The website glossary.

The 3-2-1 rule protects you if a server fails, a provider has an outage or ransomware hits your main systems. Many teams add an offline or immutable copy that attackers cannot change. It is simple to follow and widely recommended.

Related:BackupsRansomwareEncryption at rest

When URLs change during a redesign or migration, 301 redirects keep visitors from hitting dead ends and carry most ranking value to the new page. Skipping a redirect plan is one of the fastest ways to lose search traffic after a relaunch. Map every important old URL before launch.

Related:302 redirect404 errorTechnical SEO

302s are for short-term moves, like a seasonal promotion. Using one when a move is permanent can confuse search engines about which page to rank. When in doubt about a permanent change, use a 301.

Related:301 redirect404 error

A few 404s are normal, but broken links from your own pages or from popular old URLs waste visitors and lost link value. Redirect valuable old URLs and make your 404 page helpful with search and key links. Search Console reports the ones Google finds.

Related:301 redirectGoogle Search ConsoleInternal linking

The A record is usually what sends visitors from your domain to your web server. Updating it is a key step when moving hosts. Lowering the TTL before a move helps the change take effect faster.

Related:DNS (Domain Name System)CNAME recordTTL (time to live)

A/B tests replace opinions with evidence. They need enough traffic and a clear goal to give reliable answers, so low-traffic sites may get more from user research. Test one meaningful change at a time.

Related:Conversion rate optimization (CRO)Landing pageOptimizely

Combined with the WordPress MCP Adapter, it lets AI assistants carry out tasks on a site, such as drafting a post, within the permissions you allow. Test on staging and use limited-access accounts.

Related:Model Context Protocol (MCP)WordPressAI agent

This area sets the first impression, so it should say what you do and offer a clear next step. People do scroll, so not everything needs to be crammed in. Heavy media here can hurt loading speed.

Related:Call to action (CTA)Largest Contentful Paint (LCP)Landing page

Role-based access lets you give writers, editors, store managers and developers just the permissions they need. Clear roles make audits easier and reduce accidental damage. Remove access promptly when someone leaves.

Related:Principle of least privilegeSingle sign-on (SSO)Security audit

Accessible sites serve more customers, reduce legal risk and are usually easier for everyone to use. It covers color contrast, alt text, keyboard navigation, captions and clear forms. Building it in from the start is far cheaper than retrofitting.

Related:WCAGADA (Americans with Disabilities Act)Alt textColor contrast

Businesses have faced demand letters and lawsuits over websites that people with disabilities cannot use. There is no single checklist in the law for private business sites, so WCAG AA is the usual benchmark. Accessibility overlay widgets alone do not reliably fix the underlying problems.

Related:AccessibilityWCAGAlt text

Agents go beyond answering questions to actually doing work, which makes them powerful and riskier. Give them only the access they need and keep a human in the loop for anything consequential. They are also starting to browse and buy on behalf of users, which affects how sites are built.

Related:Large language model (LLM)Prompt injectionAPI

A well-built chatbot can answer common questions, qualify leads and book appointments at any hour. Grounding it in your own approved content reduces wrong answers. It needs guardrails, clear handoff to a human, and care with personal data.

Related:Large language model (LLM)Retrieval-augmented generation (RAG)Prompt injectionHallucination

Examples include OpenAI's GPTBot and OAI-SearchBot, Anthropic's ClaudeBot and PerplexityBot. You can allow or block most of them in robots.txt. Research from 2024 found that major AI crawlers did not run JavaScript, so content that only loads in the browser may be invisible to them.

Related:robots.txtClient-side rendering (CSR)llms.txt

AI Mode answers complex questions with a generated response and links to sources, and lets people ask follow-up questions. Google says the same SEO best practices apply to appearing in AI features, with no special markup required.

Related:AI OverviewsAnswer engine optimization (AEO)Generative engine optimization (GEO)

AI Overviews can answer a question before anyone clicks, which changes how search traffic flows. Being cited as a source keeps your brand visible even when clicks drop. Clear, well-structured, trustworthy content gives you the best chance.

Related:Answer engine optimization (AEO)Generative engine optimization (GEO)Featured snippet

AI builders can produce a site quickly, which is great for prototypes and small launches. The output still needs care: security, SEO, analytics, accessibility and ongoing fixes do not take care of themselves. Plan for someone to own and maintain the site after launch.

Related:Vibe codingWixFramer

Alt text makes images understandable to people who cannot see them and helps search engines and AI tools understand your content. Describe what matters in the image in context. Purely decorative images should have empty alt text so they are skipped.

Related:AccessibilityWCAGSearch engine optimization (SEO)

Anchor text tells readers and search engines what the linked page is about. Descriptive anchors like "WordPress hosting guide" work better than "click here." Over-optimized anchors in backlinks, the same exact keyword again and again, can look manipulative.

Related:Internal linkingBacklinkSearch engine optimization (SEO)

People increasingly get answers from AI tools and search summaries instead of clicking ten blue links. AEO means answering questions clearly up front, using structured data and building trust signals so your business is the source quoted. It builds on good SEO rather than replacing it.

Related:Generative engine optimization (GEO)Featured snippetSchema markupAI Overviews

APIs let your website talk to your CRM, payment gateway, inventory system or headless CMS. Good integrations remove manual copy-and-paste work and data errors. When choosing tools, the quality of their API often matters as much as their features.

Related:REST APIGraphQLWebhookHeadless CMS

Added in WordPress 5.6, they let tools connect through the REST API and can be revoked one at a time. Give integrations their own user with the least access they need.

Related:WordPressREST APIPrinciple of least privilege

ARIA can label icons or explain the state of a menu, but native HTML elements are usually better. A common rule is to use ARIA only when plain HTML cannot do the job, because incorrect ARIA can make things worse.

Related:AccessibilityScreen readerWCAG

Astra is designed to load quickly and stay out of the way, giving you a lean base to build on. It is a common choice when a WordPress site needs good speed without a fully custom theme. The overall result still depends on which plugins and builders are layered on top.

Related:ThemeWordPressGutenberg (block editor)Elementor

Most customers interact with several channels before buying. Attribution models, from last click to data-driven, assign credit differently, which changes how you judge channels. No model is perfect, so use it alongside common sense and CRM data.

Related:Conversion trackingUTM parametersCRM

You request it from your current registrar and give it to the new one. Unlocking the domain and keeping your contact email current make transfers go smoothly.

Related:Domain registrarRegistrar lockDomain name

Methods include passwords, magic links, passkeys and sign-in with Google or Microsoft. Authentication proves identity; authorization decides what that user is allowed to do.

Related:Multi-factor authentication (MFA)PasskeysOAuth

AVIF can produce very small files, which helps image-heavy sites load faster. Encoding takes more processing, and support in some tools is still catching up. Many sites serve AVIF where supported and fall back to WebP or JPEG.

Related:WebPImage compressionLargest Contentful Paint (LCP)

Amplify Hosting deploys front ends from Git, and Amplify can add authentication, data and storage using other AWS services. It suits teams already using AWS.

Related:NetlifyVercelServerless

Wholesale and B2B buyers expect their negotiated prices, purchase orders and net terms online. Not every platform supports this well out of the box. Getting it right lets sales reps spend less time on routine orders.

Related:BigCommerceMulti-storefrontCRM

The back end handles things like user accounts, form processing, orders and integrations with your CRM or ERP. You rarely see it, but it decides how reliable and secure the site is. Headless setups split the back end from the front end entirely.

Related:Front endAPIHeadless CMS

Links from reputable, relevant sites remain an important signal of trust for search engines and, increasingly, for AI tools. Buying links or using link schemes risks penalties. Earned mentions from partners, press and industry groups are the safe route.

Related:Internal linkingE-E-A-TSearch engine optimization (SEO)

Backups are your safety net against hacks, bad updates and human error. They must be automatic, stored somewhere separate from the site, and tested by actually restoring them. A backup you have never restored is only a hope.

Related:3-2-1 backup ruleRansomwareIncident response plan

BigCommerce is our pick for B2B sellers, large catalogs and multi-storefront setups. It includes features like customer-specific pricing and works well headless. Its app ecosystem is smaller than Shopify's, so check that the integrations you need exist.

Related:ShopifyB2B pricingMulti-storefrontHeadless commerce

It works like Google Search Console: submit sitemaps, check indexing, find errors and see search queries. Bing also powers results in other services, so it is worth verifying your site.

Related:Google Search ConsoleIndexNowXML sitemap

Bots fill forms with spam, scrape content and hammer login pages. Bot protection uses behavior, reputation and challenges to separate people from scripts. Many CDNs include it, and it reduces load on your server too.

Related:CAPTCHARate limitingWeb application firewall (WAF)Credential stuffing

GA4 defines bounce rate as the opposite of engagement rate. In older Universal Analytics it meant single-page sessions, so numbers from the two tools are not directly comparable.

Related:Engagement rateGoogle Analytics 4 (GA4)

Breadcrumbs help visitors move up a level and help search engines understand your site structure. Adding BreadcrumbList structured data lets Google show the trail in results instead of a long URL.

