Glossary
Glossary: shop maintenance, security and technology
From SLA to staging: terms and abbreviations around maintenance, security, servers and law, explained briefly and clearly.
In short and in plain language
On this page you will find special words. Below each word you see the start of what it means. Click on a word. Then you can read the whole text.
The words are sorted from A to Z. At the top you see the letters. Click on a letter. Then you jump to the words with this letter.
At the very bottom you find a link to the questions and answers and a link to contact us.
A
- AA AA is the middle conformance level of the WCAG. It covers all success criteria of level A plus further requirements, for example on contrast, focus and operation. Rules on digital…
- Access inventory An access inventory is an overview of who may access which systems, accounts and functions of a business. It lists, for example, access to shop, hosting, domain and database…
- ACL An ACL is a list that defines who may access which areas or functions of a system. In content management systems it controls the permissions of user accounts. It is one building…
- ACME ACME is an open protocol that lets servers request and renew certificates for encrypted connections automatically. This makes it less likely that certificates for shop and…
- AEAD AEAD designates encryption methods that not only keep data confidential but also check its integrity. Modern TLS connections use such methods in their cipher suites. Tampering…
- AES AES is a widely used method for encrypting data. It can help protect stored data such as backups from unauthorised reading. Whether a backup is encrypted is an important question…
- AI Artificial intelligence refers to software that learns patterns from data and derives suggestions, texts or decisions from them. Around websites it appears, for example, in…
- Alerting Alerting means that a monitoring system automatically raises a warning when readings look unusual. The message goes, for example, by email, text message or call to the responsible…
- Alt text An alt text describes the content of an image in words. Screen readers read it aloud, and it appears when an image does not load. Purely decorative images get an empty alt text so…
- AO The Abgabenordnung is the German Fiscal Code, the central procedural law of German taxation. Among other things, it governs tax procedures and the retention of books and records.
- API An API is a programming interface. Two programs use it to exchange data without anyone having to type anything in. One example is an online shop that passes orders on to an…
- APWG The APWG is an association of companies, agencies and organizations against phishing and internet fraud. It publishes reports on phishing attacks.
- ARIA ARIA is an extension to HTML that describes interface elements for assistive technologies such as screen readers. In a shop it can announce, for example, when the cart changes…
- ATO ATO describes attackers gaining control of an existing customer account, usually with stolen credentials. The account then looks like a normal customer, which is why the takeover…
- AVIF AVIF is a modern image format that compresses photos and graphics strongly while keeping good quality. Smaller image files can shorten the loading time of shop pages, especially…
B
- B2B B2B describes trade between companies rather than with private consumers. In B2B commerce, customer accounts, net prices and individual terms often play a role. Requirements for…
- B2C B2C refers to the business relationship between a company and private end customers. The term separates sales to consumers from trade between companies. B2C shops often follow…
- Backup A backup is a safety copy of the files and the database of a shop or website. It is stored separately from the running system. After an outage, an error or an attack, an earlier…
- BC BC stands for business continuity, the maintaining or quick restoring of important processes after a disruption. A BC solution is a substitute solution with which operations can…
- BCP BCP denotes a series of documents by the Internet Engineering Task Force that describe accepted procedures for operating the internet. Each document in this series carries a…
- BEAST BEAST is the name of a well-known attack on older encryption methods in web connections. It exploited weaknesses of earlier methods that have been replaced by newer ones in…
- BfDI The BfDI is the Federal Commissioner for Data Protection and Freedom of Information in Germany. The office advises, supervises and publishes guidance on data protection questions…
- BFSG The BFSG is the German Accessibility Strengthening Act. It implements a European Union directive on accessibility. Under it, many providers of products and services for consumers…
- BFSGV The BFSGV is the German ordinance accompanying the Accessibility Strengthening Act. It sets out the accessibility requirements for products and services in more detail. For…
- BGB The BGB is the German Civil Code, the central German law for private law, for example for purchase contracts and distance contracts. It governs contract formation, withdrawal and…
- BGBl The BGBl is the German Federal Law Gazette, in which federal laws and ordinances are officially published. A reference to it shows where the text of a provision can be found…
- BGH The BGH is the Federal Court of Justice, Germany's highest court for civil and criminal matters. Its rulings shape how other courts interpret legal questions. For shop operators…
- BITKOM BITKOM is the German industry association of the digital economy. It represents companies from information technology, telecommunications and the internet sector and publishes…
- BITV The BITV is a German ordinance on accessible information technology. It sets out how websites and apps of federal public bodies must be accessible. For companies, the BFSG usually…
- BMF The BMF is the German federal ministry responsible for tax and fiscal policy. It publishes circulars on the interpretation of tax rules. For shops they can give guidance, for…
- Brute-force A brute-force attack automatically tries a very large number of passwords or combinations until one works. Targets are often the login pages of shops and administration areas…
- BSI The BSI is the German federal authority for information security. It publishes recommendations, situation reports and standards such as the IT baseline protection. Operators of…
C
- CA A CA is a certification authority that issues digital certificates for websites. The certificate confirms that an encrypted connection belongs to the stated domain. Browsers check…
- CAA CAA is a record type in the Domain Name System with which a domain owner states which certificate authorities may issue certificates for it. It can help limit foreign or…
- Caching Caching means that frequently requested content is stored temporarily and delivered faster on the next request. This saves computing work on the server and can shorten the loading…
- CAPEC CAPEC is a public catalogue of typical attack patterns against software and systems. It describes how attackers proceed so that defensive measures can be planned more precisely.
