Security, Abuse & Privacy
Publishing something at a public address brings a set of problems that do not exist on your laptop. This category covers the browser's security model and the headers that steer it — the same-origin policy, CORS, Content Security Policy, X-Frame-Options and the rest — including the awkward fact that a strict CSP breaks exactly the kind of inline-script page an AI tool tends to produce. It also covers what a host does about abuse: scanning, holding content for review, takedown notices and counter-notices, and how a legitimate file that trips a filter gets sorted out. The last part is privacy: what counts as personal data, why an IP address does, when a cookie banner is genuinely required and when a site that sets no cookies at all can do without one. General information, not legal advice.
33 terms in this category
Abuse Report
A complaint sent to a host about something published on it — malware, impersonation, spam, copyright, harassment. It opens a review, and the quality of the report largely decides how fast that review moves.
Acceptable Use Policy
The document setting out what a host allows people to publish and what it will act on. It is the rulebook that every suspension, takedown and review decision refers back to.
Access Log
A line-by-line record of the requests a server has answered — who asked, for what, when, and what came back. It records visitors, not account activity.
Audit Log
A record of who did what inside an account — logins, uploads, deletions, permission changes, tokens created. It answers questions about the people with keys, not about the visitors.
Automated Content Scanning
The broader set of automatic checks a host runs over what people publish, beyond looking for malware. It sorts uploads into serve, hold for review, and refuse.
Bot Traffic
Requests made by software rather than a person — search crawlers, link previewers, monitors, scrapers and scanners. On a typical public address a large share of raw hits are never human.
Clickjacking
An attack in which one site loads another site's page invisibly on top of its own, so a visitor who thinks they are clicking one thing actually clicks something on the hidden page. It is defended against with headers, not with JavaScript.
Content Security Policy
A response header that tells the browser which sources a page is allowed to load scripts, styles, images and frames from. Anything outside the policy is blocked before it runs.
Cookie Consent
Permission a visitor gives before a site stores or reads non-essential information on their device. A site that sets nothing beyond what it strictly needs does not require a banner at all.
CORS
Cross-Origin Resource Sharing is a set of HTTP headers that lets a server say which other origins are allowed to read its responses from JavaScript. Without those headers the browser fetches the file but refuses to hand the contents to the calling script.
Cross-Site Scripting
A flaw in which text supplied by a visitor ends up being executed as JavaScript on your page. Because the script runs on your origin, it inherits everything your page can see.
Data Residency
Where data physically sits — which country's disks hold it, and therefore whose laws reach it. Buyers ask about it because a storage location carries a jurisdiction with it.
Data Retention
How long data is kept before it is deleted, and the rules that decide that. Keeping everything forever is a decision too, and usually the wrong one.
DDoS Protection
The defences that keep a site reachable while someone floods it with traffic from many machines at once. A distributed denial-of-service attack is not a break-in — it is an attempt to exhaust bandwidth, connections or compute until real visitors get nothing.
DMCA Takedown
A formal notice under United States copyright law asking a host to remove material that infringes someone's copyright. The host removes the file, tells the person who uploaded it, and that person may file a counter-notice.
Encryption at Rest
Storing files in encrypted form, so the bytes on disk are meaningless without the key. It protects data that is sitting still — on a drive, in a backup, on hardware being retired.
Encryption in Transit
Protecting data while it moves across a network, so that anyone between the two ends sees scrambled bytes. On the web this is TLS, which is what the S in HTTPS refers to.
GDPR
The European Union's General Data Protection Regulation, in force since 25 May 2018, governing how personal data about people in the EU may be collected and used. The UK keeps a near-identical version in its own law.
Geoblocking
Allowing or refusing a request based on the country it appears to come from. The country is guessed from the visitor's IP address, so the result is a good approximation rather than a fact.
Hotlink Protection
A rule that refuses to serve your files when they are embedded on somebody else's page. The file stays reachable when someone opens it directly or from your own site, and fails everywhere else.
IP Address
The number that identifies a machine on the internet, so packets know where to go. Every request a visitor makes carries the address it came from, which is why addresses turn up in logs, analytics and privacy law.
Malware Scanning
The checks a host runs over uploaded files to spot known malicious content before it is served to anyone. It works on signatures and reputation data, and it produces both misses and false alarms.
Open Redirect
A page that sends visitors on to any address supplied in its URL, without checking where that address points. It lends your domain's credibility to somebody else's destination.
Personal Data
Any information relating to a person who can be identified, directly or indirectly. The definition is broader than most people expect — an IP address counts, and so does an identifier that only becomes a name when combined with something else.
Phishing Page
A web page built to impersonate a real organisation so that visitors hand over credentials or payment details. Hosts treat it as prohibited content and remove it on sight.
Referrer-Policy
A response header that controls how much of the current URL the browser puts in the Referer header when a visitor follows a link or the page loads a resource. Values range from sending the full address to sending nothing at all.
Same-Origin Policy
The browser rule that keeps code loaded from one origin from reading data belonging to another. It is the foundation the rest of web security is built on.
Security Header
An HTTP response header that instructs the browser to enforce a restriction on a page — what it may load, who may frame it, how much of its URL leaks. The server states the rule; the browser applies it.
Subresource Integrity
A way of pinning a script or stylesheet you load from someone else's server to an exact cryptographic hash. If the file changes by a single byte, the browser refuses to run it.
Two-Factor Authentication
Requiring a second proof of identity alongside the password, so that a stolen password on its own is not enough to get in. The second proof is usually a code from an app or a key held on a device.
Upload Rate Limiting
A cap on how many uploads an account or address may make in a given period, separate from any cap on file size or storage. It exists mainly to blunt automated abuse.
Web Application Firewall
A filter that reads each incoming HTTP request and blocks the ones matching known attack patterns. Unlike a network firewall, it looks at what a request says, not merely where it came from.
X-Frame-Options
An older response header that tells the browser whether a page may be displayed inside a frame or iframe. It takes two useful values, DENY and SAMEORIGIN.