Related:Information architectureInternal linkingSchema markup

When files are cached in the browser, returning visitors do not download them again. It is set with server headers and costs nothing to run. It mainly speeds up second and later page views.

Related:CachingMinificationContent delivery network (CDN)

Login pages, especially well-known ones like the WordPress admin, are constantly hit by brute force bots. Strong unique passwords, MFA, login limits and a WAF stop most of them. Weak admin passwords remain a common cause of hacked sites.

Related:Credential stuffingMulti-factor authentication (MFA)Rate limitingPassword manager

BEC often looks like a vendor changing bank details or an executive urgently requesting a wire. It causes some of the largest financial losses of any cybercrime. MFA, DMARC and a rule to verify payment changes by phone are strong defenses.

Related:PhishingSpear phishingDMARCMulti-factor authentication (MFA)

Caching happens at several levels: in the browser, on the server and on a CDN. Good caching makes sites faster and reduces server load during traffic spikes. Poorly configured caching can show visitors outdated content, so it needs thoughtful setup.

Related:Browser cachingContent delivery network (CDN)Time to First Byte (TTFB)TTL (time to live)

Clear CTAs turn interest into leads. Each page should make its main action obvious and easy to complete. Vague or competing CTAs leave visitors unsure what to do.

Related:Conversion rate optimization (CRO)Landing pageAbove the fold

Duplicate versions of a page (from filters, tracking codes or http vs. https) can split ranking signals. A canonical tag points search engines to the preferred URL. It is especially important on ecommerce sites with product variations.

Related:Duplicate contentTechnical SEOIndexing

CAPTCHAs cut form spam and automated logins. Old-style puzzles frustrate people and can hurt accessibility, so many sites now use invisible or low-friction checks. Use them where spam or abuse is a real problem.

Related:Bot protectionAccessibilityBrute force attack

Some abandonment is normal, but high rates often point to unexpected shipping costs, slow pages or a clunky checkout. Fixing those issues and sending reminder emails can recover lost sales. Track it in your analytics to see where people drop off.

Related:CheckoutConversion rate optimization (CRO)Marketing automation

Amended by the CPRA, it applies to businesses that meet set thresholds, such as annual revenue or volume of consumer data. Covered businesses must disclose data practices and honor requests to opt out of sale or sharing.

Related:Privacy policyGlobal Privacy ControlGDPR

Checkout is where sales are won or lost. Extra steps, surprise costs and forced account creation are common reasons people leave. Fast, mobile-friendly checkout with familiar payment options usually pays for itself.

Related:Cart abandonmentPayment gatewayConversion rate optimization (CRO)

If you edit a theme directly, the next theme update can erase your changes. A child theme keeps those changes separate, so the parent can be updated safely for security fixes. It is a small setup step that prevents a common and expensive mistake.

Related:ThemeWordPressPatch management

CTR equals clicks divided by impressions. In Search Console, a page with many impressions but a low CTR may need a clearer title tag or meta description. CTR naturally drops for lower positions.

Related:ImpressionsTitle tagGoogle Search Console

CSR works well for app-like tools behind a login. For public marketing pages it can slow the first view and make content harder for some crawlers and AI tools to read. We usually pair it with server or static rendering for anything that needs to rank.

Related:Server-side rendering (SSR)Single-page application (SPA)Hydration

Cloud hosting handles traffic spikes better than a single server and can be very reliable when set up well. Pricing is often usage-based, so costs need monitoring. Platforms built for modern frameworks hide much of the complexity.

Related:ServerlessVirtual private server (VPS)Content delivery network (CDN)

Turnstile runs lightweight checks in the browser and works on any site, not just ones using Cloudflare. Like other CAPTCHAs, its token must be validated on your server.

Related:CAPTCHAreCAPTCHAHoneypot field

CNAMEs are common for subdomains, such as pointing www to your hosting platform or a shop subdomain to an ecommerce provider. They let the provider change server addresses without you editing DNS. They are often required when connecting third-party services.

Related:DNS (Domain Name System)A recordNameservers

Without code splitting, visitors may download code for the whole site just to read one page. Splitting keeps pages lighter and more responsive. Frameworks like Next.js do much of this automatically.

Related:JavaScriptNext.jsInteraction to Next Paint (INP)

Low-contrast text is hard to read for many people, especially on phones in sunlight or for those with low vision. WCAG sets minimum contrast ratios. Checking brand colors early avoids painful redesigns later.

Related:WCAGAccessibilityStyle guide

Instead of one platform doing everything, a composable setup lets you swap or upgrade individual pieces as needs change. It offers flexibility and performance, but more moving parts means more integration work and vendor management. It is most useful for growing businesses with real complexity.

Related:Headless CMSHeadless commerceAPIJamstack

Privacy laws in many regions require consent before certain tracking. Consent mode works with your cookie banner so tags respect each visitor's choice while still giving modeled reporting. It is required for some Google advertising features in the European Economic Area.

Related:Cookie consent bannerGoogle Analytics 4 (GA4)Google Tag Manager (GTM)

Content blocks let your team build new pages from approved, on-brand pieces. Update a block once and every page that uses it can change with it. Blocks are the bridge between a design system and a CMS.

Related:Content modelDesign systemGutenberg (block editor)Contentful

A CDN makes pages load faster for visitors far from your main server and absorbs traffic spikes. Many CDNs also provide security features like a web application firewall and DDoS protection. For most business sites it is one of the easiest speed wins.

Related:CachingEdge functionsWeb application firewall (WAF)DDoS attack

A CMS separates your content (pages, posts, products, images) from the code that displays it, so your team can update the site through an admin screen. The right CMS decides how easy daily edits are, how far the site can grow, and how much you depend on a developer. WordPress, Webflow, Contentful and Sanity are all content management systems, built for very different jobs.

Related:WordPressHeadless CMSWebflowContent model

A content model spells out, for example, that a "location" has an address, hours, photos and a phone number. Getting it right makes content reusable, consistent and easy to edit, and it feeds schema markup and AI search. A poor content model is one of the most common reasons a site becomes hard to manage.

Related:Content typeContent blockHeadless CMSSchema markup

A CSP limits the damage from XSS and compromised third-party scripts by blocking anything not on your approved list. It takes careful setup, since a strict policy can break legitimate tools. Starting in report-only mode helps you tune it safely.

Related:Security headersCross-site scripting (XSS)Third-party scripts

Each content type has its own fields and templates, so editors fill in a form instead of designing from scratch. Clear content types keep pages consistent and make it easy to list, filter and reuse content around the site.

Related:Content modelCustom post typeContent block

Contentful stores content as structured entries that any site or app can request through an API. Teams define content models once and reuse components across pages and channels. It fits organizations with several sites, regions or apps that need consistent content.

Related:Headless CMSContent modelContent blockSanity

CRO uses analytics, user research and testing to find and fix what stops people from converting. Small improvements on key pages can add up to meaningful revenue without more traffic. It works best as an ongoing habit, not a one-time project.

Related:A/B testCall to action (CTA)HeatmapConversion tracking

Without conversion tracking, you cannot tell which ads, pages or campaigns bring in leads and sales. It connects your site to analytics and ad platforms. Accurate tracking is the difference between guessing and managing a marketing budget.

Related:Key eventAttributionConversions API (server-side tracking)UTM parameters

Server-side tracking is more resilient to ad blockers and browser restrictions, which helps ad platforms optimize. It must respect user consent and privacy laws. It takes more setup than a simple browser pixel.

Related:Meta PixelConversion trackingConsent mode

Depending on where your visitors are, laws like GDPR and some US state privacy laws affect what you can track and how you must ask. A good banner is clear, honest and actually controls the tags that run. It should be set up with your legal guidance in mind.

Related:Consent modeGoogle Tag Manager (GTM)Data breach

Core Web Vitals measure how real visitors experience your pages and are part of Google's page experience signals. More importantly, slow or jumpy pages frustrate people and cost conversions. Google reports them in Search Console and PageSpeed Insights using real-user data.

Related:Largest Contentful Paint (LCP)Interaction to Next Paint (INP)Cumulative Layout Shift (CLS)PageSpeed Insights

Crawl budget mostly matters for large sites with thousands of URLs, like big catalogs. Wasting it on duplicate, filtered or broken pages can delay important pages from being found. Small sites rarely need to worry about it.

Related:CrawlingIndexingCanonical tag

If a page cannot be crawled, it cannot be ranked. Broken links, blocked resources and orphan pages with no internal links all get in the way. Good internal linking and a clean sitemap make crawling easy.

Related:IndexingCrawl budgetInternal linkingXML sitemap

Because people reuse passwords, a leak from an unrelated service can unlock your site, email or bank. Unique passwords from a password manager and MFA shut this down. Sites with customer logins should also watch for unusual login patterns.

Related:Brute force attackPassword managerMulti-factor authentication (MFA)Data breach

Connecting your website forms to a CRM like HubSpot or Salesforce means no lead gets lost in an inbox. It lets sales follow up quickly and lets you see which marketing produces revenue, not just form fills. It is often the most valuable integration a business site has.