- CAPTCHA A CAPTCHA is a test intended to tell people apart from automated programs, for example with distorted letters or picture puzzles. It is meant to slow down misuse of forms and…
- CBC CBC is an operating mode of block ciphers in which each block of data is linked to the previous one. In encrypted connections it is now regarded as less suitable than newer modes…
- CDN A CDN is a network of distributed servers that delivers images and files from a location close to the visitor. Shop pages can load faster as a result and the shop's own server is…
- CE CE stands for Community Edition, the freely available base edition of an open-source product. It covers the core functions, while paid editions can add further features or…
- CEN CEN is a European standardisation organisation. It develops European standards, including the series of standards for electronic invoices. Standards describe technical…
- Certificate A certificate is a digital attestation that confirms the identity of a website and enables the encrypted connection via HTTPS. It is issued by a certificate authority. Once it…
- CEST CEST is the summer time of the Central European time zone, which includes Germany. Without a time zone, timestamps in systems and logs are ambiguous on the night the clocks change.
- CET CET is the time zone used in winter in Germany and many neighbouring countries. In summer, Central European Summer Time applies instead. Times such as office hours usually refer…
- CGI CGI is an older interface through which a web server runs programs and returns their output to the browser. PHP can also be connected this way. Security flaws in this connection…
- CI CI is a software development practice in which changes are merged continuously and checked automatically. It usually appears together with CD for automated delivery. For shops…
- CI/CD CI/CD describes workflows that build, test and deliver software changes automatically. They often use credentials and keys that are stored in the environment. Maintaining and…
- CIS The CIS is a nonprofit organization that publishes recommendations for the secure configuration of IT systems. These collections are called CIS Benchmarks.
- CISA CISA is the United States agency for cybersecurity and the protection of critical infrastructure. It publishes warnings and recommendations, for example a list of vulnerabilities…
- CJEU The CJEU gives binding interpretations of European Union law. Its judgments shape how courts in the member states apply that law. For websites, its decisions on data protection…
- CLI A CLI is a way of operating software through text commands in a command line instead of a graphical interface. Maintenance tasks such as clearing the cache or applying updates can…
- CLS CLS is a metric that measures how much the content of a page shifts unexpectedly while loading. It is one of the Core Web Vitals. A low value stands for a calmer display while the…
- CMP A CMP is software that obtains, stores and manages visitors' consent on a website. It shows, for example, the cookie banner and remembers the choice. Its setup and upkeep are part…
- CMS A CMS is a program that lets you maintain the content of your website yourself. You edit texts, images and pages in the browser without programming. The look of the site stays the…
- CNAME A CNAME is a record in the domain name system that points one name to another name. For example, a subdomain can point to the address of a service. It is among the records set…
- CNCF The CNCF is a foundation that hosts open-source projects around modern cloud technology. These include standards and tools for monitoring and operating applications. Its terms…
- COA COA stands for Content Object Array, a building block in the configuration of pages in a content management system that combines several content elements. Heavily nested…
- Contrast Contrast is the difference in brightness between text and background. The WCAG set minimum values for it. Good contrast helps everyone, especially people with low vision or in…
- Cookie A cookie is a small text file that a website stores in the browser. Some cookies are needed for the site to work, for example for a shopping cart. For others, such as measuring…
- CPU The CPU is the main processor of a computer or server that executes instructions and performs calculations. Its utilisation is an important metric for a shop's performance under…
- Crawler A crawler is a program that automatically visits web pages and reads their content. Search engines use crawlers to capture pages; others collect content for other purposes. Many…
- CRL A CRL is a list of certificates that were declared invalid before they expired. Browsers and systems can query it to recognise revoked certificates. For businesses it is one part…
- CRM CRM is software for managing customer contacts, enquiries and sales opportunities. Sales and customer service see the history of each business relationship there. A connection to…
- Cron job A cron job is a task that a server runs automatically at set times. Typical examples are imports, updates of the search index or sending reminder emails. If a cron job does not…
- CRS CRS refers to an open-source rule set of the OWASP project for web application firewalls. It collects generic detection rules against common classes of attack. Operators can use…
- CSP The CSP is a security setting with which a website tells the browser from which sources scripts, images and other content may be loaded. It can help to make injecting foreign…
- CSRF CSRF is an attack in which a foreign site tricks a logged-in user's browser into making unwanted requests. Forms often use a secret token per session as a countermeasure.
