Web and WordPress Security Terms
Many small business websites run on WordPress, and break-ins often start with a plugin, a password, or an admin account nobody noticed. These terms cover how WordPress sites get compromised and how they are protected, from plugin vulnerabilities and rogue admin users to file integrity monitoring. Each one uses real cases from vulnerability databases and published security research.
Start here
- Cross-site scripting (XSS): A web flaw that lets an attacker run their own JavaScript in other users' browsers on a trusted site.
- SQL injection (SQLi): An attack that inserts database commands through a website's input so the site executes them.
- Cross-site request forgery (CSRF): An attack that tricks a logged-in user's browser into sending a request they did not intend.
- WordPress nonce: A short-lived WordPress security token added to forms and links to confirm a request was intended.
- File integrity monitoring: The practice of recording cryptographic hashes of important files and alerting when files change, appear, or disappear unexpectedly.
- Plugin vulnerability: A security flaw in a WordPress plugin or theme that an attacker can use to break into or misuse a site, even when WordPress core is up to date.
- Web application firewall (WAF): A filter in front of a website that inspects HTTP requests against rules to block common attacks.
- Brute force attack: An attempt to break into an account by trying many passwords, usually automated, until one works.
- XML-RPC: A legacy WordPress remote interface at xmlrpc.php that accepts credentials with each call and is often abused for password guessing.
- wp-config.php hardening: Protecting WordPress's main configuration file and using its settings to disable risky features.
- Rogue admin user: An administrator account the site owner did not create or no longer controls, usually added by an attacker to keep full control of a site.
Last updated October 14, 2026.