Related:Marketing automationWebhookAttribution

CSRF abuses the trust a site has in a logged-in user. Well-built applications use tokens and cookie settings to block it. It is another reason to keep CMS core and plugins updated.

Related:Cross-site scripting (XSS)Session hijackingSecurity headers

XSS can steal sessions, deface pages or redirect users. It usually comes from code that displays user input without cleaning it, often in plugins. Secure coding, updates and a Content Security Policy reduce the risk.

Related:Content Security Policy (CSP)Plugin vulnerabilityWeb application firewall (WAF)

CSS turns structured HTML into your brand's visual design. Well-organized CSS keeps pages fast and makes design changes predictable. Large unused stylesheets slow pages down, which is why minification and trimming matter.

Related:HTMLResponsive designMinification

Layout shifts make people tap the wrong button or lose their place. Common causes are images without set dimensions, late-loading ads and fonts that swap. These are usually simple to fix once identified.

Related:Core Web VitalsLazy loadingLargest Contentful Paint (LCP)

Custom post types let WordPress store structured content with its own fields and templates. Instead of cramming everything into pages, your team fills in a simple form and the design stays consistent. It is the WordPress version of a content model.

Related:WordPressContent typeContent model

CVE IDs let security tools and vendors talk about the same flaw precisely. Scanners match your installed software against CVEs to flag risks. Watching CVEs for your CMS and plugins tells you when updates are urgent.

Related:Vulnerability scanningPatch managementPlugin vulnerability

Sites can follow the visitor's system setting with the prefers-color-scheme media query or offer a toggle. Dark themes still need sufficient color contrast and should be tested, not just inverted.

Related:Color contrastResponsive design

Breaches bring cleanup costs, lost trust and, in many cases, legal duties to notify affected people under state and industry rules. Collect only the data you need, protect what you keep, and know your notification obligations. An incident response plan shortens the damage.

Related:Incident response planEncryption at restHIPAAPCI DSS

Each website you track gets a web data stream with its own measurement ID (starting with G-). Settings like enhanced measurement are configured per stream.

Related:Google Analytics 4 (GA4)Event trackingGoogle Tag Manager (GTM)

It was called Data Studio, renamed Looker Studio in 2022, and renamed back to Data Studio in 2026. Reports can combine several sources, update automatically and be emailed on a schedule.

Related:Google Analytics 4 (GA4)Google Search Console

DDoS attacks can take a site down for hours and are cheap for attackers to launch. CDNs and DDoS protection services absorb and filter the flood. Any business that cannot afford downtime should have this in place.

Related:Web application firewall (WAF)Content delivery network (CDN)Rate limitingUptime

Dedicated servers offer full control and consistent performance for heavy workloads. They cost more and require skilled administration. Today many businesses get similar results more flexibly with cloud hosting.

Related:Virtual private server (VPS)Cloud hostingWeb hosting

Hosts like Netlify and Vercel create deploy previews for pull requests so you can review changes before they go live. They are a lightweight alternative to a permanent staging site.

Related:Staging siteNetlifyVercel

A design system defines buttons, forms, typography, colors and page sections once so every new page matches. It speeds up design and development and reduces one-off fixes. It pairs naturally with content blocks in a CMS.

Related:Content blockStyle guideUser interface (UI)

A DXP goes beyond a CMS by tying content to customer data so different visitors can see different experiences. These platforms are built for large brands with many sites, regions and teams. For most small and mid-sized businesses, a well-chosen CMS plus a few integrations does the job at far lower cost.

Related:OptimizelyComposable architectureContent management system (CMS)

Divi bundles a theme and a drag-and-drop builder in one product, with many prebuilt layouts. It is approachable for owners who want to edit visually. Like other builders, content is tied closely to the tool, so switching away later usually means rebuilding pages.

Related:Page builderElementorWordPressTheme

DKIM adds a signature that receiving servers check against a key in your DNS. It improves deliverability and makes spoofing harder. Each service that sends mail for you should be set up with its own DKIM key.

Related:SPFDMARCTXT record

DMARC is what actually stops criminals from sending email as your domain. Start by monitoring, fix legitimate senders, then move to quarantine or reject. Major mailbox providers now require it for bulk senders, so it also protects deliverability.

Related:SPFDKIMBusiness email compromise (BEC)Phishing

DNS records tell the world where your website, email and other services live. A wrong record can take your site or email down, so changes should be planned and documented. DNS is also where email authentication records like SPF, DKIM and DMARC are published.

Related:A recordCNAME recordNameserversTTL (time to live)DNSSEC

DNSSEC helps stop attackers from secretly redirecting visitors to fake servers. It must be supported and set up at both your DNS provider and registrar. When changing DNS providers, it needs careful handling to avoid an outage.

Related:DNS (Domain Name System)Domain hijackingRegistrar lock

Drop-catching services attempt the registration as soon as the name is released. If several people backorder the same name, it often goes to auction.

Related:Domain nameDomain registrarUDRP

A hijacked domain can send your visitors and email to criminals. Protect the registrar account with MFA, keep contact emails current, and enable registrar lock. Make sure the domain is in an account your business owns.

Related:Registrar lockDomain registrarDNSSECMulti-factor authentication (MFA)

Your domain is a core business asset, used for your website and usually your email. Register it in an account your business controls, not a former vendor's. Losing access to it can take your site and email offline.

Related:Domain registrarDNS (Domain Name System)Domain hijackingRegistrar lock

The registrar holds the keys to your domain, including where its DNS points. Protect that account with strong passwords and multi-factor authentication, keep contact details current, and turn on auto-renew. Expired or hijacked domains are a painful and avoidable problem.

Related:Domain nameRegistrar lockNameserversMulti-factor authentication (MFA)

Duplicate content rarely causes a penalty, but it confuses search engines about which page to rank. That can dilute visibility. Canonical tags, redirects and unique copy for each page keep things clear.

Related:Canonical tag301 redirectIndexing

It was once a common fix for sites search engines could not render. Google now calls it a workaround, not a recommended long-term solution, and suggests server-side rendering or static generation instead.

Related:Client-side rendering (CSR)Server-side rendering (SSR)Static site generation (SSG)

E-E-A-T comes from Google's search quality rater guidelines. It is not a single ranking factor, but it describes what Google wants to reward: content from people who know the subject, with clear authorship and a trustworthy business behind it. It matters most for health, finance, legal and other high-stakes topics.

Related:Search engine optimization (SEO)Generative engine optimization (GEO)Backlink

Edge functions can handle redirects, personalization, A/B tests and security checks with very little delay. Because they run near the user, they help pages respond quickly worldwide. They are best for light, fast tasks rather than heavy processing.

Related:Content delivery network (CDN)ServerlessTime to First Byte (TTFB)

Elementor gives editors visual control over layouts, templates and widgets inside WordPress. It works well for marketing teams who want to change pages themselves. It needs careful setup to stay fast, and its own add-on plugins should be kept updated like any other plugin.

Related:Page builderWordPressDiviPlugin

Embeddings let a search tool find "cancel my plan" when your page says "end your subscription." They power smart site search and RAG chatbots. They are stored and searched in a vector database.

Related:Vector databaseRetrieval-augmented generation (RAG)Large language model (LLM)

If a server, laptop or backup is stolen, encryption at rest keeps the data useless to the thief. Most reputable cloud and hosting providers offer it, but it should be confirmed, especially for regulated data. Protecting the keys matters as much as the encryption.

Related:Encryption in transitBackupsHIPAAData breach

TLS is the standard way to encrypt web traffic in transit. It should cover your website, forms, APIs and connections to databases and third-party services. It is a baseline expectation for any site handling personal data.

Related:SSL/TLSEncryption at restHTTPS

A session counts as engaged if it lasts longer than 10 seconds, includes a key event or has at least two page or screen views. Engagement rate replaced bounce rate as GA4's main quality signal.

Related:Bounce rateGoogle Analytics 4 (GA4)Key event

Keeping secrets in environment variables instead of code means they are not exposed in your repository. Hosts like Netlify and Vercel let you set different values for production and previews.

Related:APINetlifyVercel

When buying or selling a domain or website, escrow protects the buyer from paying for assets that never transfer and the seller from handing over assets without payment.

Related:Seller's discretionary earnings (SDE)Domain name

Page views alone do not tell you what people did. Event tracking shows which buttons, forms and content actually drive results. It is the foundation for conversion tracking and attribution.

Related:Google Analytics 4 (GA4)Key eventGoogle Tag Manager (GTM)

Google added this spam policy in March 2024. Buying an expired domain for a genuine new business or rebrand is fine. Repurposing a respected old domain to host thin content that has nothing to do with its history is not.

Related:Spam policiesDomain nameBacklink

A clear favicon makes your site easier to spot among open tabs. Google can show it next to your result, so use a simple square version of your logo.

