which helps SEO compared with rendering everything in the browser. It needs more server work than static pages, so it is used where freshness matters.

Serverless Development

Running code on demand in the cloud without managing servers, paying mostly for what you use.

Serverless functions handle tasks like form submissions, payments or API calls and scale up automatically. They reduce server maintenance, though costs and limits need watching for heavy workloads. Many Next.js and Jamstack sites rely on them.

Session hijacking Cybersecurity

Stealing a user's login session so an attacker can act as them without a password.

Stolen session cookies can bypass passwords and even some MFA. HTTPS everywhere, secure cookie settings and short sessions for admin accounts reduce the risk. Malware on staff devices is a common source.

Session recording Analytics & marketing tech

Anonymized replays of how individual visitors moved through and interacted with a site.

Watching real sessions shows where people get confused, hesitate or hit errors. It is valuable for CRO and bug finding. Make sure recordings mask personal information and are covered in your privacy policy.

Shared hosting Hosting & infrastructure

Entry-level hosting where many websites share the same server and its resources.

Shared hosting is the cheapest way to get online and fine for very small sites. Because neighbors share resources, a busy or compromised site on the same server can slow or affect yours. Growing businesses usually outgrow it.

Shopify Ecommerce

A hosted ecommerce platform that handles products, checkout, payments and hosting in one subscription.

We recommend Shopify for most online stores. It is reliable, secure, has a large app ecosystem and lets owners run day-to-day operations themselves. Heavy customization and some B2B needs can push you toward higher plans, apps or a different platform.

Single sign-on (SSO) Cybersecurity

Letting staff log in once with one company identity to access many approved apps.

SSO simplifies logins and lets you enforce MFA and remove access in one place when someone leaves. That reduces forgotten accounts and shared passwords. It is common in growing companies using Google Workspace or Microsoft 365.

Single-page application (SPA) Development

A web app that loads once and updates content in place as users navigate, without full page reloads.

SPAs feel smooth for dashboards, portals and tools. Built carelessly, they can be slow to first load and harder for search engines to index. For public content, frameworks like Next.js combine app-like navigation with search-friendly pages.

SKU Ecommerce

Stock keeping unit: a unique code a business assigns to each distinct product or variant it sells.

SKUs keep inventory, orders and reporting accurate across your website, warehouse and accounting tools. A clear SKU scheme makes integrations and catalog migrations far easier. Messy SKUs cause messy data everywhere else.

SOC 2 Cybersecurity

An audit framework from the AICPA that reports on how a service company protects customer data.

SOC 2 reports cover controls for security and, optionally, availability, confidentiality, processing integrity and privacy. A Type I report looks at controls at a point in time; Type II tests them over a period. Larger clients often ask SaaS and service vendors for one.

Spear phishing Cybersecurity

A targeted phishing attack crafted for a specific person or company using details about them.

Spear phishing uses real names, projects and vendors to look legitimate, so it is much harder to spot. Finance staff and executives are common targets. Verify unusual requests through a separate, known channel.

SPF Cybersecurity

Sender Policy Framework: a DNS record listing which servers are allowed to send email for your domain.

SPF helps receiving mail servers spot forged emails pretending to be from you. It is published as a TXT record and must include every service that sends on your behalf, like your CRM or newsletter tool. It works best combined with DKIM and DMARC.

Related:DKIM DMARC TXT record

SQL injection Cybersecurity

An attack that sneaks database commands into a form or URL to read, change or delete data.

SQL injection can expose customer records or take over a site. It happens when code passes user input straight to the database. Modern frameworks, careful plugin choices, updates and a WAF prevent most cases.

Squarespace Platforms & CMS

An all-in-one hosted website builder with templates, hosting and simple ecommerce included.

Squarespace is a good fit for small businesses and simple shops that want a tidy site with little maintenance. Templates look polished out of the box. Custom functionality, advanced SEO control and integrations are more limited than on WordPress or a custom build.

SSL/TLS Cybersecurity

The encryption protocols that secure data moving between a browser and a website; TLS is the modern successor to SSL.

An SSL/TLS certificate is what puts the padlock and https in the address bar. Without it, browsers warn visitors that your site is not secure, and form data can be intercepted. Most hosts provide free certificates, but someone needs to confirm they renew automatically.

Staging site Hosting & infrastructure

A private copy of your website used to test changes before they go live.

A staging site lets you try updates, new features and redesigns without risking the live site. Problems are caught where customers cannot see them. Staging copies should be blocked from search engines and protected with a password.

Static site generation (SSG) Development

Building every page into ready-made HTML ahead of time so it can be served instantly from a CDN.

Static pages are fast, cheap to host and hard to break, because the server does not assemble each page on request. They suit marketing pages, blogs and documentation. The catch is that content changes require a rebuild, which ISR helps solve.

Style guide Design & UX

A document setting out a brand's visual and written rules, such as logo use, colors, fonts and tone.

A style guide keeps everyone who touches your brand consistent, from designers to outside vendors. It is often the starting point for a fuller design system. Consistency builds recognition and trust.

