Website maintenance glossary. 22 terms in plain English.

Backup

A saved copy of your website's files and database that can be put back if something goes wrong. A backup is only useful if it is recent, stored away from the website's own server and known to restore.

Backup retention

How far back your backups go. Longer retention lets you return to a version from before a problem started, which matters when damage is not noticed for days or weeks.

Brute-force attack

An automated attempt to guess a password by trying many combinations. Strong passwords, login limits and two-factor authentication make it fail.

Caching

Saving a ready-made copy of a page so it can be delivered quickly instead of being built from scratch for every visitor. It is one of the biggest speed improvements for most sites.

CDN (content delivery network)

A network of servers around the world that deliver your site's images and files from a location near each visitor, which shortens load times for an international audience.

Core Web Vitals

Google's measures of how a page feels to use: how fast the main content appears, how quickly it responds to a tap or click, and whether it jumps around while loading.

CVE

A public identification number for a known security flaw in software, such as a plugin. When a CVE is published for a component your site uses, updating it is a priority.

Hands-on hours

The hours of expert work included in a maintenance plan each month, used for changes, fixes and requests. They are separate from the automated monitoring and protection that runs continuously.

HSTS

A setting that tells browsers to always use the secure (HTTPS) version of your site, which prevents visitors from being sent to an insecure copy.

Malware scan

A check of your website's files and database for malicious code, such as hidden redirects or injected scripts. Regular scans find an infection before visitors or search engines do.

Plugin conflict

A fault that appears when two plugins, or a plugin and a theme, interfere with each other. Updating in small batches and testing after each makes the cause easy to find.

Restore test

Putting a backup back onto a separate copy of the site to confirm it works. It is the only real proof that a backup can be relied on.

RPO (recovery point objective)

How much recent work you can afford to lose, measured in time. If backups run daily, the most you can lose is about a day of changes.

RTO (recovery time objective)

How long your site can be down before it hurts the business. It decides how quickly a restore has to happen.

Security headers

Instructions your server sends with each page that tell the browser to apply protections, such as blocking the page from being embedded in another site.

SSL certificate

A digital certificate that lets your site use HTTPS, so the connection between a visitor and your site is encrypted and the browser shows the site as secure.

Staging site

A private copy of your website used to test updates and changes before they go live, so a mistake never reaches your visitors.

Two-factor authentication

A second step at login, such as a code from a phone, in addition to the password. It stops most attacks that rely on stolen or guessed passwords.

Uptime

The share of time your website is available to visitors. 99.9 percent uptime still allows about 8 hours and 45 minutes of downtime in a year.

Uptime monitoring

Automatic checks, every few minutes, that your site is reachable and working, with an alert when it is not. It shortens the time between a failure and its fix.

Vulnerability scan

A check of your site's software, such as plugins, themes and core, against lists of known security flaws, so outdated or weak components are found and updated.

Web application firewall (WAF)

A filter in front of your website that blocks malicious requests, such as attempts to exploit a known flaw, before they reach the site.

Last updated: October 1, 2026. Written by the WebXSentry team; see our editorial policy. For longer explanations, read our guides or the about page.