Related:Style guide

Featured snippets give one page prime placement for a question. Pages that answer clearly and concisely, often with a short paragraph, list or table, are more likely to be chosen. The same habits help with AI answers.

Related:Answer engine optimization (AEO)AI OverviewsSchema markup

Teams use Figma for wireframes, mockups, design systems and developer handoff. Several people can work in the same file at once and leave comments.

Related:WireframePrototypeDesign system

Attackers often modify core files or slip in hidden scripts. Integrity monitoring alerts you when files change outside planned updates. Fast detection means faster cleanup and less damage.

Related:MalwareSupply chain attackIncident response plan

FCP tells you when visitors first see that something is happening. A slow FCP makes people think the site is broken and leave. It is closely tied to server speed and render-blocking resources.

Related:Largest Contentful Paint (LCP)Render-blocking resourcesTime to First Byte (TTFB)

Keyboard and assistive technology users rely on it to know where they are on the page. Removing focus outlines without a clear replacement is a common accessibility failure.

Related:AccessibilityWCAGScreen reader

Framer lets designers publish polished sites with motion and responsive layouts quickly. It suits startups and small marketing sites that change often. As with any hosted builder, you are tied to its platform, plans and feature limits.

Related:WebflowPrototypeAI website builder

Front-end work covers layout, design, interactivity and speed in the browser. It is what visitors judge your business on in the first few seconds. A strong front end is fast, accessible and works well on phones.

Related:Back endReactResponsive design

It requires a lawful basis for processing data, transparency and respect for rights like access and deletion. Under related EU rules, most non-essential cookies need consent before they are set.

Related:Privacy policyCookie consent bannerConsent mode

Generative AI tools summarize the web, and GEO aims to make your content easy for them to understand and trust. That means clear facts, consistent business information across the web, expert content and mentions on reputable sites. The field is young, so be wary of anyone promising guaranteed results.

Related:Answer engine optimization (AEO)Large language model (LLM)llms.txtE-E-A-T

Git lets you see who changed what, undo mistakes and work on new features in branches without breaking the live site. It is the standard for software and website code.

Related:Version control (Git)GitHubRepository

Developers use GitHub to store code, review changes and track issues. Hosts like Netlify and Vercel can deploy a site automatically every time code is pushed to GitHub.

Related:GitRepositoryNetlify

California and Colorado require covered businesses to honor it, and regulators have enforced this. Consent tools can detect the signal and apply the opt-out automatically.

Related:CCPACookie consent bannerPrivacy policy

GA4 replaced Universal Analytics, which stopped processing data in 2023. It tracks how people find and use your site and which actions count as key events. It needs deliberate setup to measure what matters to your business, not just page views.

Related:Google Tag Manager (GTM)Key eventConversion trackingConsent mode

Your profile shows hours, reviews, photos and directions, and is often the first thing local customers see. Keep it complete and accurate, respond to reviews and post updates. Make sure it is owned by a business account you control.

Related:Local SEOSearch engine optimization (SEO)

Core updates are not aimed at any one site. They reassess how content is ranked overall, so some pages rise and others fall. Google's advice after a drop is to focus on helpful, reliable, people-first content rather than quick fixes.

Related:E-E-A-TSpam policiesSearch engine optimization (SEO)

Search Console shows the queries people use to find you, which pages are indexed, and problems like crawl errors or Core Web Vitals issues. It is essential during and after a redesign. It should be set up for every business site.

Related:IndexingXML sitemapCore Web VitalsGoogle Analytics 4 (GA4)

GTM lets marketers install analytics, ad pixels and conversion tags from one dashboard. It speeds up campaigns and keeps tracking organized. Too many tags can slow a site and leak data, so it needs governance.

Related:Google Analytics 4 (GA4)Meta PixelConversion tracking

GraphQL can reduce the number of requests and the amount of data a page loads, which helps performance on complex sites. Many headless CMS and commerce platforms offer it. It adds some complexity, so it is used where the flexibility pays off.

Related:APIREST APIHeadless CMS

Gutenberg replaced the old single text box in WordPress with a block-based editor. Well-built custom blocks let your team assemble on-brand pages without a heavy page builder plugin. That usually means cleaner code, faster pages and fewer things that can break during updates.

Related:WordPressPage builderContent block

Hallucinations are a real risk for customer-facing AI, especially on prices, policies or legal and medical topics. Grounding answers in your content, limiting scope and adding human review reduce the risk. Never let an AI make promises your business cannot keep.

Related:Retrieval-augmented generation (RAG)AI chatbotLarge language model (LLM)

A headless CMS lets one source of content feed a website, mobile app, kiosk or anything else. We use it when content must reach several channels or power a fast Next.js front end. It costs more to set up than a traditional CMS, and editors lose some of the instant visual preview unless it is built in.

Related:ContentfulSanityNext.jsAPIContent model

Headless commerce lets brands build a fast, fully custom shopping experience while the platform handles orders and payments. It suits high-volume or content-rich brands. It costs more to build and maintain than a standard theme, so it should solve a real problem.

Related:Composable architectureHeadless CMSNext.jsShopify

Heatmaps reveal whether people see your key content and calls to action or ignore them. They are a quick way to spot design problems. They should be configured to avoid capturing sensitive form data.

Related:Session recordingConversion rate optimization (CRO)Above the fold

Medical and health businesses must protect protected health information (PHI), including what visitors submit through website forms. Vendors handling PHI, such as form or hosting providers, typically need to sign a business associate agreement. Standard contact forms and many analytics tools are not HIPAA-ready by default.

Related:Encryption at restData breachSOC 2

If the field contains anything, the submission is treated as spam. Honeypots are invisible to real visitors, so they block a lot of basic spam without hurting conversions.

Related:CAPTCHABot protectionCloudflare Turnstile

If you have pages in several languages or for different countries, hreflang helps the right version appear in the right market. Mistakes are common and can cause the wrong page to rank. It needs careful, consistent setup across every version.

Related:Canonical tagTechnical SEOMulti-storefront

HSTS closes the gap where a visitor might first reach an insecure version of your site, which attackers can exploit. Once set, browsers refuse plain HTTP connections. It should be enabled only after HTTPS works everywhere on the domain.

Related:HTTPSSSL/TLSSecurity headers

Every website ultimately sends HTML to the browser. Clean, semantic HTML helps search engines and AI tools understand your content, and helps screen readers serve people with disabilities. Messy markup from bloated tools can hurt all three.

Related:CSSJavaScriptAccessibility

HTTPS protects logins, forms and payments from being read or altered in transit. Browsers flag non-HTTPS pages as not secure, and Google treats HTTPS as a ranking signal. Every page of a business site should use it.

Related:SSL/TLSHSTSMixed content

Hydration lets a page appear quickly and then become interactive. Heavy hydration can make a page look ready while buttons still feel sluggish, which shows up in INP scores. Good engineering keeps it light.

Related:Server-side rendering (SSR)Interaction to Next Paint (INP)React

Oversized images are one of the most common reasons business websites are slow. Compressing, resizing and serving modern formats can shrink files dramatically with little visible change. It is often the cheapest speed fix available.

Related:WebPAVIFLazy loadingLargest Contentful Paint (LCP)

Google Search Console counts an impression when your link appears on a results page a person loads. Rising impressions with flat clicks often means you are ranking for more queries but not high enough, or your snippet needs work.

Related:Click-through rate (CTR)Google Search Console

In a breach, confusion wastes hours. A plan names who decides, how to contain the problem, how to restore from backups, and who must be notified, including customers or regulators where required. Review and practice it at least once a year.

Related:Data breachBackupsRansomware

ISR gives you the speed of static pages without rebuilding the whole site when one product or post is updated. It is ideal for large catalogs and content sites on a headless CMS. Editors publish, and the page refreshes shortly after.

Related:Static site generation (SSG)Next.jsHeadless CMSCaching

Crawled pages are not always indexed: search engines skip pages they see as duplicate, low quality or blocked. Google Search Console shows which pages are indexed and why others are not. Checking it after a launch catches problems early.

Related:CrawlingGoogle Search ConsoleNoindexCanonical tag

Bing and several other search engines support IndexNow. Many CMSs and SEO plugins can send pings automatically. Google does not currently use it, so keep your XML sitemap up to date as well.

Related:Bing Webmaster ToolsXML sitemapIndexing

Good information architecture means visitors find services, pricing and contact details without thinking. It also shapes your URLs, navigation and internal links, which affects SEO. It is usually planned with a sitemap before design starts.

Related:User experience (UX)WireframeInternal linking

INP replaced First Input Delay as a Core Web Vital in 2024. Poor INP means buttons and menus feel laggy, usually because too much JavaScript is running. Trimming third-party scripts and heavy code usually helps most.

Related:Core Web VitalsJavaScriptHydration

Internal links help visitors find more of what they need and help search engines understand which pages matter. They spread ranking value around the site. A thoughtful linking plan is one of the cheapest SEO improvements.

Related:CrawlingBacklinkSearch engine optimization (SEO)

Without syncing, you risk selling items you do not have or hiding items you do. Integrations through APIs or connectors keep counts current. It becomes essential once you sell in more than one place.

