Nexren ShieldWeb security glossary
Short, direct definitions of the technical terms used in the guides. The link beside each term leads to the guide that covers the topic in detail.
A
- #A record
- A DNS record that maps a name directly to an IPv4 address; used at the zone apex where a CNAME is not allowed.Guide: What Is a Reverse Proxy?
- #ACME
- The protocol that automates certificate issuance and renewal with a certificate authority (RFC 8555); Let's Encrypt uses it.Guide: Automatic SSL and Let's Encrypt
B
- #Bot
- Software that sends HTTP requests without human involvement; it can be useful, like a search crawler, or harmful, like a scraper or credential-stuffing tool.Guide: Bot Protection and CAPTCHA Alternatives
C
- #CAPTCHA
- A test designed to tell humans from automated software; it can be an image selection, a checkbox or a verification that runs in the background.Guide: Bot Protection and CAPTCHA Alternatives
- #Challenge
- A test a suspicious client must pass before entering a site; it can be a proof-of-work, a CAPTCHA or a browser check.Guide: When to Enable Under Attack Mode
- #CNAME record
- A DNS record that makes one name an alias of another; in a reverse-proxy setup it points your domain at the protection layer.Guide: What Is a Reverse Proxy?
- #Crawler
- A robot that automatically follows links to visit pages and index content; search engines and AI services use them.Guide: Bot Protection and CAPTCHA Alternatives
D
- #DDoS
- Distributed denial of service: traffic from many sources exhausts a service's network or application resources so legitimate users cannot reach it.Guide: DDoS Attack Types
H
- #HSTS
- A response header that tells browsers to connect to a site over HTTPS only (RFC 6797), making downgrade attacks harder.Guide: Automatic SSL and Let's Encrypt
- #HTTP flood
- A layer-7 attack that sends a large number of valid-looking HTTP requests to slow down or crash the application.Guide: DDoS Attack Types
J
- #JA3 / JA4
- Fingerprints derived from the fields of the TLS ClientHello message; they help recognise a client's TLS stack but do not prove identity.Guide: TLS Fingerprinting (JA3, JA4)
K
- #KVKK
- Turkey's Personal Data Protection Law no. 6698, the core statute on processing personal data and the obligations of data controllers.Guide: KVKK, GDPR and Security Logs
L
- #L3/L4 attack
- An attack on the network and transport layers of the OSI model (IP, TCP, UDP), aimed at filling bandwidth or connection tables.Guide: DDoS Attack Types
- #L7 attack
- An attack on the application layer (HTTP). Each request looks legitimate, but together they exhaust server CPU or the database.Guide: DDoS Attack Types
O
- #Origin Lock™
- Nexren Shield's method for ensuring the origin is reached only through it: a shared secret header plus an origin firewall script.Guide: Hide Your Origin IP and Lock the Origin
- #Origin (origin server)
- The actual application server a reverse proxy forwards requests to; its real IP address should be kept private.Guide: Hide Your Origin IP and Lock the Origin
- #OWASP Top 10
- OWASP's regularly updated list of the most critical security risk categories in web applications.Guide: What Is a WAF?
P
- #Proof-of-work
- A puzzle the client must solve by computation before its request is accepted; cheap for one visitor, expensive for mass-produced requests.Guide: Bot Protection and CAPTCHA Alternatives
R
- #Rate limiting
- Capping how many requests a client may send in a given period; exceeding the cap usually returns a 429 response.Guide: API Security
- #Reverse proxy
- An intermediary that sits between clients and a server, accepts requests on the server's behalf and forwards them; it can handle TLS, filtering and caching in front of the server.Guide: What Is a Reverse Proxy?
S
- #SNI (Server Name Indication)
- A TLS extension in which the client states which host name it wants to reach, letting one IP address serve several certificates.Guide: Automatic SSL and Let's Encrypt
- #SQL injection (SQLi)
- An attack that mixes SQL code into input to alter a database query; parameterised queries are the primary defence.Guide: What Is a WAF?
- #SSRF
- An attack that tricks a server into making requests to an address of the attacker's choosing, often an internal network or cloud metadata service.Guide: What Is a WAF?
- #SYN flood
- An attack that sends masses of TCP handshake opening packets (SYN), often from spoofed addresses, to use up the server's half-open connection resources.Guide: DDoS Attack Types
T
- #TLS
- The protocol that encrypts network communication and verifies the server's identity with a certificate (RFC 8446); it underpins HTTPS.Guide: Automatic SSL and Let's Encrypt
- #TOTP
- A method that derives one-time codes, typically valid for 30 seconds, from a shared secret and the current time (RFC 6238).Guide: Zero Trust Access
W
- #WAF (Web Application Firewall)
- A security layer that inspects HTTP requests before they reach the application and blocks known attack patterns such as SQL injection and XSS.Guide: What Is a WAF?
X
- #XDP / eBPF
- eBPF lets the Linux kernel run small, verified programs; XDP applies such programs to packets arriving from the network card before the rest of the network stack.Guide: DDoS Attack Types
- #XSS (cross-site scripting)
- An attacker injects their own script into a page so it runs in other users' browsers; output encoding is the primary defence.Guide: What Is a WAF?
Z
- #Zero Trust
- A security approach in which being inside the network confers no trust and every access is verified separately by identity and context (NIST SP 800-207).Guide: Zero Trust Access
Take a closer look at Nexren Shield
Review the plans and prices. Accounts are opened by our team; you can send an account request through the contact form.