WordPress Security Glossary

Cross-Site Request Forgery (CSRF) is an attack that tricks a user's browser into making an unwanted request to a web application where they're authenticated.

Cross-Site Scripting (XSS) is an attack where malicious scripts are injected into trusted websites, executing in victims' browsers to steal data or hijack sessions.

SQL Injection is an attack where malicious SQL code is inserted into application queries, allowing attackers to read, modify, or delete database data.

A WordPress nonce is a one-time token used to verify that a request originated from the expected source, protecting against Cross-Site Request Forgery attacks.

PHP_CodeSniffer (PHPCS) is a tool that detects violations of coding standards in PHP code, with WordPress-specific rulesets that enforce security and style conventions.

PHPStan is a static analysis tool for PHP that finds bugs and type errors without running the code, with WordPress-specific extensions that understand the WordPress API.

The General Data Protection Regulation (GDPR) is an EU law that governs how personal data is collected, processed, and stored, with significant implications for WordPress plugins.

The European Accessibility Act (EAA) is EU legislation requiring digital products and services to meet WCAG 2.1 Level AA accessibility standards, effective June 28, 2025.

The Cyber Resilience Act (CRA) is EU legislation requiring all software products to meet cybersecurity requirements, including vulnerability handling and security documentation.

A capability check verifies that the current user has permission to perform a specific action, using WordPress's role-based access control system via current_user_can().

A prepared statement separates SQL query structure from data values, preventing SQL injection by ensuring user input cannot alter the query's logic.

Data sanitization is the process of cleaning user input to ensure it's safe for storage and processing, removing potentially dangerous content.

Escaping converts special characters in output to their safe HTML entity equivalents, preventing browsers from interpreting data as executable code.

The permission_callback is a required parameter in WordPress REST API route registration that determines whether a request should be processed based on the user's identity and capabilities.

WordPress autoloading is a mechanism that loads all options marked as 'autoload' into memory on every page request, which can cause performance issues if overused.

A persistent cross-site scripting attack where malicious script is saved to the server and served to other users.

A non-persistent XSS attack where malicious script is reflected off a web server via URL parameters or form submissions.

Server-Side Request Forgery where the server is tricked into making requests to unintended internal or external resources.

A critical vulnerability allowing an attacker to run arbitrary code on the server.

A vulnerability where an attacker can read arbitrary files from the server by manipulating file path parameters.

Accessing resources by manipulating identifiers without proper authorization checks.

An attack where a user gains higher access privileges than intended, such as a subscriber becoming an administrator.

A vulnerability that allows accessing protected resources without valid credentials.

An attack using ../ sequences to access files outside the intended directory.

Tricking users into clicking hidden elements by overlaying a transparent iframe on a legitimate page.

A vulnerability where a web application redirects users to an attacker-controlled URL without validation.

Compromising software by targeting its dependencies, build tools, or distribution channels.

A vulnerability exploited before the vendor is aware of it or has released a patch.

Common Vulnerabilities and Exposures, a standardized identifier for publicly known security vulnerabilities.

Common Vulnerability Scoring System, a standardized framework for rating vulnerability severity on a 0-10 scale.

A regularly updated list of the ten most critical web application security risks.

A security layer that filters and monitors HTTP traffic to protect web applications from attacks.

An HTTP header that controls which resources a browser is allowed to load, preventing XSS and data injection.

A header that forces browsers to only connect via HTTPS, preventing downgrade attacks.

A mechanism that controls which domains can make requests to your API.

Hash-based Message Authentication Code for verifying both data integrity and authentication using a cryptographic hash.

An attack that systematically tries all possible passwords until the correct one is found.

Malicious software designed to damage, disrupt, or gain unauthorized access to computer systems.

Hidden code that provides unauthorized remote access to a system, often surviving normal security measures.

Deliberately making code difficult to understand, often used to hide malicious intent.

The event system that allows plugins to modify WordPress behavior through actions and filters.