Related:SKUAPIWebhook

Jamstack stands for JavaScript, APIs and Markup. Pre-built pages load fast and have a smaller attack surface because there is no live database behind each page view. The idea has since blended into frameworks like Next.js that mix static and dynamic rendering.

Related:Static site generation (SSG)Content delivery network (CDN)APIComposable architecture

JavaScript runs in the browser and powers most interactivity online. Too much of it, especially from third-party tags, is a leading cause of slow, laggy pages. Keeping scripts lean improves speed and Core Web Vitals.

Related:ReactInteraction to Next Paint (INP)Render-blocking resources

JSON-LD keeps structured data tidy and easy to maintain because it does not tangle with your page HTML. Most CMS SEO tools generate it, and custom builds can produce it from your content model. Test it with Google's Rich Results Test after changes.

Related:Schema markupAnswer engine optimization (AEO)Google Search Console

Google renamed GA4 conversions to key events in 2024, while Google Ads still uses the word conversions. Marking the right actions lets you see which channels and pages produce results. Too many key events blur the picture.

Related:Google Analytics 4 (GA4)Conversion trackingEvent tracking

Google can create key moments automatically or use the timestamps you provide in the video description or with Clip structured data. They help searchers jump to the part of a video that answers their question.

Related:Schema markupRich results

Keyword research tells you what people actually ask, how they phrase it, and how competitive it is. It shapes site structure, page topics and content plans. Without it, sites often target terms nobody searches.

Related:Search engine optimization (SEO)Answer engine optimization (AEO)Internal linking

Landing pages remove distractions and match the promise of the ad that brought someone there. That focus usually converts better than sending traffic to a general home page. They are ideal for A/B testing.

Related:Call to action (CTA)A/B testUTM parameters

LLMs power AI chatbots, writing tools and AI search answers. They are increasingly how people research businesses, which is why AEO and GEO matter. They can also be built into your site for support, search or internal tools, with proper safeguards.

Related:AI chatbotRetrieval-augmented generation (RAG)Generative engine optimization (GEO)Hallucination

LCP reflects how fast a page feels like it has loaded. Large uncompressed images, slow servers and render-blocking code are the usual culprits. Fixing LCP is often the biggest perceived speed improvement you can make.

Related:Core Web VitalsImage compressionTime to First Byte (TTFB)Render-blocking resources

Lazy loading cuts the amount of data a page loads up front, making it faster on phones and slow connections. It should not be applied to the main hero image, since that delays LCP. Modern browsers support it natively.

Related:Image compressionLargest Contentful Paint (LCP)Cumulative Layout Shift (CLS)

Forms, calls, chat, quote calculators and free offers like audits are common lead generation tools. Tracking each lead's source shows which pages and campaigns actually bring in business.

Related:Landing pageConversion trackingCRM

llms.txt is a community proposal, similar in spirit to robots.txt, meant to help large language models find a site's most useful pages. It is not an official standard, and major AI providers have not confirmed they rely on it. It is cheap to add, but it is no substitute for clear content and structured data.

Related:robots.txtGenerative engine optimization (GEO)Large language model (LLM)

Also called the map pack, it appears for searches like "plumber near me." Listings come from Google Business Profiles, and placement depends largely on relevance, distance and prominence. Reviews, accurate categories and a strong website all help.

Related:Google Business ProfileLocal SEOLocal citations

Citations on sites like Yelp, Apple Business Connect, Bing Places and industry directories help confirm that your business is real and where it is located. Accuracy matters more than volume, so fix wrong or duplicate listings before adding new ones.

Related:NAP+W consistencyLocal SEOLocal 3-pack

Local SEO relies on a complete Google Business Profile, consistent name, address and phone details across the web, reviews and location pages. For service businesses it often drives the most valuable calls. It is closely tied to how AI tools recommend local businesses too.

Related:Google Business ProfileSchema markupSearch engine optimization (SEO)

On websites, malware can redirect visitors to scams, inject spam links or steal checkout data. Search engines and browsers may flag an infected site, cutting traffic overnight. Updates, a WAF, scanning and clean backups keep it out and speed recovery.

Related:RansomwareVulnerability scanningFile integrity monitoringBackups

Managed WordPress plans cost more than shared hosting, but they include the speed tuning, staging sites, backups and malware protection most businesses need. They save developer time and reduce risk. Check what each plan includes, since features and limits vary.

Related:WordPressShared hostingStaging siteBackups

Manual actions can lower rankings for some pages or remove a whole site from results. You can see them in Google Search Console under Manual actions. After fixing the problem, you submit a reconsideration request explaining what changed.

Related:Google Search ConsoleSpam policiesBacklink

Automation can nurture new leads, recover abandoned carts and send timely follow-ups without manual effort. It works best with clean CRM data and clear goals. Over-automating can feel impersonal, so keep messages relevant.

Related:CRMCart abandonmentUTM parameters

Meta descriptions do not directly affect rankings, but a clear one can improve how many people click. Google sometimes rewrites them using text from the page. Write them for people: what the page offers and why it is worth a click.

Related:Title tagOpen Graph tagsSearch engine optimization (SEO)

The Meta Pixel connects your site to your Meta ad account so you can measure results and build audiences. Browser privacy changes and ad blockers reduce what it captures. Pairing it with the Conversions API improves accuracy.

Related:Conversions API (server-side tracking)Conversion trackingConsent mode

Minified CSS and JavaScript download faster without changing how the site works. Most modern build tools and performance plugins do this automatically. It is a small but standard optimization.

Related:CSSJavaScriptRender-blocking resources

Mixed content can break the padlock, trigger browser warnings or block scripts entirely. It often appears after moving to HTTPS or from old hard-coded links. Fixing it is usually a quick cleanup.

Related:HTTPSSSL/TLSContent Security Policy (CSP)

Starting with mobile forces clear priorities: what matters most gets the space. It usually produces faster, simpler pages for everyone. It matches how Google indexes sites, using the mobile version.

Related:Responsive designUser experience (UX)Core Web Vitals

Introduced by Anthropic in 2024, MCP lets an assistant like Claude read files, query a database or act in an app through a server that exposes those abilities. Only connect servers you trust, since they can take real actions.

Related:AI agentAPIPrompt injection

Mood boards help clients and designers agree on direction before detailed design begins. Use them to study what you like about other work, not to copy it.

Related:Style guideDesign systemWireframe

MFA blocks most account takeovers even when a password is stolen. Turn it on for email, hosting, domain registrar, CMS admin, payment and social accounts. App-based prompts, passkeys and security keys are stronger than text-message codes.

Related:Two-factor authentication (2FA)PasskeysCredential stuffingPhishing

Multi-storefront setups let you manage products and orders in one place while showing different brands, prices or languages. It is common for wholesale and retail splits or international selling. Platform support for it varies, so it should be confirmed early.

Related:BigCommerceB2B pricingHreflang

MX records route your business email. Mistakes during a website or DNS move are a classic cause of lost mail. Always confirm MX records are carried over when changing nameservers or hosts.

Related:DNS (Domain Name System)NameserversTXT record

Whoever controls your nameservers controls your DNS. You set them at your registrar, often pointing to your host or a DNS provider like a CDN. Changing nameservers moves all your records at once, so copy every record first or email can break.

Related:DNS (Domain Name System)Domain registrarMX record

Search engines compare your details across your website, Google Business Profile and directories. Mismatches, like an old phone number or a suite number written two ways, make it harder for them to trust which version is right. Consistent details support local rankings and help customers reach you.

Related:Local SEOGoogle Business ProfileLocal citations

Netlify offers global CDN hosting, deploy previews, forms, serverless functions and automatic SSL. It is popular for Jamstack and Next.js sites.

Related:VercelJamstackDeploy preview

Next.js is our pick when a project needs speed, custom functionality or a headless CMS front end. It can pre-build pages, render them on the server, or update them on a schedule, which helps Core Web Vitals and SEO. It needs developers to build and maintain, so it is not a DIY tool.

Related:ReactStatic site generation (SSG)Server-side rendering (SSR)Incremental static regeneration (ISR)Headless CMS

Node.js powers frameworks like Next.js and many build tools. It lets teams use one language for both front end and back end.

Related:JavaScriptNext.jsBack end

Noindex is the right tool for thank-you pages, staging sites and thin pages you do not want in search. Left on by accident after a launch, it can wipe a site from Google. Checking for stray noindex tags is part of every launch checklist.

Related:robots.txtIndexingStaging site

OAuth is how most integrations connect securely, granting specific permissions that can be revoked. Review which apps have access to your accounts and remove ones you no longer use. Over-broad permissions are a quiet security risk.

Related:Single sign-on (SSO)APIPrinciple of least privilege

Without Open Graph tags, shared links can show a random image or a cut-off title. Setting them makes every share look intentional and on-brand. They also feed previews in many chat and collaboration tools.

