Plain-English glossary

169 words you meet in alerts, invoices from your IT person and vendor notices, each explained in a few sentences with what to do about it.

4

  • 4G backupA mobile connection that takes over when the fixed internet fails.

A

  • A recordThe DNS record that points your domain at the server's IP address.
  • ABNAustralian Business Number, the 11-digit public ID for a business. Anyone can check it on ABN Lookup.
  • ACNAustralian Company Number, the 9-digit ID ASIC gives a company. Companies have both an ACN and an ABN.
  • AcquittalThe report and receipts you give a funder to show the grant was spent as promised.
  • APIThe way two software products talk to each other, for example your website sending orders to your accounting software.
  • API keyA long secret code that lets one piece of software use another, like a password for programs.
  • ASIC annual reviewThe yearly check and fee every Australian company owes ASIC, due on the anniversary of registration.
  • Audit logA record of who did what and when in a system.

B

  • BackupA copy of your files and website kept somewhere else, so you can recover from deletion, hacks or ransomware.
  • BASThe Business Activity Statement Australian businesses lodge to report GST and PAYG, monthly or quarterly.
  • BotSoftware that visits websites automatically: search engines, uptime checkers, scrapers and attackers.
  • Business continuity planA short written plan for keeping the business running when something fails: power, internet, a key tool, a key person.
  • Business email compromiseA scam where an attacker uses or imitates a business email account to redirect payments.
  • Business grantMoney from government or a foundation for a purpose, which does not have to be repaid.
  • Business nameThe trading name registered with ASIC; not the same as a company and not a trade mark.

C

  • CAA recordA DNS record that says which certificate authorities may issue certificates for your domain.
  • CacheA saved copy of a page or file served instead of generating it again.
  • Canonical URLThe one official address for a page when the same content can be reached at several addresses.
  • CDNA network of servers around the world that serves your site faster and absorbs attacks. Cloudflare is the common one.
  • Certificate authorityAn organisation trusted by browsers to issue SSL certificates, like Let's Encrypt, DigiCert or Sectigo.
  • Certificate chainThe set of certificates that link yours back to one browsers already trust.
  • Certificate transparencyPublic logs of every SSL certificate issued, which reveal new lookalike sites and unexpected certificates for your own domain.
  • ChargebackA card payment reversed by the customer's bank after a dispute.
  • CMSThe system your website is built on, like WordPress, Shopify or Squarespace.
  • CNAME recordA DNS alias: this name points at that name.
  • Co-contributionThe share of a project's cost you must fund yourself to receive a grant.
  • Companies HouseThe UK register of companies. Its free public data shows status, filing deadlines and insolvency events.
  • Confirmation statementThe yearly form every UK company files with Companies House to confirm its details.
  • Core Web VitalsGoogle's three speed and stability measures: how fast the main content shows, how quickly the page responds, and how much it jumps around.
  • cPanelThe control panel most shared hosts use for email, files, databases and certificates.
  • CrawlerA bot that follows links to read pages, the way search engines discover and index websites.
  • Credential stuffingTrying leaked email and password pairs on other websites, hoping people reused them.
  • CVEA public ID number for one specific security flaw in a piece of software.
  • CVSS scoreA 0 to 10 severity score for a vulnerability. 9 and above is critical.
  • Cyber insuranceA policy that pays for the costs of a cyber incident: recovery, legal, notification, sometimes ransom.

D

  • Dark webParts of the internet reached through special software, where stolen data is traded.
  • Data breachWhen information held by a company is stolen or exposed, often including customer emails and passwords.
  • DDoS attackFlooding a website with so much traffic that real visitors cannot get through.
  • DeepfakeA convincing fake voice or video of a real person, used to authorise payments or spread lies.
  • Degraded performanceThe service works but is slow or failing for some people.
  • DeregistrationA company struck off the register by ASIC, usually for not paying the annual review fee or not trading.
  • Director IDA unique number every Australian company director must hold for life.
  • DKIMA digital signature your mail provider adds to prove an email really came from you.
  • DMARCThe DNS record that tells receivers what to do with email that fails SPF and DKIM.
  • DNSThe address book that turns your domain name into the servers that run your website and email.
  • DNS outageYour DNS host stops answering, so your domain cannot be found even though the server is fine.
  • DNS propagationThe hours it takes for a DNS change to reach every resolver in the world.
  • DNSSECSignatures on your DNS records so they cannot be forged on the way to a visitor.
  • Domain nameYour web address, like yourbusiness.com.au. You rent it yearly from a registrar.

E

  • EFTPOSThe card terminal at the counter, and the Australian network it can route through.
  • Electricity distributorThe company that owns the poles and wires to your premises and fixes outages. Not the same as your retailer.
  • Email spoofingSending an email that pretends to come from your address, usually to trick a customer or supplier.
  • EncryptionScrambling data so only someone with the key can read it.
  • End of lifeThe date a software version stops receiving security fixes. After it, every new flaw stays open.
  • Energy retailerThe company that bills you for electricity; different from the distributor that owns the wires.
  • EPSSAn estimate of the chance a vulnerability will be exploited in the next 30 days.
  • Essential EightThe Australian government's eight baseline cyber security measures for organisations.
  • Expired domainA domain whose registration lapsed; the website and email stop, and anyone can buy it after a grace period.
  • Expression of interestA short first-round application that asks whether you want to be considered for a grant or tender.