WordPress AJAX hook system for handling asynchronous requests from the browser.

WordPress pseudo-cron system that executes scheduled tasks on page load rather than using system-level cron.

WordPress function that escapes HTML entities in a string, preventing XSS when outputting text content.

WordPress function that escapes a string for safe use inside HTML attributes.

WordPress function that validates and sanitizes URLs, removing dangerous protocols and characters.

WordPress function that filters HTML content allowing only a safe subset of HTML tags and attributes.

WordPress function that sanitizes a string by removing HTML tags, encoding special characters, and stripping unwanted data.

WordPress function that removes backslashes added by PHP magic quotes from superglobal data.

WordPress function that converts a value to a non-negative integer, combining abs() and intval().

WordPress database query preparation method that safely parameterizes SQL queries.

WordPress constant defining the absolute path to the installation directory, used to prevent direct file access.

High-Performance Order Storage in WooCommerce, using custom database tables for orders instead of post meta.

WordPress block-based approach to building entire websites including headers, footers, and templates.

WordPress built-in JSON-based API for creating, reading, updating, and deleting content programmatically.

WordPress temporary data caching system that stores data with an expiration time.

WordPress plugins that are automatically activated and cannot be deactivated through the admin interface.

The official command-line interface for WordPress, allowing site management and plugin operations from the terminal.

WordPress legacy remote procedure call interface, largely replaced by the REST API.

The block-based content editor introduced in WordPress 5.0, replacing the classic TinyMCE editor.

Configuration file for block themes that defines global styles, settings, and design tokens.

A PHP static analysis tool with taint analysis for tracking data flow from user input to dangerous sinks.

An open-source static analysis tool that matches code patterns using customizable rules.

Static Application Security Testing analyzing source code for vulnerabilities without executing the program.

Continuous Integration and Continuous Deployment pipelines that automate building, testing, and deploying code.

PHP dependency manager used to install and manage third-party libraries and their versions.

A versioning scheme (MAJOR.MINOR.PATCH) where version numbers convey meaning about changes.

A standard for connecting AI assistants to external tools and data sources.

A PHP feature for organizing code into logical groups preventing naming conflicts between packages.

Using PHP type declarations to catch type-related bugs at analysis time rather than runtime.

California Consumer Privacy Act giving consumers rights over their personal data collected by businesses.

Payment Card Industry Data Security Standard for organizations handling credit card data.

Software Bill of Materials listing all components, libraries, and dependencies in a software product.

A security practice where vulnerabilities are reported privately and given time to patch before public disclosure.

A privacy principle requiring only the minimum necessary personal data be collected and retained.

The requirement to obtain user permission before storing non-essential cookies.

GNU General Public License used by WordPress, requiring derivative works to also be GPL-licensed.

An attack where the attacker sets a user's session ID to a known value, then waits for the user to authenticate.

An attack that exploits XML parsers to read local files, perform SSRF, or cause denial of service.

A vulnerability where untrusted data is used to instantiate objects, potentially leading to remote code execution.

A side-channel attack that exploits time differences in cryptographic comparisons to guess secret values.

An automated attack using stolen username/password pairs from data breaches to access accounts.

A precomputed table for reversing cryptographic hash functions, used to crack password hashes.

A security mechanism that associates a host with its expected SSL certificate to prevent man-in-the-middle attacks.

A browser feature that verifies fetched resources match expected hashes, preventing CDN tampering.

Restricting the number of requests a client can make in a given time period to prevent abuse.

Verifying that user input meets expected format, type, and range before processing it.

Converting special characters to safe equivalents before inserting data into HTML, URLs, or other contexts.

Granting users and processes only the minimum permissions needed to perform their tasks.

A security strategy using multiple layers of protection so that if one layer fails, others still protect the system.

WordPress macro codes enclosed in square brackets that plugins can register to output dynamic content.

Modular content blocks that can be placed in widget areas defined by themes.

Developer-defined content types beyond the default posts and pages, extending WordPress as a CMS.