- CSS CSS defines how a web page looks: colours, fonts, spacing and the arrangement of the content. Because the design is kept separate from the content, a page can adapt to the screen…
- CT CT is a public logging system that documents the issuance of certificates for domains. Operators can watch the entries and so detect unexpectedly issued certificates for their…
- CVE CVE is a catalog in which known security flaws in software receive a unique identifier. The identifier helps to find the same flaw in advisories, updates and audit reports…
- CVSS CVSS is a system that rates security flaws by their technical severity. The result is a numerical value on a fixed scale. For planning updates it is a point of reference, but it…
- CVV The CVV is a security code on a payment card that is requested in addition for online payments. It is meant to help confirm that the card is actually in hand.
- CW CW stands for calendar week, the running number of a week within the year. In maintenance plans and reports, dates and periods are often given by calendar week.
- CWE CWE is a public list of types of software weaknesses, each with its own identifier. It helps name the causes of security flaws consistently. Security advisories often cite a CWE…
D
- DB DB is the short form of database, the system in which a website stores content, products and orders. Many or slow database queries can delay the server's response. For updates and…
- DCV DCV is the check by which a certificate authority establishes that an applicant actually controls a domain. It is a prerequisite for issuing a certificate for that domain. The…
- DDG The DDG is the German Digital Services Act, which among other things governs provider identification. It names requirements for information found on a business website. What…
- DDoS A DDoS is an attack in which a large number of computers send requests to a server at the same time to overload it. The shop then becomes slow or unreachable. Upstream filters can…
- DENIC DENIC is the central registry for internet addresses ending in .de. It keeps the register of these addresses. For a business it plays a role where holder details, a transfer or…
- Deployment Deployment means putting a new program version or change onto the live system. It usually follows testing and can cause brief restrictions. An orderly process with a rollback plan…
- DIN DIN is the national standards organisation in Germany. DIN standards define technical requirements and procedures that businesses and service providers can refer to. Paper formats…
- DKIM DKIM is a method in which outgoing emails receive a digital signature from the sending domain. The recipient can check whether the message was altered on the way. This can…
- DMA The DMA is a regulation of the European Union, in German called Gesetz über digitale Märkte. It governs the conduct of very large platform operators, who are called gatekeepers…
- DMARC DMARC is a record in the Domain Name System that tells recipients how to handle emails that fail SPF and DKIM checks. It can also request reports on who sends mail in the name of…
- DNS The DNS is the directory of the internet that translates domain names into the addresses of the responsible servers. Its records state where the website is hosted and which server…
- DNSSEC DNSSEC is an extension of the DNS in which answers are digitally signed. This makes it possible to check whether information about a domain was altered on the way. For businesses…
- Domain A domain is the name of a website on the internet, for example the part after “www.” in the address. It is registered with a registry and points to the server on which the website…
- DPA A DPA is a contract with a service provider that processes personal data on behalf of a business. It describes how the provider handles and protects that data. This concerns, for…
- DR DR stands for disaster recovery, the restoration of systems and data after a serious outage. A DR plan describes who does what and in which order. It is usually tested so that the…
- DRP A DRP is a documented plan that describes how IT systems are restored after a serious outage. It records the steps, responsibilities and order of the restoration. In an emergency…
- DSA The DSA is a regulation of the European Union, in German called Gesetz über digitale Dienste. It sets out requirements for intermediary services and online platforms, for example…
- DSK The DSK is the German Data Protection Conference, the body of the independent federal and state data protection authorities. It publishes resolutions and guidance on how the…
- DV DV refers to checking the domain for SSL and TLS certificates: the certificate authority only verifies that the applicant controls the domain. Such certificates carry no verified…
E
- EAA The EAA is a European Union directive on the accessibility of certain products and services. Member states transpose it into national law, in Germany through the BFSG. It sets…
- EC EC stands for European Community, a former name of part of today's European Union. Older European directives therefore carry the abbreviation in their reference.