F

  • FBTFringe Benefits Tax on non-cash benefits to staff, like a car. The FBT year ends 31 March.
  • FirewallSoftware or a device that blocks unwanted network traffic. Web application firewalls protect websites specifically.

G

  • GeneratorA petrol, diesel or battery unit that powers essentials through an outage.
  • Google Safe BrowsingGoogle's list of dangerous websites. If your site lands on it, visitors see a red warning page.
  • Google Search ConsoleGoogle's free dashboard showing how your site appears in search and any problems it found.
  • GSTGoods and Services Tax, the 10 percent tax Australian businesses with turnover of 75,000 dollars or more must register for.

H

  • Hacked websiteA website an attacker has changed: adding spam pages, redirects, phishing pages or card-stealing code.
  • Have I Been PwnedA free catalogue of data breaches you can check an email address against.
  • HomoglyphA character that looks like another: a capital I and a lowercase l, a zero and an O.
  • HSTSA setting that tells browsers to only ever load your site over HTTPS.
  • HTTP status codeThe three-digit number a web server answers with: 200 fine, 404 missing, 500 broken, 503 overloaded.
  • HTTPSThe secure version of a web address. The s means the connection is encrypted.

I

  • IDCAREAustralia and New Zealand's identity and cyber support service for people and businesses after a scam or breach.
  • IncidentA vendor's word for a problem with their service, from a small glitch to a full outage.
  • InfostealerMalware that copies saved passwords, cookies and session tokens from a computer and sends them to criminals.
  • InsolvencyWhen a business cannot pay its debts as they fall due. Liquidation, administration and bankruptcy are the formal stages.
  • Invoice scamA fake or altered invoice that tricks you into paying the wrong bank account.
  • IP addressThe numeric address of a computer or server on the internet, like 203.0.113.10.

K

L

  • Let's EncryptA free certificate authority most hosts use for automatic HTTPS.
  • LiquidationWinding up a company: a liquidator sells what is left and pays creditors in order.
  • Lookalike domainA web address designed to be mistaken for yours, like yourbusines.com or your-business.com.

M

  • Maintenance windowA planned time when a vendor or host takes a service down to update it.
  • MalwareMalicious software: viruses, ransomware, spyware and code injected into hacked websites.
  • Man-in-the-middleSomeone sitting between you and a website, reading or changing what passes.
  • Managed hostingHosting where the provider runs the server, the updates, the backups and the security for you.
  • MFA fatigueBombarding you with approve-sign-in prompts until you press yes to make them stop.
  • Mixed contentA secure page that still loads some parts insecurely, so the padlock disappears.
  • MX recordThe DNS record that says which mail server receives email for your domain.
  • myIDThe Australian government's digital identity app (formerly myGovID) used to sign in to business services.

N

  • NameserversThe servers that hold your DNS records. Changing them moves control of your whole domain.
  • Nice classThe 45 international categories of goods and services a trade mark is registered under.
  • NMIThe National Metering Identifier: the number that identifies your electricity connection on a bill.
  • noindexA setting that tells Google not to show a page in search results. Left on by mistake, it hides your whole site.
  • Notifiable data breachIn Australia, a breach of personal information likely to cause serious harm must be reported to the OAIC and the people affected.

P

  • PasskeyA sign-in that uses your phone or computer's lock instead of a password, and cannot be phished.
  • Password managerAn app that creates and remembers a different strong password for every account.
  • PatchA software update that fixes a bug or security flaw.
  • Payday SuperFrom 1 July 2026, super must reach each employee's fund within 7 business days of payday.
  • PAYG withholdingThe tax you take out of employee wages and send to the ATO.
  • PayIDPaying to an email address, phone number or ABN instead of a BSB and account number.
  • Payment redirectionA fake notice that a supplier, landlord or employee has new bank details; the next payment goes to a criminal.
  • Payroll diversionAn email 'from an employee' asking payroll to change their bank account before payday.
  • PCI DSSThe card industry's security rules for anyone who takes card payments.
  • Penetration testPaying a security professional to try to break into your systems and report what they found.
  • PhishingA fake message that tricks you into typing a password or paying money.
  • Plain-English summaryOur rewrite of a technical notice at about a Grade 7 reading level, using only facts from the source.
  • Planned power outageA scheduled interruption to electricity for maintenance, announced in advance by your distributor.
  • PPSRThe Personal Property Securities Register: where interests in goods (leased equipment, stock on credit) are recorded.
  • PunycodeThe way a domain with accented or foreign letters is written in plain ASCII, starting with xn--.