Related:Meta descriptionTitle tagSchema markup

Optimizely (formerly Episerver) is used by larger organizations that need personalization, testing and content management in one suite. It is powerful but carries enterprise pricing and implementation effort. It makes sense when a company has the team and traffic to use those features.

Related:Digital experience platform (DXP)A/B testHeadless CMS

Page builders such as Elementor and Divi let non-developers lay out pages visually. They are fast for getting started, but they can add extra code that slows pages down, and moving away from one later often means rebuilding pages. We weigh editing convenience against long-term speed and maintenance before choosing one.

Related:ElementorDiviGutenberg (block editor)Core Web Vitals

PageSpeed Insights shows both lab test results and, when available, real-user data from Chrome. The real-user field data is what matters most for visitors and Google. Treat the score as a guide to priorities, not a goal on its own.

Related:Core Web VitalsLargest Contentful Paint (LCP)Google Search Console

Passkeys are built on FIDO standards and are designed to resist phishing, since there is no password to steal or type into a fake site. Major platforms and many services now support them. They are a strong option for both staff accounts and customer logins.

Related:Multi-factor authentication (MFA)PhishingPassword manager

A password manager makes unique passwords practical, which defeats credential stuffing. Business versions let teams share access securely and remove it when someone leaves. Protect the manager itself with a strong master password and MFA.

Related:Credential stuffingMulti-factor authentication (MFA)Principle of least privilege

Most website hacks exploit known flaws that already had a fix. Regular updates to the CMS, plugins, themes and server close those doors. Test on staging, keep backups, and treat critical security updates as urgent.

Related:Plugin vulnerabilityZero-day vulnerabilityStaging siteBackups

Gateways such as Stripe, PayPal and Shopify Payments handle the sensitive part of checkout. Using a reputable hosted gateway keeps card data off your servers, which greatly reduces your security and PCI burden. Fees and features vary, so check current pricing.

Related:PCI DSSTokenizationCheckout

If you take card payments, you are expected to follow PCI DSS. Using a hosted payment gateway that keeps card data off your servers makes compliance much simpler. Card data stored or handled carelessly can lead to fines, lost processing ability and breaches.

Related:Payment gatewayTokenizationData breachEncryption in transit

Pen tests go beyond automated scans by chaining issues together like a real attacker would. They are common for web apps that handle sensitive data or need compliance evidence. Fixing the findings is the point, so plan time for remediation.

Related:Vulnerability scanningSOC 2Security audit

Phishing is one of the most common ways businesses get breached. Messages often imitate banks, vendors, shipping companies or your own IT. Training, email authentication, MFA and passkeys sharply reduce the risk.

Related:Spear phishingBusiness email compromise (BEC)DMARCSocial engineering

PHP runs on the server to build pages before they reach the browser. Keeping your host's PHP version current matters for speed and security.

Related:WordPressBack end

Plugins are a big reason WordPress is flexible, but each one is third-party code running on your site. Too many plugins can slow the site and widen the attack surface, especially if they are abandoned by their developers. We keep plugin lists short, reputable and updated.

Related:WordPressPlugin vulnerabilityPatch managementSupply chain attack

Plugins are the most common entry point for WordPress compromises. Abandoned or obscure plugins are the biggest risk. Keep the list short, remove unused plugins, update promptly and watch vulnerability alerts.

Related:PluginPatch managementSupply chain attackCVE

If an account with limited access is compromised, the damage is limited too. On a website, that means editors are not admins and old vendor accounts are removed. Review access regularly, especially when staff or agencies change.

Related:Access controlSingle sign-on (SSO)Incident response plan

Many laws, and tools like Google Analytics, require one when you collect personal information. It should match what your site actually does, including forms, analytics, cookies and third-party tools.

Related:GDPRCCPACookie consent banner

A clean product feed powers shopping ads and free product listings. Errors in titles, prices or availability can get products rejected. Feeds are usually generated by your ecommerce platform or an app.

Related:SKUGoogle Analytics 4 (GA4)Meta Pixel

Variants let shoppers choose options on one product page instead of hunting through separate listings. Each variant usually has its own SKU, price and stock level. How a platform limits variants can affect which one fits your catalog.

Related:SKUShopifyCanonical tag

Clear prompts with context, examples and constraints get far better results than vague ones. For business tools, prompts are often written once by a developer and reused behind the scenes. They are part of how a chatbot stays on-brand and on-topic.

Related:Large language model (LLM)Prompt injectionAI chatbot

If your chatbot or AI tool reads user messages, web pages or documents, someone can try to slip in commands like "ignore your instructions." This can expose data or cause harmful actions. Limit what the AI can access and do, and treat its outputs with caution.

Related:AI chatbotAI agentPrinciple of least privilege

Prototypes let stakeholders and real users try the experience early. Finding confusing steps here costs far less than fixing them in code. They range from quick clickable wireframes to near-final designs.

Related:WireframeDesign systemA/B test

Ransomware can halt a business for days or weeks. Offline or immutable backups, MFA, patching and staff training are the core defenses. Have an incident response plan ready before you need it.

Related:Malware3-2-1 backup ruleIncident response planPatch management

Rate limiting slows brute force logins, scraping, form spam and some denial of service attempts. It is set at the server, CDN or application level. Limits should be tuned so real customers are not blocked.

Related:Brute force attackBot protectionCredential stuffing

React lets developers build complex, fast interfaces from reusable pieces. It is the foundation of Next.js and many modern web apps. It is a strong choice for custom functionality, but a simple brochure site does not always need it.

Related:Next.jsJavaScriptSingle-page application (SPA)

Older versions show a checkbox or image puzzles; reCAPTCHA v3 runs in the background and returns a score your site uses to decide what to do. The token must be verified on your server.

Related:CAPTCHACloudflare TurnstileBot protection

Large or fast motion can cause discomfort for some people. Respect the setting by turning off or toning down parallax, auto-playing effects and big transitions.

Related:AccessibilityView transitionsScroll-driven animations

Registrar lock (also called transfer lock) prevents unauthorized transfers, a common step in domain hijacking. It is usually free and takes seconds to enable. Valuable domains can also use stronger registry-level locks.

Related:Domain hijackingDomain registrarDNSSEC

If a page waits on several large files before showing anything, visitors stare at a blank screen. Deferring non-essential scripts and inlining critical styles lets content appear sooner. This is a frequent finding in speed audits.

Related:First Contentful Paint (FCP)Largest Contentful Paint (LCP)JavaScriptMinification

Often shortened to repo. Your business should own the repository for its website, or at least have admin access, so you are never locked out by a former developer.

Related:GitGitHubVersion control (Git)

Most web traffic for many businesses comes from phones, and Google primarily evaluates the mobile version of a site. A responsive site gives every visitor a usable experience. It is a baseline requirement, not an extra.

Related:Mobile-first designCSSCore Web Vitals

REST is the most widespread way systems share data on the web, and most business tools offer one. It is simple to work with and well supported. It is the default choice for many integrations.

Related:APIGraphQLWebhook

Retainers suit continuing work like content, SEO, updates and improvements. Make sure the scope, hours and what happens to unused time are clear.

Related:Website care plan

RAG lets a chatbot answer from your own policies, services and FAQs instead of guessing from general training data. It makes answers more accurate and easier to keep current. It is the usual approach for business chatbots and internal knowledge tools.

Related:EmbeddingsVector databaseAI chatbotHallucination

A reverse proxy can serve a blog from another system at example.com/blog, add caching or security, or balance traffic. CDNs and hosts like Netlify, Vercel and Cloudflare offer rewrites that work this way.

Related:Content delivery network (CDN)SubdirectoryWeb application firewall (WAF)

A good website RFP explains your goals, audience, scope, must-have features, budget range and timeline. Clear RFPs get comparable proposals and fewer surprises.

Related:Information architectureContent management system (CMS)

Google can show rich results when a page includes valid structured data and meets its guidelines. Markup makes a page eligible but does not guarantee the enhanced display. Use Google's Rich Results Test to check your markup.

Related:Schema markupJSON-LDFeatured snippet

robots.txt keeps crawlers away from areas like admin pages and search results. It is a request, not a security control, and it does not reliably keep a page out of search results. One wrong line can block an entire site, which is a surprisingly common launch mistake.

Related:XML sitemapCrawlingNoindexllms.txt

Website builders like Wix and Shopify, CRMs and email tools are SaaS. You get updates and hosting included, but you pay ongoing fees and depend on the vendor.

Related:Content management system (CMS)CRM

Sanity lets developers shape the editing interface around how your team actually works, and content is delivered through an API to any front end. It pairs well with Next.js for fast, flexible sites. Like other headless options, it needs a developer to set up and extend.

Related:Headless CMSContentfulNext.js

Google added this spam policy in March 2024. It applies whether pages are written by AI, people or a mix. Using AI to help write is not a violation in itself; mass-producing low-value pages to game search is.

Related:Spam policiesE-E-A-THallucination

Schema markup uses the shared Schema.org vocabulary to tell search engines and AI tools exactly what a page is about. It can make you eligible for rich results like star ratings and FAQ details, and it supports AEO. It must match what is visible on the page, or it can be ignored or penalized.