- ECDHE ECDHE is a method by which browser and server agree on a shared key when setting up an encrypted connection. A new, short-lived key is created for each connection. It is a common…
- EDI EDI is the automated exchange of business documents such as orders, dispatch advices and invoices between the systems of trading partners. Fixed formats are used so that data can…
- EEA The European Economic Area links the member states of the European Union with Iceland, Liechtenstein and Norway. It plays a role when it comes to the location of hosting, backups…
- ELTS ELTS describes an extended support period in which software can keep receiving security fixes after its regular end. Such programmes are often paid. For operations it matters…
- ENISA ENISA is the European Union Agency for Cybersecurity. Among other things, it publishes threat landscape reports on threats and security incidents. Such reports show which types of…
- EOL EOL refers to the end of the life cycle of a software version. After that the vendor usually no longer supplies security updates. For shops the date matters because it makes…
- EPSS EPSS is a scoring system that estimates how likely it is that a known security flaw will be exploited. It complements the severity rating that CVSS, for example, provides. It can…
- ERP An ERP system is the central business software for inventory, purchasing, accounting and order processing. In an online shop it often supplies prices, stock levels and customer…
- Escalation Escalation means passing a disruption on to a higher level with more experience, authority or availability. This usually follows a sequence, for example from an automatic email to…
- EU The EU is a union of European states with a common internal market and shared legislation. It issues regulations and directives, for example on data protection, consumer…
- EV EV stands for Extended Validation, a type of certificate with a thorough check of the organization behind a website. The business has its identity verified by the certification…
F
- FAQ An FAQ is a collection of frequently asked questions with matching answers. On a website, it answers typical questions about services, process or prices before visitors need to…
- FID FID describes the delay between a visitor's first input and the web page's response. The value belongs to the Core Web Vitals metrics. It shows how sluggish or smooth a page feels.
- FIM FIM is a method that monitors the files of a website for unexpected changes. Check values of clean files are stored and later compared with the current state. Deviations can point…
- Firewall A firewall is a filter that allows or blocks traffic between a server and the internet according to set rules. A web application firewall additionally examines the content of…
- FPM FPM is the component that runs PHP applications on the web server and manages their processes. Its settings can influence how quickly a shop responds under load.
- FTP FTP is a method for transferring files between your own computer and a server. For websites it is used, for example, to upload files to the host. Because FTP transfers data…
G
- GB GB is a unit for amounts of data, for example for a server's memory or disks. How much memory a server has can influence how many requests it handles quickly at the same time. The…
- GCM GCM is a mode of operation for encryption methods that encrypts data and at the same time makes tampering detectable. It is widely used for encrypted web connections. Many…
- GDPR The GDPR is a regulation of the European Union. It governs when and how personal data may be processed, for example names, email addresses or IP addresses. On a website this…
- GDV The GDV is the German Insurance Association, the umbrella organisation of insurance companies in Germany. Among other things, it publishes statistics and surveys on damage and…
- GTC GTC are pre-formulated contract terms that a company uses for many contracts. In an online shop they cover, for example, payment, delivery, warranty and liability.
H
- HDE HDE is the trade association of German retail. It publishes figures and forecasts on the development of trade, including online trade.
- HGB The HGB is the German Commercial Code for merchants and commercial companies. Among other things it governs commercial books, bookkeeping and annual financial statements. For…
- HSM An HSM is a dedicated device or module that stores cryptographic keys and performs calculations with them without the keys leaving the module. It is generally used where…
- HSTS HSTS is a web server setting that tells the browser to open the website only over an encrypted connection from then on. This can make intercepting or redirecting connections…
- HTML HTML is the language every web page is made of. It defines what each part of the page is: heading, paragraph, list, link or image. Clean HTML is the basis for screen readers and…
- HTTP HTTP is the protocol browsers and servers use to exchange web pages and data. Interfaces between a shop and other systems often run over it as well. The encrypted variant is…
- HTTPS HTTPS encrypts the data sent between browser and website. This way, others cannot read what you enter into a form, for example. Many browsers warn about pages without HTTPS with…
I
- IANA IANA is the body that manages central identifiers of the internet, such as address ranges, domain endings and protocol numbers. It also publishes the time zone database that many…
- ICANN ICANN is a non-profit organisation that coordinates the allocation of domain names and internet addresses worldwide. Among other things, it sets rules for domain endings and for…
- IdNr IdNr is the German short form for identification number and mostly appears in compounds such as USt-IdNr. The VAT identification number identifies a business in trade within the…
- IETF The IETF is an open international body that develops technical standards for the internet. Its documents are called RFCs and describe, for example, procedures for email…
- Impressum (legal notice) The Impressum states who is responsible for a website: name, address and ways to get in touch. Business websites in Germany need an Impressum that is easy to find.
