Web glossary

Plain-English definitions of the technical terms that recur across the tips and guides. No background assumed — skim the cluster you need. For AI-specific jargon, see the separate AI glossary.

Web basics

URL — Uniform Resource Locator. The full address of a page or resource, like https://example.be/contact — the protocol, the domain, the path, and sometimes query parameters and a #fragment.

HTTP — Hypertext Transfer Protocol. The request-and-response system browsers and servers use to exchange pages, images and data. HTTPS is HTTP secured with TLS encryption.

Browser / client — The software that requests and displays a site (Safari, Firefox, Chrome). In web terms the browser is the client; the system answering it is the server.

Web server — Software that receives HTTP requests and returns pages, files or other responses. The machine running it is also called a server.

Web hosting — The service and infrastructure that keep a website available on the internet — storing its files or running its application on a connected server.

API — Application Programming Interface. A defined way for one program or service to request data or actions from another.

Domains & DNS

Domain — Your website's name, such as example.be. You register the right to use it through a registrar, normally renewed each year.

Subdomain — A name in front of your main domain, like shop.example.be or mail.example.be. It can point to a separate site or service.

Apex (root) domain — The bare domain with nothing in front of it: example.be rather than www.example.be. DNS panels often write it as @. Some record types — notably CNAME — aren't allowed at the apex, which is why providers offer ALIAS-style workarounds.

DNS — Domain Name System. The internet's address book: it translates a human name like example.be into the numeric addresses computers use. See DNS records explained.

A record — Associates a domain (or subdomain) with an IPv4 address. That address may lead to your server — or to a reverse proxy, load balancer, or hosting platform standing in front of it.

AAAA record — The same idea as an A record, but pointing to an IPv6 address (the newer, longer address format).

CNAME — An alias that points one name at another name rather than at an address, so the target's record is followed.

MX record — Mail Exchanger. Tells other servers where to deliver email for your domain; each entry has a priority number.

TXT record — A free-text DNS entry. Used for things like domain verification and the SPF, DKIM, and DMARC email records below.

CAA record — Certification Authority Authorization. Lists which certificate authorities may issue TLS certificates for your domain. Optional — but if a CAA record exists and doesn't authorize the CA you're using, a compliant CA will refuse new issuance, renewals included. Existing certificates stay valid until expiry, and whether you notice the refusal depends on your renewal alerts.

NS record — Nameserver. Lists the servers that are authoritative for your domain's DNS — i.e. who holds the real answers.

TTL — Time To Live. How long a resolver may reuse a cached DNS answer before checking again. A lower TTL shortens how long old answers linger after a change — but lower it in advance and wait out the old TTL first, since resolvers that already cached the record keep it for the TTL it carried. It does not make changes instant; a higher TTL means less lookup traffic.

DNS resolver — The service that looks up DNS answers for your browser or device, asking the authoritative nameservers and caching the results for their TTL.

DNS propagation — Informal term for the window after a DNS change during which old, cached answers are still being served. Records aren't pushed everywhere at once — cached copies expire on their TTL.

DNSSEC — Adds cryptographic signatures so a validating resolver can verify that signed DNS data came through the domain's chain of trust unaltered. It does not encrypt DNS lookups, and it can't make wrongly published records right — it proves authenticity, not correctness.

PTR record / reverse DNS — Associates an IP address with a hostname in the separate reverse-DNS namespace — normally managed by whoever provides the IP address, and independent of your A records. It matters most for mail, where receivers often expect forward and reverse DNS to be sensibly consistent.

RDAP / WHOIS — Services for looking up a domain's registration details (registrar, dates, status). RDAP is the standardized successor to the older WHOIS protocol — since 2025 it is the definitive source for the common generic domains. Contact details are often redacted for privacy.

Registrar lock — A status that blocks ordinary domain transfers while enabled, closing one route for domain theft. It does not secure your registrar account itself or prevent unauthorized DNS changes — those need strong credentials and MFA.

Email

SMTP — Simple Mail Transfer Protocol. How mail systems submit and relay outgoing email to one another.

IMAP — Internet Message Access Protocol. Lets a mail program read and manage messages kept on the server, with folders and read/unread status synced across your devices.

SPF — Sender Policy Framework. A DNS TXT record listing which servers are allowed to send mail for your domain. It authenticates the SMTP envelope/HELO domain (used during delivery), not necessarily the visible "From" address a reader sees.

DKIM — DomainKeys Identified Mail. Adds a cryptographic signature to your outgoing mail; the receiver checks it against a public key in your DNS to confirm the signing domain and that the signed content was not altered after signing. It verifies a signature, not that a human sender is genuine.