Related:JSON-LDAnswer engine optimization (AEO)Featured snippetContent model

Screen readers depend on real headings, labeled form fields, alt text and meaningful link text. Testing with one, such as VoiceOver or NVDA, reveals problems automated checkers miss.

Related:AccessibilityAlt textARIA

They can create progress bars, reveals and parallax effects without JavaScript, which is lighter and smoother. Keep them subtle so content stays readable.

Related:View transitionsReduced motionCSS

SEO covers technical health, content quality, site structure and reputation signals like links. Done well, it brings steady, high-intent visitors without paying for every click. It takes time, and shortcuts that try to trick search engines tend to backfire.

Related:Answer engine optimization (AEO)Technical SEOKeyword researchLocal SEO

Pages rank best when they match what the searcher actually wants. Someone searching "website cost" wants prices and ranges, not a sales pitch. Look at the pages already ranking for a query to see what format and depth searchers expect.

Related:Keyword researchSearch engine optimization (SEO)Featured snippet

An audit checks who has access, what is out of date, how backups work and whether email and DNS are protected. It produces a prioritized list of fixes. It is a smart step after a staff change, vendor change or relaunch.

Related:Access controlVulnerability scanningPenetration testing

Security headers block whole classes of attacks like clickjacking and some script injection at very low cost. They are set at the server, CDN or framework level. Free online tools can show which headers your site is missing.

Related:Content Security Policy (CSP)HSTSCross-site request forgery (CSRF)

Buyers and brokers often value content, ecommerce and small SaaS sites as a multiple of SDE or net profit. Clean financial records make the figure easier to prove.

Related:Escrow

SSR is useful for pages that must always be current or personalized, like account dashboards or live inventory. Search engines receive complete HTML, which helps SEO compared with rendering everything in the browser. It needs more server work than static pages, so it is used where freshness matters.

Related:Static site generation (SSG)Client-side rendering (CSR)Next.jsTime to First Byte (TTFB)

Serverless functions handle tasks like form submissions, payments or API calls and scale up automatically. They reduce server maintenance, though costs and limits need watching for heavy workloads. Many Next.js and Jamstack sites rely on them.

Related:Edge functionsCloud hostingAPI

Stolen session cookies can bypass passwords and even some MFA. HTTPS everywhere, secure cookie settings and short sessions for admin accounts reduce the risk. Malware on staff devices is a common source.

Related:HTTPSCross-site request forgery (CSRF)Malware

Watching real sessions shows where people get confused, hesitate or hit errors. It is valuable for CRO and bug finding. Make sure recordings mask personal information and are covered in your privacy policy.

Related:HeatmapConversion rate optimization (CRO)Cookie consent banner

Shared hosting is the cheapest way to get online and fine for very small sites. Because neighbors share resources, a busy or compromised site on the same server can slow or affect yours. Growing businesses usually outgrow it.

Related:Web hostingVirtual private server (VPS)Managed WordPress hosting

We recommend Shopify for most online stores. It is reliable, secure, has a large app ecosystem and lets owners run day-to-day operations themselves. Heavy customization and some B2B needs can push you toward higher plans, apps or a different platform.

Related:BigCommerceWooCommerceHeadless commercePayment gateway

SSO simplifies logins and lets you enforce MFA and remove access in one place when someone leaves. That reduces forgotten accounts and shared passwords. It is common in growing companies using Google Workspace or Microsoft 365.

Related:OAuthMulti-factor authentication (MFA)Principle of least privilege

SPAs feel smooth for dashboards, portals and tools. Built carelessly, they can be slow to first load and harder for search engines to index. For public content, frameworks like Next.js combine app-like navigation with search-friendly pages.

Related:Client-side rendering (CSR)ReactNext.js

An example is a news site hosting unrelated coupon or payday loan pages written by someone else. Google treats this as a spam policy violation. Only publish content you would stand behind as your own.

Related:Spam policiesManual actionSubdomain

SKUs keep inventory, orders and reporting accurate across your website, warehouse and accounting tools. A clear SKU scheme makes integrations and catalog migrations far easier. Messy SKUs cause messy data everywhere else.

Related:Product variantInventory syncProduct feed

SOC 2 reports cover controls for security and, optionally, availability, confidentiality, processing integrity and privacy. A Type I report looks at controls at a point in time; Type II tests them over a period. Larger clients often ask SaaS and service vendors for one.

Related:HIPAAPenetration testingAccess control

Attackers call help desks, pose as vendors or create urgency to get someone to bypass normal steps. Clear procedures and a culture where staff can say "let me verify" are the best defense. Technology alone does not solve it.

Related:PhishingSpear phishingBusiness email compromise (BEC)

They cover things like cloaking, hidden text, link schemes, scaled content abuse, expired domain abuse and site reputation abuse. Violations can be caught by automated systems or lead to a manual action.

Related:Manual actionScaled content abuseExpired domain abuse

Spear phishing uses real names, projects and vendors to look legitimate, so it is much harder to spot. Finance staff and executives are common targets. Verify unusual requests through a separate, known channel.

Related:PhishingBusiness email compromise (BEC)Social engineering

SPF helps receiving mail servers spot forged emails pretending to be from you. It is published as a TXT record and must include every service that sends on your behalf, like your CRM or newsletter tool. It works best combined with DKIM and DMARC.

Related:DKIMDMARCTXT record

SQL injection can expose customer records or take over a site. It happens when code passes user input straight to the database. Modern frameworks, careful plugin choices, updates and a WAF prevent most cases.

Related:Web application firewall (WAF)Plugin vulnerabilityData breach

Squarespace is a good fit for small businesses and simple shops that want a tidy site with little maintenance. Templates look polished out of the box. Custom functionality, advanced SEO control and integrations are more limited than on WordPress or a custom build.

Related:WixShopifyContent management system (CMS)

An SSL/TLS certificate is what puts the padlock and https in the address bar. Without it, browsers warn visitors that your site is not secure, and form data can be intercepted. Most hosts provide free certificates, but someone needs to confirm they renew automatically.

Related:HTTPSHSTSEncryption in transitMixed content

A staging site lets you try updates, new features and redesigns without risking the live site. Problems are caught where customers cannot see them. Staging copies should be blocked from search engines and protected with a password.

Related:Version control (Git)Patch managementrobots.txtNoindex

Static pages are fast, cheap to host and hard to break, because the server does not assemble each page on request. They suit marketing pages, blogs and documentation. The catch is that content changes require a rebuild, which ISR helps solve.

Related:Incremental static regeneration (ISR)Server-side rendering (SSR)JamstackContent delivery network (CDN)

A style guide keeps everyone who touches your brand consistent, from designers to outside vendors. It is often the starting point for a fuller design system. Consistency builds recognition and trust.

Related:Design systemUser interface (UI)

Content in a subdirectory is clearly part of your main site, shares its navigation and builds on its reputation. It is the usual choice for blogs, guides, service and location pages.

Related:SubdomainInformation architecture

Subdomains suit separate systems such as apps, help centers or stores on another platform. Google can treat a subdomain more like its own site, so content meant to strengthen your main site usually belongs in a subdirectory instead.

Related:SubdirectoryDomain nameDNS (Domain Name System)

Supabase is a common choice for apps built with frameworks like Next.js. Row Level Security rules control who can read and write each record, so they must be set up carefully.

Related:AuthenticationAPIServerless

You can do everything right and still be affected if a tool you depend on is compromised. Use reputable, actively maintained software, limit third-party scripts, and monitor for unexpected changes. Software inventories make it easier to respond fast.

Related:Plugin vulnerabilityThird-party scriptsFile integrity monitoring

Lighter pages, optimized images, fewer third-party scripts and green hosting all reduce a site's footprint, and usually make it faster too. The W3C publishes Web Sustainability Guidelines.

Related:Image compressionThird-party scriptsCore Web Vitals

Technical SEO includes site speed, sitemaps, redirects, canonical tags, structured data and mobile friendliness. Great content cannot rank if search engines struggle to access it. It is often where a redesign helps or hurts most.

Related:Search engine optimization (SEO)CrawlingIndexingXML sitemapCanonical tag

In WordPress and Shopify, the theme decides your design, page templates and much of your front-end code. A bloated theme can slow every page, while a well-built one keeps the site fast and easy to edit. Customizations should live in a child theme or custom code so updates do not wipe them out.

Related:Child themeWordPressShopifyAstra

Each third-party script can slow your site and has access to what happens on the page, including forms. If the provider is compromised, so is every site that loads it. Keep only the scripts you need and control them with a Content Security Policy.

Related:Supply chain attackContent Security Policy (CSP)Google Tag Manager (GTM)

A slow TTFB delays everything else on the page. It is usually caused by slow hosting, missing caching or heavy server-side work. Better hosting, a CDN and page caching are the typical fixes.