- INP INP is a metric for how quickly a web page visibly responds to input such as clicks or key presses. It is one of the metrics for loading speed and usability. A low value stands…
- IoT The IoT refers to the networking of devices, machines and sensors that exchange data over the internet on their own. Examples are connected household appliances or measuring…
- IP IP stands for the Internet Protocol, which defines how data is addressed and transferred between devices on the internet. An IP address identifies a device or a connection in the…
- ISO ISO is the international organisation for standardisation. It publishes standards, for example on quality management or information security, that suppliers and customers refer to.
- IT IT stands for information technology and covers computers, networks, software and the people who run them. For an online shop this includes servers, interfaces and security…
J
- JPEG JPEG is a widely used image format for photos, named after the standards committee that developed it. It reduces file size through lossy compression. Modern formats such as WebP…
- JS JS is the common abbreviation for JavaScript, the programming language for interactivity in the browser. Large or numerous scripts have to be downloaded, parsed and executed. This…
- JSON JSON is a simple text format that programs use to exchange structured data. Many interfaces between a shop and other systems transfer items, prices and orders in this format…
K
- KB A kilobyte is a small unit for amounts of data, for example the size of an image or a script file. The fewer kilobytes a page transfers, the faster it can load.
- KEV KEV refers to a catalogue of known vulnerabilities that are demonstrably exploited, maintained by the US agency CISA. It helps to judge which flaws are particularly urgent…
- KiB A kibibyte is a unit of data counted in the binary system and slightly larger than a kilobyte. Technical documentation often states file sizes and limits in this unit.
- KPI A KPI is a metric used to measure the success of a project or process. In maintenance, examples include availability, response time and the time taken to apply updates. Such…
- KRITIS KRITIS is the German short form for critical infrastructure, meaning facilities whose failure can have considerable consequences for the supply of society. Examples are energy…
- KSK The KSK is the key that signs the other keys of a domain in DNSSEC. It forms the basis of the chain of trust. When it is replaced, all parties must publish the new version in time…
L
- LCP LCP is a metric for the loading time of a web page. It measures when the largest visible element, such as an image or a heading, is displayed. The value shows how quickly a page…
- Load test A load test checks how many simultaneous visitors and orders a shop can handle. For this, visits are generated artificially, and it is observed when the shop slows down or errors…
- LTS LTS denotes a software version with an extended support period in which the vendor fixes bugs and security flaws. Such versions are intended for long-term operation. The exact…
M
- Maintenance window A maintenance window is a period agreed in advance during which changes are made to a system. During this time the shop may be briefly restricted or unavailable. Businesses often…
- Malware Malware is harmful software that damages, spies on or remotely controls systems without the operator's knowledge. On a shop it can, for example, capture payment data or redirect…
- MB A megabyte is a unit for amounts of data, for example the size of a file or a page. Large pages and images load more slowly on a phone. Page weight is therefore watched when…
- MFA With multi-factor authentication, a login requires a further proof in addition to the password, such as a code from a smartphone. It can help secure access to the shop…
- MIME MIME designates a standard that specifies the type of a file, such as image, font or script. Browsers use it to decide how to handle a file. Wrongly stated types can lead to…
- MTTA MTTA is the average time until an incident is acknowledged after it was reported. It is one of the metrics of incident management. It differs from the time until full resolution.
- MTTD The MTTD is the average time until a fault or security incident is noticed. The shorter it is, the sooner a business can react. Monitoring and alerting influence this metric.
- MVC MVC is a design principle for software that separates data, presentation and control. Many web applications and content management systems are built on this pattern. This makes it…
- MX An MX record is an entry in the Domain Name System that states which server accepts email for a domain. Without a suitable record, mail sent to your own address cannot be…
N
- NIS NIS stands for network and information security and refers to European rules on cybersecurity. They set out requirements for the security of important services and organisations…
- NIS2 NIS2 is an EU directive on cybersecurity. It names requirements for risk management and for reporting security incidents for companies in certain sectors. Whether a business is…
- NIST NIST is a United States agency for standards and measurement. Its recommendations on information security often serve as guidance, for example for passwords, sign-in procedures…
- NVD The NVD is a public database of known security vulnerabilities that collects severity ratings and descriptions for CVE entries, among other things. It is maintained by a US…
O
- OAT OAT is a classification by the OWASP project of automated attacks on web applications, for example the mass trying of credentials or voucher codes. Each threat type has a name and…
- OAuth OAuth is an open standard that lets an application access protected data without knowing the user's password. Instead of credentials, it issues time-limited access keys called…
- OCSP OCSP is a method a browser can use to check whether a website's security certificate is still valid. With so-called stapling, the server delivers this information itself. This…
- OPS OPS is the group of modules on operations in the IT-Grundschutz baseline of the German BSI. These modules name requirements, for example for updates, testing and logging. They…
- ORP ORP is the group of modules on organisation and personnel in the IT-Grundschutz baseline of the German BSI. These modules describe, for example, how logins are assigned to…
- OS OS stands for operating system. It is the basic software on which the programs of a server or computer run.