DMARC — Builds on SPF and DKIM. A message passes DMARC when at least one of them passes and its authenticated domain aligns with the visible "From" domain. The domain owner publishes a policy telling receivers how to handle mail that fails, and where to send reports. It reduces visible-domain spoofing when receivers honor the policy — it is not a delivery guarantee.

DMARC alignment — The relationship between the visible "From" domain and the domain SPF or DKIM authenticated. Strict alignment requires an exact match; relaxed alignment requires both to belong to the same organizational domain. At least one aligned check must pass for DMARC to pass.

Email address case — The domain after the @ is case-insensitive. The part before it is technically allowed to be case-sensitive, though many providers treat different capitalizations as the same mailbox. Preserve the address as the user typed it for display and delivery; if you normalize it for account matching, do so consistently and don't assume every provider follows the same rules.

Open relay — A mail server that will forward email for anyone, not just its own users. Spammers abuse them, so a mail server should never be left open.

Bounce — A notification that an email could not be delivered. A hard bounce signals a permanent problem (e.g. no such address); a soft bounce a temporary one (e.g. a full mailbox). See why your email bounced.

DNSBL / blocklist — A DNS-queryable list of IP addresses or domains that meet the list operator's abuse or policy criteria — being listed doesn't always mean proven spamming. Some receiving mail systems consult these lists as one input when deciding how to handle mail. Older name: RBL, and informally "blacklist". See get off an email blacklist.

Greylisting — A spam defense that temporarily refuses mail from an unfamiliar sender on the first try. Properly configured mail servers normally retry and get through, while many abusive senders don't — a useful filter, not a guarantee.

Security & HTTPS

HTTPS — HTTP carried over TLS. It provides encryption, integrity, and authentication between the browser and the TLS endpoint it connects to. When a reverse proxy or CDN terminates TLS, the connection onward to your origin server is a separate link that must be protected too.

TLS / SSL — The protocol that encrypts an HTTPS connection. TLS is the current standard; SSL is its obsolete predecessor, but the old name still lingers in everyday use.

HSTS — HTTP Strict Transport Security. A response header telling a browser that has learned the policy to use only HTTPS for that host for a set period. It protects later visits; a browser's very first contact is only covered by preloading. Deploy the includeSubDomains option with care.

Certificate — A digital document binding domain names to a public key, issued by a certificate authority after validation, enabling HTTPS. Most routine certificates validate only control of the domain; some types also carry validated organization details. None proves the business behind the site is legitimate or safe. Certificates expire and must be renewed in time.

Mixed content — A secure HTTPS page that still loads some resources (an image, a script) over insecure HTTP. Browsers warn about or block it, so serve everything over HTTPS.

CSP — Content Security Policy. A policy that restricts where a page may load scripts, styles, frames and other resources from, reducing the impact of cross-site scripting and content injection. Deliver it as a real HTTP response header — some directives (like frame-ancestors) are ignored in a <meta> tag. See HTTPS everywhere and headers.

WAF — Web Application Firewall. A filter that inspects HTTP requests and blocks common attack patterns before they reach your site. Useful, but not a substitute for secure code and prompt updates.

Reverse proxy — A server that sits in front of your origin, receiving requests first and forwarding them on. It can add caching, TLS termination, filtering, load balancing and DDoS protection. See should you use a reverse proxy or CDN.

Privacy & tracking

Cookie — A small piece of data the browser stores and sends with later requests when the cookie's domain, path, expiry, and security/SameSite rules allow. Cookies can keep you signed in, remember preferences, or support tracking.

localStorage — Storage in the browser tied to one website (origin). It can persist between visits but, unlike a cookie, is not automatically sent to the server with every request. Consent and privacy rules aren't cookie-specific — storing or reading data on a visitor's device can need the same care.

First-party / third-party — First-party is served by the site you chose to visit. Third-party comes from another provider that site loads or contacts — an ad network, a video embed, a spam-protection service. Note the technical and legal views differ: a technically third-party service can legally be your processor, so judge privacy roles by purpose and relationship, not domain names.

Personal data — Under the GDPR, information relating to an identified or identifiable person. Names, email addresses, account identifiers, IP addresses and combinations of technical signals can all qualify, depending on the circumstances.

Controller / processor — Under the GDPR, the controller decides why and how personal data is processed; a processor handles it on the controller's behalf, following its instructions. The role attaches to each processing activity — the same company can be processor for one activity and controller for another.

Fingerprinting — Recognizing or distinguishing a visitor from a combination of browser, device, network and configuration signals — sometimes without storing any cookie. Skipping cookies does not skip the privacy rules: consent and disclosure duties can apply to fingerprinting too.

SEO

Crawling / indexing — Crawling is a search engine discovering and fetching a page; indexing is analyzing it and storing it for possible use in results. A page can be crawled without being indexed — and blocking crawling in robots.txt can stop the engine from ever seeing a noindex instruction.

noindex — A per-page instruction (a meta tag or header) telling compliant search engines not to include the page in their index. The crawler must be allowed to fetch the page to see it.