Supply chain attack Cybersecurity

Compromising a trusted vendor, library or plugin so the attack spreads to everyone who uses it.

You can do everything right and still be affected if a tool you depend on is compromised. Use reputable, actively maintained software, limit third-party scripts, and monitor for unexpected changes. Software inventories make it easier to respond fast.

T

Technical SEO SEO & AEO

The behind-the-scenes work that helps search engines crawl, render and index a site correctly.

Technical SEO includes site speed, sitemaps, redirects, canonical tags, structured data and mobile friendliness. Great content cannot rank if search engines struggle to access it. It is often where a redesign helps or hurts most.

Theme Platforms & CMS

The package of templates and styles that controls how a CMS site looks and is laid out.

In WordPress and Shopify, the theme decides your design, page templates and much of your front-end code. A bloated theme can slow every page, while a well-built one keeps the site fast and easy to edit. Customizations should live in a child theme or custom code so updates do not wipe them out.

Third-party scripts Cybersecurity

Code loaded from outside services, like chat widgets, analytics tags and ad pixels, that runs on your pages.

Each third-party script can slow your site and has access to what happens on the page, including forms. If the provider is compromised, so is every site that loads it. Keep only the scripts you need and control them with a Content Security Policy.

Time to First Byte (TTFB) Performance

How long the browser waits before receiving the first piece of data from the server.

A slow TTFB delays everything else on the page. It is usually caused by slow hosting, missing caching or heavy server-side work. Better hosting, a CDN and page caching are the typical fixes.

Title tag SEO & AEO

The HTML element that sets a page's title in browser tabs and, usually, as the clickable headline in search results.

The title tag is one of the strongest on-page SEO signals and a big factor in whether people click. Each page should have a unique, specific title that matches what the page offers. Keep the most important words near the start.

Tokenization Ecommerce

Replacing sensitive data like a card number with a random stand-in token that is useless if stolen.

Payment gateways use tokenization so your store can charge returning customers without ever storing their card number. It shrinks the damage if your systems are breached. It is one reason hosted gateways are the safer choice.

TTL (time to live) Hosting & infrastructure

A DNS setting that tells other servers how long to remember a record before checking for changes.

A long TTL means fewer lookups but slower updates when you change something. Before a website migration, we lower the TTL so the switch takes effect quickly, then raise it again afterward. Most visitors see a change once their cached copy expires.

Two-factor authentication (2FA) Cybersecurity

A form of MFA that uses exactly two factors, usually a password plus a code or prompt.

2FA is the most common form of multi-factor authentication. It is one of the highest-value, lowest-cost security steps a business can take. Store backup codes safely so you are not locked out if you lose your phone.

TXT record Hosting & infrastructure

A DNS record that holds text, often used to verify domain ownership and publish email security policies.

TXT records hold SPF, DKIM and DMARC settings and verification codes for services like Google Search Console. They are small but important for email deliverability and security. Keep them tidy, since duplicate or conflicting records cause problems.

Typosquatting Cybersecurity

Registering misspelled or look-alike versions of a domain to fool people into visiting a fake site or trusting fake email.

Criminals register domains like examp1e.com to phish your customers or staff. Registering the most obvious misspellings of your key domain and enforcing DMARC limits the damage. Training staff to check sender domains helps too.

Related:Phishing DMARC Domain name

U

Uptime Hosting & infrastructure

The share of time a website is online and working, usually shown as a percentage.

Downtime costs leads, sales and trust. Hosts often advertise uptime guarantees, but what matters is how quickly problems are noticed and fixed. Uptime monitoring alerts you as soon as the site goes down.

Uptime monitoring Hosting & infrastructure

A service that checks your website regularly and alerts you when it goes down or slows dramatically.

Without monitoring, owners often learn about outages from customers. Monitoring checks your site from outside every few minutes and sends an alert when something fails. It is a basic part of any website care plan.

User experience (UX) Design & UX

How easy, clear and satisfying it is for someone to use your website to get what they came for.

UX covers navigation, content, speed, forms and how the whole journey feels. Good UX turns visitors into leads and customers with less friction. It is shaped by research and testing, not just looks.

User interface (UI) Design & UX

The visual and interactive elements people use on a site, such as buttons, menus, forms and type.

UI is the look and feel of each screen. Consistent, clear interface design builds trust and makes actions obvious. It works hand in hand with UX: beautiful screens still fail if the journey is confusing.

UTM parameters Analytics & marketing tech

Tags added to the end of a link that tell analytics tools which campaign, source and medium sent a visitor.

UTMs let you see whether a newsletter, social post or partner link actually drove traffic and leads. Use a consistent naming system or reports get messy fast. Do not add them to internal links on your own site.

V

Vector database AI

A database designed to store embeddings and quickly find the most similar items by meaning.

Vector databases are the lookup engine behind most RAG systems and semantic search. They let an AI find the right paragraph among thousands of documents in moments. Some general databases now offer vector features too.

Version control (Git) Development

A system that records every change to a site's code so work can be reviewed, shared and rolled back.