- OSV OSV stands for an open database and data format for known vulnerabilities in open-source software packages. Entries point to the affected packages and versions. Operators can use…
- OTP An OTP is a one-time password that is valid for a single login or approval, for example by text message or app. It is used in multi-factor login and in confirming payments.
- OV OV designates a certificate for which the certificate authority additionally verifies the identity of the organisation behind a domain. It is issued when an encrypted connection…
- OWASP OWASP is a non-profit community that publishes freely available guidance on web application security. Its lists of typical vulnerabilities serve many developers and service…
P
- P95 P95 refers to a percentile value: the vast majority of measurements fall below it, only a small share of the slowest cases above it. Unlike an average, it shows how the website…
- PAngV The PAngV is the German Price Indication Ordinance, which governs how prices are to be shown to consumers. It covers final prices, unit prices and price reductions in shops, among…
- Patch A patch is a small correction to software that fixes a known error or security gap. It is provided by the vendor and only takes effect once it has been applied to the shop. As…
- PC A PC is a computer used by an individual person, for example at a desk in the office. In a business it is often used for email, accounting and administration.
- PCI PCI stands for Payment Card Industry, the sector of card payments. The name appears in PCI DSS, a security standard for handling payment card data. For shops that accept card…
- PCI DSS PCI DSS is a security standard of the payment card industry for businesses that process, store or transmit card data. It names technical and organisational requirements for…
- PDF PDF is a widely used file format for documents that displays layout and fonts consistently across devices. In a shop, catalogs, quotes and invoices are often provided as PDF files.
- Phishing Phishing is an attempt to obtain login or payment data through forged messages or websites. The messages usually look like notices from a known sender, such as a service provider…
- PHP PHP is a widely used programming language for web applications that runs on the server. Many shop systems and content management systems are written in PHP. For maintenance it…
- PIM PIM is software in which all product data is maintained centrally. From there, texts, attributes and images flow into the shop, catalogues and marketplaces. The connection to the…
- Plugin A plugin is an extension that adds further functions to shop or website software, such as payment methods or forms. Depending on the system it is also called an extension or…
- PNG PNG is an image format that stores graphics without quality loss and supports transparency. It suits logos and graphics with sharp edges well, but often produces large files for…
- POODLE POODLE is the name of a known vulnerability in old versions of the SSL encryption method. It can allow an attacker to read parts of encrypted connections.
- PSD3 PSD3 belongs to the series of European rules on payment services, the Payment Services Directive. These rules mainly concern banks and payment service providers. For shops they…
Q
- QA QA covers all measures used to check and secure the quality of a result. For websites and shops this includes, for example, tests after updates. They are meant to help find errors…
- QR A QR code is a square code made of dots that smartphones and scanners can read quickly. It often points to a web page or other information.
R
- RAM RAM is the working memory of a computer or server that keeps running programs and data quickly accessible. Sufficient RAM is important for fast databases and shop systems. Scarce…
- Ransomware Ransomware is harmful software that encrypts files or entire systems and demands a ransom for their release. For a shop this can mean downtime and data loss. Backups stored…
- RC4 RC4 is an older method for encrypting data. Current recommendations usually list it among the methods that should no longer be used.
- RCE RCE denotes a security flaw through which an attacker can run foreign program code remotely on a server. Such flaws are usually rated as critical.
- RDoS RDoS denotes extortion with an overload attack: attackers threaten an outage or trigger one and demand money. Such an attack can make a shop temporarily unreachable.