Canonical URL — The preferred, representative version of a page you ask search engines to consolidate on when several URLs show similar content, set with a rel="canonical" tag. It's a hint, not a command, and need not be the "original" — just the version you want indexed.

301 — Moved Permanently. Tells visitors and search engines the resource has a new permanent URL. Search engines can use it as a strong consolidation signal — with no guarantee about how ranking value carries over.

302 — Found; commonly used as a temporary redirect, with the original URL remaining the one to keep using. How search engines index around it is up to them and can shift — when a move is permanent, say so with a permanent redirect.

404 — Not Found. The server has no current page at that URL — or won't disclose one — and the code says nothing about whether that's temporary or permanent. Give visitors a helpful custom 404 page that still returns status 404 (a "not found" page answering 200 becomes a soft 404) — see 404 error messages explained.

410 — Gone. The resource is no longer available and the server considers that condition likely permanent — a stronger signal than 404 for content you know won't return.

503 — Service Unavailable. A temporary state, useful during overload or planned maintenance — send a Retry-After header where possible, and don't leave a site answering 503 indefinitely.

robots.txt — A file at your domain root that asks crawlers which paths not to crawl. It is a request, not a lock, and is not a security measure.

Sitemap — An XML file listing the URLs you want search engines to discover and consider crawling, optionally with limited metadata. It guarantees neither crawling nor indexing.

Title tag — The HTML <title> of a page. Search engines often use it as the clickable title shown in results, though they may rewrite it. See unique titles and meta tags.

Meta description — A short page summary that search engines may show beneath your title in results. A good one can affect whether people click — but the engines decide how, and whether, to use it.

hreflang — Markup identifying the equivalent language or regional versions of a page, so supporting search engines can pick the right one per visitor. A signal they may use, not a guarantee they will.

Structured data / JSON-LD — Machine-readable markup (commonly in the JSON-LD format) that describes your content — a product, an event, an FAQ — so search engines understand it and may show richer results.

E-E-A-T — Experience, Expertise, Authoritativeness, Trust — a quality concept from Google's Search Quality Rater Guidelines, not a single score or direct ranking factor. See E-E-A-T explained.

Performance & caching

CDN — Content Delivery Network. Servers spread around the world that can cache your static files close to visitors — on cache hits, with sensible rules, that cuts latency for distant users. See should you use a reverse proxy or CDN.

Cache — A stored copy of content, kept so it can be served quickly without fetching or regenerating it every time.

Cache-Control — An HTTP header that sets whether and how long browsers and other caches may store a response. Its directives are often misread: no-cache allows storing a copy but requires revalidating it with the server before reuse (it does not mean "don't cache"); no-store tells conforming caches to keep no copy — which doesn't rule out logs or other systems retaining one; private allows only the visitor's own browser to store it, not shared caches like a CDN. See Cache-Control.

TTL (browser vs edge) — Informal shorthand for how long a cached copy counts as fresh — in the visitor's browser and at a CDN edge, which can differ (max-age, s-maxage, cache configuration). Freshness is a promise about reuse, not retention: a cache may evict a file early, and a stale copy isn't deleted but must be revalidated before normal reuse.

TTFB — Time To First Byte. The time between requesting a resource and receiving the first byte of its response — connection, network and server-processing time combined.

Compression — Shrinking the transfer size of text files (HTML, CSS, JavaScript), usually with Brotli or gzip, before sending them to the browser.

WebP — An image format with lossy and lossless modes, transparency and animation, that can produce smaller files than older formats at similar quality — compare real encodes of your own images rather than assuming.

AVIF — An image format with efficient lossy and lossless compression, transparency and HDR support, often smaller still. Compare actual encodes, and provide fallbacks where your audience's browsers need them.

Responsive images — Serving an image in several sizes or formats (via srcset/sizes or <picture>) so the browser can pick one that fits the visitor's screen instead of downloading an oversized file.

Core Web Vitals (LCP / CLS / INP) — Metrics for loading, visual stability, and responsiveness that Google currently groups as Core Web Vitals. See Core Web Vitals explained.

Minification — Stripping unnecessary characters (spaces, comments) from HTML, CSS, and JavaScript to shrink file size without changing behavior.

Render-blocking resource — A stylesheet or script the browser must process before it can display the page. Too many render-blocking resources delay the first visible content.

Lazy loading — Delaying the load of offscreen images and other resources until the visitor scrolls near them, so the initial page loads faster. Only for genuinely offscreen content: never lazy-load the main above-the-fold image, and keep dimensions reserved so nothing shifts.

Bookmark this page; these terms recur across the tips and guides.