Q

R

  • RansomwareMalware that encrypts your files and demands payment to unlock them.
  • Rate limitingAllowing only so many requests from one source in a minute, so abuse and floods are slowed.
  • RDAPThe modern, structured replacement for WHOIS lookups of domain records.
  • RegistrarThe company you pay to keep your domain name registered.
  • Registrar lockA setting that stops your domain being transferred away without you unlocking it.
  • ReportCyberThe Australian Cyber Security Centre's portal for reporting cybercrime to police.
  • Request for quoteA buyer asking suppliers to price a defined job; smaller and faster than a full tender.
  • robots.txtA file at the root of your site that tells search engines which parts to stay out of.

S

  • Scam alertA warning from an authority or bank about a scam currently circulating, with what it looks like and what to do.
  • ScamwatchThe ACCC's Australian scam reporting and warning service.
  • Scheduled maintenanceA planned time when a service will be unavailable, announced in advance.
  • Scheduled task (cron)A job that runs automatically on a schedule, like certificate renewal or backups. When it silently fails, things expire.
  • SFTPSecure file transfer to a server; the replacement for old FTP.
  • Shared hostingMany websites on one server, each paying a few dollars a month.
  • SIM swapA criminal convinces your mobile provider to move your number to their SIM, then receives your codes.
  • Single sign-onOne login (Google, Microsoft) used for many apps.
  • Single Touch PayrollReporting wages, tax and super to the ATO every payday through your payroll software.
  • SmishingPhishing by text message: a link or number in an SMS that looks like a bank, courier or the tax office.
  • SMS scam (smishing)A text message pretending to be from a bank, parcel company or government to steal details or money.
  • Social engineeringTricking a person into doing something, rather than breaking into a system.
  • SPFA DNS record listing which services may send email from your domain.
  • SSHA secure command-line login to a server, used by developers and system administrators.
  • SSL certificateThe file that gives your website the padlock and keeps what visitors type private.
  • Status pageA vendor's own page that reports whether its service is working.
  • Structured dataHidden labels on a page that tell search engines what it is: a business, a product, an event, a question and answer.
  • SubdomainA name under your domain: shop, mail, app or booking before the dot.
  • Subdomain takeoverA forgotten subdomain still points at a cancelled service, so a stranger claims it under your name.
  • Superannuation guaranteeThe minimum super an employer must pay for each employee, as a percentage of ordinary earnings.
  • Supply chain attackCompromising a vendor, plugin or update that many businesses trust, to reach them all at once.
  • Surge protectorA power board or device that absorbs voltage spikes so equipment survives a storm or a grid fault.

T

  • TenderA formal invitation to bid for government or corporate work.
  • Time to first byteHow long the server takes to start answering; the first sign of a slow or overloaded site.
  • TLSThe current name for the technology behind SSL certificates and the padlock.
  • TPARThe Taxable Payments Annual Report some industries lodge by 28 August listing payments to contractors.
  • Trade markA registered right to a name, logo or phrase for particular goods or services.
  • Transfer codeThe password (EPP or auth code) that moves a domain between registrars.
  • TTLHow long DNS answers may be cached before they are looked up again.
  • Two-factor authenticationA second check at sign-in, like a code from an app, so a stolen password alone does not work.
  • Two-location checkConfirming a website is down from two places in the world before alerting, to avoid false alarms.
  • TXT recordA DNS record that holds text: SPF, DMARC, domain verification codes and similar.
  • TyposquattingRegistering misspellings of a popular address to catch people who mistype it.

U

  • UPS (battery backup)A battery that keeps computers, routers and terminals running for a short time when power fails.
  • UptimeThe share of time your website was reachable. 99.9 percent uptime still allows about 43 minutes down a month.

V

  • VAT returnThe UK and EU equivalent of a BAS: reporting the VAT you charged and paid, usually every quarter.
  • VishingPhishing by voice: a phone call that pretends to be your bank, telco, the ATO or your own IT person.
  • Voluntary administrationA company's directors hand control to an administrator to try to rescue it or wind it up in an orderly way.
  • VPNAn encrypted tunnel between a device and your network or a provider, used for remote work and privacy.
  • VPSA virtual private server: your own slice of a server, with full control and full responsibility.
  • VulnerabilityA weakness in software that an attacker can use to break in, steal data or take control.

W

  • Web application firewallA filter in front of your website that blocks known attack patterns before they reach it.
  • Web hostingThe company whose servers your website runs on.
  • WebhookAn automatic message one system sends to another when something happens, like a payment received.
  • WHOIS and RDAPThe public lookup of who registered a domain and when it expires. RDAP is the modern version.
  • WHOIS privacyHiding your name, address and phone from the public domain record.
  • Wildcard certificateOne certificate for every subdomain of a domain: *.yourbusiness.com.au.
  • WordPress pluginAn add-on that gives a WordPress site a feature. Plugins are the most common way WordPress sites get hacked.

X

  • XML sitemapA machine-readable list of your pages that helps search engines find and refresh them.

Z

  • Zero-dayA flaw attackers are using before the vendor has a fix.