Version control means no change is lost and a bad update can be undone quickly. It lets several developers work safely at once and creates a clear history of who changed what. Any serious web project should have it.

Vibe coding Development

Building software by describing what you want to an AI tool and accepting the code it writes, often without reviewing it closely.

Vibe coding can turn an idea into a working prototype fast. The risk is code nobody fully understands, with hidden security holes, exposed keys or fragile logic. Treat it as a starting point and have the result reviewed before it handles real customers or data.

Virtual private server (VPS) Hosting & infrastructure

Hosting where one physical server is split into isolated virtual servers, each with dedicated resources.

A VPS gives you more power and control than shared hosting at a moderate step up in cost. Someone has to manage the server, though: updates, security and backups. Unmanaged VPS plans put that work on you or your developer.

Vulnerability scanning Cybersecurity

Automated checks that look for known security flaws, outdated software and misconfigurations.

Regular scans catch outdated plugins, exposed files and weak settings before attackers do. They are quick and affordable compared with cleanup after a hack. Scanning finds known issues; penetration testing digs deeper.

W

WCAG Design & UX

Web Content Accessibility Guidelines: the international standard for making web content accessible.

WCAG is published by the W3C and organized into levels A, AA and AAA. Level AA is the common target for business websites and is referenced by many laws and policies. Meeting it requires both automated checks and manual testing.

Web application firewall (WAF) Cybersecurity

A filter that sits in front of a website and blocks malicious requests such as SQL injection and bot attacks.

A WAF catches many common attacks before they reach your site, including attempts to exploit known plugin flaws. Many CDNs and managed hosts include one. It reduces risk but does not replace updates and secure code.

Web hosting Hosting & infrastructure

The service that stores your website's files and serves them to visitors over the internet.

Hosting affects speed, uptime and security as much as design does. Options range from cheap shared plans to managed and cloud hosting with support and monitoring built in. Pick hosting that matches your traffic, platform and how much risk you can tolerate, and check current pricing since plans change.

Webflow Platforms & CMS

A visual website builder and hosted CMS known for design control, interactions and clean code output.

We recommend Webflow for design-led marketing sites where visual polish and animations matter. Designers can build precisely without a theme in the way, and Webflow handles hosting and security updates. It is less suited to complex custom functionality or very large content operations.

Webhook Development

An automatic message one system sends to another the moment something happens, like a new order or form fill.

Webhooks keep systems in sync in real time without anyone checking manually. For example, a new lead can land in your CRM instantly, or a CMS publish can trigger a site rebuild. They should be secured so only trusted sources can send them.

WebP Performance

A modern image format that is usually much smaller than JPEG or PNG at similar quality.

WebP is supported by all major browsers and is a safe default for photos and graphics on the web. Switching to it reduces page weight and improves load times. Many CMS platforms and CDNs can convert images automatically.

Wireframe Design & UX

A simple, low-detail layout of a page that shows structure and content priority without visual design.

Wireframes let you agree on what goes on each page and in what order before spending time on colors and imagery. Changes are cheap at this stage. They keep conversations focused on goals and content.

Wix Platforms & CMS

A hosted drag-and-drop website builder aimed at small businesses and DIY site owners.

Wix bundles design tools, hosting and apps in one subscription. It is quick to launch, but your site lives inside Wix, so moving to another platform later usually means a rebuild. It suits simple sites more than complex or fast-growing ones.

WooCommerce Ecommerce

A free ecommerce plugin that turns a WordPress site into an online store.

WooCommerce makes sense when content and commerce live together and you already use WordPress. It is very flexible, but you are responsible for hosting, security, updates and PCI-friendly payment setup. Large stores need strong hosting to stay fast.

WordPress Platforms & CMS

The most widely used open-source CMS, popular for blogs, content-heavy sites and sites that need lots of plugins.

WordPress powers a large share of the web, which means a huge pool of developers, themes, plugins and SEO tools. We recommend it for blogs and content-heavy sites where several editors publish often. The trade-off is upkeep: core, themes and plugins need regular updates and security attention, or the site becomes an easy target.

X

XML sitemap SEO & AEO

A file listing a site's important URLs to help search engines discover and crawl them.

An XML sitemap does not guarantee rankings, but it helps search engines find new and updated pages faster. It is particularly useful for large sites and new sites with few links. Submit it in Google Search Console and keep it free of broken or redirected URLs.

Z

Zero-day vulnerability Cybersecurity

A security flaw attackers know about before the software maker has released a fix.

Zero-days cannot be patched right away, so layered defenses matter: a WAF, least privilege, monitoring and backups. Once a fix ships, apply it quickly, since attacks often spike after a flaw becomes public. Speed of patching is what you control.

Security is part of every build.

MFA on every admin, least-privilege accounts, security headers, a web application firewall, tested backups and email authentication. We set it up at launch and keep it current.

Care and security Security checklist

Tell us what the site needs to do.

Share a few details and a budget range. We reply within one business day with a plan, a platform recommendation and a fixed quote.

Start a project Estimate your budget