- Responsive design Responsive design means that a website adapts to the size of the screen. On a phone the content is stacked, on a large screen it often sits side by side. There is only one website…
- REST REST is an architectural style for interfaces through which systems exchange data via web requests. Many shop and website systems offer such interfaces. They can be used for…
- Restore A restore means putting data or an earlier system state back from a backup. Files and database of the shop are brought back into a working condition. A restore test checks whether…
- RFC An RFC is a technical document of internet standardisation that describes protocols and procedures of the internet. Many processes around websites and email are based on such…
- RGB RGB is a colour model in which colours on screens are mixed from shares of red, green and blue. A brand's colour values are often given in this model. They help display colours…
- Rollback A rollback returns a system to its previous working state after a failed change. It is usually planned before an update, for example with a fresh backup. This allows a faulty…
- RPO The RPO describes how much data loss, measured in time, is still acceptable after an outage. It depends on how often backups of a shop are taken. Owners and service providers can…
- RRSIG RRSIG is a record type in the Domain Name System that holds the digital signature for other records of a domain. It belongs to DNSSEC and is used to verify the authenticity of DNS…
- RTO The RTO is the time within which a system should be running again after an outage. It is a target value and not an assurance. In maintenance contracts it is often considered…
- RUM RUM measures loading times and errors directly for real visitors of a website. This shows how fast a shop is under real conditions with different devices and connections. It…
S
- SAN SAN designates the list of additional domain names that a single TLS certificate can cover. A certificate with this field can include several domains and subdomains of a business…
- SBOM An SBOM is a list of all components of a piece of software, such as libraries and extensions with their versions. It helps to clarify whether a shop is affected by a newly…
- Screen reader A screen reader is a program that reads the content of a page aloud or outputs it on a braille display. Blind and visually impaired people use it to operate websites. For this…
- SDK An SDK is a collection of tools, libraries and documentation for developers. It makes it easier to build applications for a specific platform or to connect services, such as…
- SEO SEO covers all measures that help a website to be found more easily in search engines. These include suitable content, a clear page structure, short loading times and clean…
- SFTP SFTP is a method for transferring files between systems in encrypted form. For websites it is used, for example, to upload files to a server securely or to store backups. It…
- SLA An SLA is an agreement on the type and scope of a service, such as the maintenance of a shop. It describes, for example, response times, responsibilities and reports. Which…
- SLSA SLSA is a framework that describes levels for securing the supply chain of software. It concerns how software is built, checked and delivered. A higher level alone does not say…
- SMB SMB is the English short form for small and medium-sized businesses. It corresponds to the German KMU and appears mainly in studies and source references. The size criteria depend…
- SME SME stands for small and medium-sized enterprises, which are distinguished from large companies by size criteria. The term is used in statistics, funding programmes and laws…
- SMS An SMS is a short text message sent to a phone over the mobile network. For alerting and logins it is often used to deliver warnings or confirmation codes. It is one channel…
- SMTP SMTP is the standard protocol used to send emails between servers. Shops use it to send order confirmations, invoices or notifications. A clean setup can improve the…
- SOA SOA refers to a DNS record that holds basic information about a domain zone. This includes the responsible name server and details on how the zone is updated. The record is also…
- SoZV The SoZV is the German Summer Time Ordinance. It governs how summer time is handled in Germany, that is the clock change in spring and autumn. For scheduled tasks on servers, such…
- SP SP stands for Special Publication, a series of publications of the US agency NIST. They describe recommendations on information security, for example on passwords and sign-in…
- SPDX SPDX is an open format for listing the components of a piece of software in a machine-readable way. Such bills of materials help to check which packages and components are used in…
- SPF SPF is a record in the domain name system that states which servers may send email for a domain. Receiving mailboxes check it so that forged senders stand out. A suitable record…
- SQL SQL is a query language that applications use to read and write data in a database. Many or poorly built queries can increase a shop's response time. Attacks such as SQL injection…
- SRE SRE is an approach that combines the reliable operation of systems with methods from software development. It includes monitoring, error analysis and clear availability targets…
- SRI SRI is a browser mechanism in which a checksum is stored for an externally loaded file. The browser compares it with the loaded file and does not execute a changed file. This can…
- SSAC The SSAC is an advisory committee of ICANN. It deals with the security and stability of the domain system and address allocation on the internet. It publishes reports and…
- SSH SSH is a protocol for encrypted connections to servers. Administrators use it to log in and transfer files, with the systems often identifying themselves by a key pair. For shop…
- SSL SSL is an older method for encrypting data sent between a browser and a website. Today its successor TLS is mostly used, but the name SSL has stuck. An SSL certificate usually…
- Staging Staging is a test copy of a shop that closely resembles the live system. Updates and changes are tried out there first, before they reach the live shop. Errors can show up there…
- Status page A status page is a public page that shows the current operating state of a shop or service. During disruptions it can inform customers about the progress of the fix. It should be…
- SYN SYN refers to the message with which a device requests a connection when connecting over the internet. In a SYN flood, a server is overloaded with very many such requests. This…
T
- TDDDG The TDDDG is a German act on data protection in telecommunications and digital services. Among other things it governs access to information on a visitor's device, for example…
- TER The TER is a directory in which extensions for a content management system are provided. Businesses and service providers look there for additional functions. Each extension has…
- TLS TLS is a method that encrypts data on its way between browser, shop and interfaces. It is the successor of SSL. Websites using HTTPS rely on it.