Related:CachingContent delivery network (CDN)Largest Contentful Paint (LCP)Web hosting

The title tag is one of the strongest on-page SEO signals and a big factor in whether people click. Each page should have a unique, specific title that matches what the page offers. Keep the most important words near the start.

Related:Meta descriptionSearch engine optimization (SEO)Open Graph tags

Payment gateways use tokenization so your store can charge returning customers without ever storing their card number. It shrinks the damage if your systems are breached. It is one reason hosted gateways are the safer choice.

Related:Payment gatewayPCI DSSEncryption at rest

A long TTL means fewer lookups but slower updates when you change something. Before a website migration, we lower the TTL so the switch takes effect quickly, then raise it again afterward. Most visitors see a change once their cached copy expires.

Related:DNS (Domain Name System)A recordCaching

2FA is the most common form of multi-factor authentication. It is one of the highest-value, lowest-cost security steps a business can take. Store backup codes safely so you are not locked out if you lose your phone.

Related:Multi-factor authentication (MFA)PasskeysPassword manager

TXT records hold SPF, DKIM and DMARC settings and verification codes for services like Google Search Console. They are small but important for email deliverability and security. Keep them tidy, since duplicate or conflicting records cause problems.

Related:SPFDKIMDMARCDNS (Domain Name System)

Developed by Microsoft, TypeScript is widely used in modern frameworks like Next.js. It makes larger codebases easier to maintain.

Related:JavaScriptReactNext.js

Most of a website is text, so typography shapes readability and brand feel. Aim for comfortable body text size, enough line height and a limited number of font families.

Related:User interface (UI)Visual hierarchyStyle guide

Criminals register domains like examp1e.com to phish your customers or staff. Registering the most obvious misspellings of your key domain and enforcing DMARC limits the damage. Training staff to check sender domains helps too.

Related:PhishingDMARCDomain name

A trademark owner can file a UDRP complaint to have a domain transferred or cancelled if it is confusingly similar to their mark, registered and used in bad faith, and the holder has no legitimate interest. Check trademarks before buying a domain.

Related:Domain nameDomain backorderTyposquatting

Downtime costs leads, sales and trust. Hosts often advertise uptime guarantees, but what matters is how quickly problems are noticed and fixed. Uptime monitoring alerts you as soon as the site goes down.

Related:Uptime monitoringWeb hostingDDoS attack

Without monitoring, owners often learn about outages from customers. Monitoring checks your site from outside every few minutes and sends an alert when something fails. It is a basic part of any website care plan.

Related:UptimeIncident response planSSL/TLS

Even small, informal tests can reveal confusing labels, hidden buttons and broken forms. Test early with wireframes or prototypes, and again before launch.

Related:User experience (UX)PrototypeUser flow

UX covers navigation, content, speed, forms and how the whole journey feels. Good UX turns visitors into leads and customers with less friction. It is shaped by research and testing, not just looks.

Related:User interface (UI)Information architectureConversion rate optimization (CRO)Wireframe

Mapping user flows reveals extra steps, dead ends and confusing choices. Simplifying the most important flows is often the quickest way to improve conversions.

Related:User experience (UX)WireframeUser persona

UI is the look and feel of each screen. Consistent, clear interface design builds trust and makes actions obvious. It works hand in hand with UX: beautiful screens still fail if the journey is confusing.

Related:User experience (UX)Design systemCall to action (CTA)

Good personas describe goals, problems and context, not just demographics. They help teams ask "what would this person need here?" when planning pages and content.

Related:User experience (UX)User flowUsability testing

UTMs let you see whether a newsletter, social post or partner link actually drove traffic and leads. Use a consistent naming system or reports get messy fast. Do not add them to internal links on your own site.

Related:Google Analytics 4 (GA4)AttributionConversion tracking

Vector databases are the lookup engine behind most RAG systems and semantic search. They let an AI find the right paragraph among thousands of documents in moments. Some general databases now offer vector features too.

Related:EmbeddingsRetrieval-augmented generation (RAG)AI chatbot

Vercel deploys from Git, creates preview links for every change and runs serverless and edge functions. It has first-class support for Next.js.

Related:NetlifyNext.jsEdge functions

Version control means no change is lost and a bad update can be undone quickly. It lets several developers work safely at once and creates a clear history of who changed what. Any serious web project should have it.

Related:Staging sitePatch managementBackups

Vibe coding can turn an idea into a working prototype fast. The risk is code nobody fully understands, with hidden security holes, exposed keys or fragile logic. Treat it as a starting point and have the result reviewed before it handles real customers or data.

Related:AI website builderLarge language model (LLM)Vulnerability scanning

The View Transition API lets elements morph or fade as content changes, effects that once needed heavy JavaScript. Use them subtly and respect reduced motion settings.

Related:Scroll-driven animationsReduced motionCSS

A VPS gives you more power and control than shared hosting at a moderate step up in cost. Someone has to manage the server, though: updates, security and backups. Unmanaged VPS plans put that work on you or your developer.

Related:Shared hostingDedicated serverCloud hosting

Strong hierarchy guides the eye from headline to key message to call to action. When everything is bold or bright, nothing stands out.

Related:User interface (UI)TypographyCall to action (CTA)

Vite starts quickly and updates the browser instantly as you edit, then bundles optimized files for production. It is popular for React, Vue and static sites.

Related:JavaScriptReactStatic site generation (SSG)

Regular scans catch outdated plugins, exposed files and weak settings before attackers do. They are quick and affordable compared with cleanup after a hack. Scanning finds known issues; penetration testing digs deeper.

Related:Penetration testingCVEPatch management

WCAG is published by the W3C and organized into levels A, AA and AAA. Level AA is the common target for business websites and is referenced by many laws and policies. Meeting it requires both automated checks and manual testing.

Related:AccessibilityADA (Americans with Disabilities Act)Color contrast

A WAF catches many common attacks before they reach your site, including attempts to exploit known plugin flaws. Many CDNs and managed hosts include one. It reduces risk but does not replace updates and secure code.

Related:DDoS attackSQL injectionBot protectionContent delivery network (CDN)

Hosting affects speed, uptime and security as much as design does. Options range from cheap shared plans to managed and cloud hosting with support and monitoring built in. Pick hosting that matches your traffic, platform and how much risk you can tolerate, and check current pricing since plans change.

Related:Shared hostingManaged WordPress hostingVirtual private server (VPS)Cloud hosting

We recommend Webflow for design-led marketing sites where visual polish and animations matter. Designers can build precisely without a theme in the way, and Webflow handles hosting and security updates. It is less suited to complex custom functionality or very large content operations.

Related:Content management system (CMS)FramerWordPressDesign system

Webhooks keep systems in sync in real time without anyone checking manually. For example, a new lead can land in your CRM instantly, or a CMS publish can trigger a site rebuild. They should be secured so only trusted sources can send them.

Related:APICRMIncremental static regeneration (ISR)

WebP is supported by all major browsers and is a safe default for photos and graphics on the web. Switching to it reduces page weight and improves load times. Many CMS platforms and CDNs can convert images automatically.

Related:AVIFImage compressionContent delivery network (CDN)

Care plans are most important for WordPress and other self-hosted sites, where plugins and core software need regular updates. Check what is included, response times and whether restores are tested.

Related:BackupsPatch managementUptime monitoring

Wireframes let you agree on what goes on each page and in what order before spending time on colors and imagery. Changes are cheap at this stage. They keep conversations focused on goals and content.

Related:PrototypeInformation architectureUser experience (UX)

Wix bundles design tools, hosting and apps in one subscription. It is quick to launch, but your site lives inside Wix, so moving to another platform later usually means a rebuild. It suits simple sites more than complex or fast-growing ones.

Related:SquarespaceAI website builderContent management system (CMS)

WooCommerce makes sense when content and commerce live together and you already use WordPress. It is very flexible, but you are responsible for hosting, security, updates and PCI-friendly payment setup. Large stores need strong hosting to stay fast.

Related:WordPressShopifyPCI DSSPlugin

WordPress powers a large share of the web, which means a huge pool of developers, themes, plugins and SEO tools. We recommend it for blogs and content-heavy sites where several editors publish often. The trade-off is upkeep: core, themes and plugins need regular updates and security attention, or the site becomes an easy target.

Related:Gutenberg (block editor)PluginManaged WordPress hostingWooCommercePlugin vulnerability

An XML sitemap does not guarantee rankings, but it helps search engines find new and updated pages faster. It is particularly useful for large sites and new sites with few links. Submit it in Google Search Console and keep it free of broken or redirected URLs.

Related:robots.txtCrawlingGoogle Search ConsoleIndexing

Google's quality rater guidelines hold YMYL pages, like medical, legal and financial advice, to a higher standard of trust and expertise. Clear authorship, credentials and sources matter most here.

Related:E-E-A-TSearch engine optimization (SEO)

Zero-days cannot be patched right away, so layered defenses matter: a WAF, least privilege, monitoring and backups. Once a fix ships, apply it quickly, since attacks often spike after a flaw becomes public. Speed of patching is what you control.

Related:Patch managementWeb application firewall (WAF)CVE