Classification systems for grouping WordPress content, like categories and tags, with support for custom taxonomies.

Admin interface panels for adding custom fields to post editing screens.

WordPress database API for storing and retrieving site-wide settings using key-value pairs.

Custom data fields stored per WordPress user, accessible via get_user_meta() and update_user_meta().

URL routing rules that map pretty permalinks to WordPress query variables.

WordPress caching layer that stores database query results in memory for faster subsequent access.

A WordPress feature allowing multiple sites to be managed from a single installation.

The main WordPress configuration file containing database credentials, secret keys, and site settings.

WordPress constant that enables debug mode, showing PHP errors and notices.

WordPress constant that disables the built-in theme and plugin file editors in the admin dashboard.

PHP Code Beautifier and Fixer, the automatic code fixer companion to PHP_CodeSniffer.

A PHP refactoring tool that performs automated code transformations using AST manipulation.

A tool to automatically fix PHP coding standards issues, supporting PSR and custom rule sets.

Scripts that run automatically at specific points in the Git workflow, like pre-commit or pre-push.

The systematic examination of source code by peers to find bugs, security issues, and improve quality.

Authorized simulated attacks on a system to evaluate its security by finding exploitable vulnerabilities.

Analyzing third-party libraries and packages for known vulnerabilities.

A PHP standard for automatically loading class files based on namespace and class name without manual require statements.

PHP bytecode cache that stores precompiled script bytecode in memory, eliminating the need to parse PHP files on each request.

Modern PHP features including named arguments, match expressions, enums, fibers, readonly properties, and intersection types.

Strategies for gracefully managing and recovering from errors, exceptions, and unexpected conditions in code.

Recording application events, errors, and debug information for monitoring and troubleshooting.

Privacy and Electronic Communications Regulations, UK law governing electronic marketing and cookies.

EU directive governing privacy in electronic communications, including the cookie consent requirement.

International standard for information security management systems, defining requirements for managing security risks.

Service Organization Control 2, a framework for managing customer data based on five trust service criteria.

A legally binding contract between data controllers and processors, required under GDPR.

GDPR right allowing individuals to request deletion of their personal data.

GDPR right allowing individuals to receive their personal data in a machine-readable format.

An approach to system design that embeds privacy protections from the start rather than adding them later.

A published policy describing how an organization receives and handles security vulnerability reports.

Ensuring that all software components are used in accordance with their license terms.

WordPress function that outputs a hidden form field containing a nonce for CSRF protection.

WordPress function that verifies a nonce was included in the request, dying with an error if invalid.

WordPress function that terminates execution and displays an error message, used for access control.

WordPress function that redirects to a URL only if it is on an allowed host, preventing open redirect attacks.

WordPress database abstraction class providing methods for safe database interaction.

WordPress abstract class for rendering hierarchical data structures like menus and comment trees.

WordPress filesystem abstraction API that provides safe methods for reading and writing files.

WordPress HTTP request API (wp_remote_get, wp_remote_post) for making external HTTP calls safely.

WordPress hook that fires when a plugin is activated, used for setup tasks like creating database tables.

WordPress hook that fires when a plugin is deactivated, used for cleanup tasks.

WordPress system for properly loading JavaScript and CSS files with dependency management.

WordPress function that passes PHP data to JavaScript by creating a global variable.

WordPress API for periodic AJAX communication between the browser and server.

WordPress system for registering custom intervals for WP-Cron recurring tasks.

WordPress system for displaying messages in the admin dashboard header area.

WordPress API for creating admin settings pages with automatic nonce verification and sanitization.

Predefined block layouts that users can insert into the block editor with a single click.

WordPress system that determines which template file is used to render a specific page based on a priority order.

WordPress class for querying posts with custom parameters, supporting complex filtering and pagination.

Custom data fields associated with WordPress posts, stored as key-value pairs in the postmeta table.

JSON Schema definitions for WordPress REST API endpoints, enabling validation and documentation.