- TMG The TMG was the former German Telemedia Act for online services and contained, among other things, the legal notice requirement. It has been replaced by the German Digital…
- TOM TOMs are technical and organizational measures to protect personal data. They include, for example, encryption, access rights, backups and clear procedures within the team. The…
- TOTP TOTP is a method for time-based one-time passwords that an app displays for a short period. It serves as an additional proof when signing in. For access to the shop administration…
- TR A TR is a technical guideline in which the German Federal Office for Information Security describes requirements for secure technology. It is generally a professional…
- TTDSG The TTDSG is the former name of the German law protecting privacy in online services. Today it is called the TDDDG. References to the TTDSG in privacy policies or cookie banners…
- TTFB TTFB measures how long it takes after a request until the first data of the server's response arrives in the browser. A low value is a basis for short loading times in a shop…
- TTL The TTL states how long a cached answer or record remains valid before it is requested again. It occurs in the domain name system and in caches for browsers and delivery networks…
- TU A TU is a German university of technology focusing on engineering and natural sciences. It teaches and does research in fields such as mechanical engineering, electrical…
- TXT TXT is a record type in the Domain Name System that stores free-form text for a domain. It is used, for example, for SPF, DKIM and DMARC settings or to confirm ownership of a…
U
- Uptime Uptime describes the time during which a shop or website is reachable and responds. It is usually stated as a share of a period and measured by regular checks from outside. The…
- URI A URI is a uniform identifier for a resource, such as a web address. It is the umbrella term that also covers the familiar URL. Technical texts and rule sets use the term when…
- URL A URL is the address of a page or file on the internet. It appears in the address bar at the top of the browser. It consists of the protocol, for example https, the domain name…
- US US stands for the United States of America. In operational matters the abbreviation appears, for example, in US dollars, studies or providers from that country.
- USA USA is the abbreviation for the United States of America. In texts about online shops it appears, for example, with market figures and statistics. There it names the country to…
- UStG The UStG is the German VAT Act. It governs the taxation of supplies and services and contains provisions on invoices and invoicing. How it applies in an individual case is a…
- UTC UTC is the worldwide reference time on which time zones are based. Technical systems such as servers and cron jobs often state times in UTC, regardless of summer and winter time.
- UWG The UWG is the German Act against Unfair Competition. It covers, for example, misleading advertising and unreasonable nuisance through advertising. For shops and websites it can…
V
- VAT VAT is a tax on goods and services that is shown on invoices and in price information. Prices for business customers are often quoted net, with VAT added on top. How it applies in…
- VPN A VPN is an encrypted connection that links remote systems as if they were on the same internal network. Businesses use it, for example, to reach internal systems remotely that…
- VPS A VPS is a virtual server with dedicated resources that shares its hardware with other virtual servers. Unlike simple shared hosting, the web server and cache can be configured…
- Vulnerability A vulnerability is a flaw or gap in software or configuration that an attacker could exploit. It affects, for example, shop software, plugins or servers. Vendors usually fix known…
- VVG The VVG is the German Insurance Contract Act. It governs the rights and duties of insurers and policyholders, including when contracts are concluded and withdrawn. What applies in…
W
- W3C The W3C is the body that develops technical standards for the web. These include HTML, CSS and the guidelines for accessible web content.
- WAF A WAF is a protective layer in front of a shop that inspects requests to the website and can filter suspicious access. It can help to fend off known attack patterns. Set too…
- WCAG The WCAG are international guidelines for accessible web content. They describe testable requirements, for example for contrast, for text alternatives to images and for keyboard…
- WiStrG The WiStrG is the German Economic Offences Act. It governs certain criminal and administrative offences in business life, for example in connection with prices and services. How…
- WSTG WSTG is a guide by the organization OWASP for testing the security of web applications. It describes test procedures by which tests can be structured.
X
- XML XML is a text format for describing structured data in a machine-readable way. Many interfaces, product catalogs and electronic invoices use XML to exchange data between systems.
- XML-RPC XML-RPC is an older interface through which programs call functions on another system over the internet. In some content management systems it is a known target for automated…
- XSS XSS is a type of attack in which foreign malicious code is injected into a web page and executed in a visitor's browser. Input fields, comments or search pages can be affected…
Z
- Zero-day A zero-day is a security gap that is exploited or known before the vendor could provide a fix. Until a patch appears, often only interim measures can reduce the risk. For…
- ZSK The ZSK is a key used to digitally sign the records of a domain zone. With DNSSEC it is exchanged regularly, which is called a rollover. Errors during the change can disrupt the…
Term not covered?
Our FAQ covers more about how a project runs — or simply ask us directly.