Security Glossary
Web-security terms, in plain English
A working vocabulary for protecting modern surfaces — from the WAF and the OWASP Core Rule Set to non-human identities, key custody, and agent endpoints.
- Web Application Firewall (WAF)
- A security layer that inspects HTTP requests — method, path, headers, query, body — and blocks common web attacks like SQL injection and cross-site scripting before they reach application code.
- OWASP Core Rule Set (CRS)
- An open, community-vetted set of detection rules covering the OWASP Top 10 and other common attack classes. Because it is open, you can see exactly what is detected and why.
- Coraza
- A modern, open-source WAF engine that executes OWASP CRS rules and can run embedded in an edge data plane. ArxLayer Edge runs Coraza with the OWASP Core Rule Set.
- Edge enforcement
- Inspecting and filtering traffic at the network edge, before it reaches your origin — so attacks are absorbed away from the systems you care about and policy applies consistently.
- Reverse proxy
- A server that sits in front of your origin, terminating client connections and forwarding only the traffic that passes policy. A cloud WAF is delivered as a reverse proxy at the edge.
- Detect mode vs block mode
- Detect (or count) mode logs what a policy would block without affecting traffic; block mode enforces. The safe path is to run in detect first, review would-block events, then enforce.
- Anomaly scoring
- A CRS technique where rules contribute to a score and a request is actioned once it crosses a threshold, so blocking is deliberate and tunable rather than a single all-or-nothing rule.
- Bot defense
- Controls that distinguish automated traffic from humans and good bots — using challenges, reputation, and verified-crawler allowlists — to stop scraping, credential stuffing, and abuse.
- Proof-of-work challenge
- A self-hosted JavaScript challenge that makes a client do a small amount of computation. It raises the cost for automated clients and bars clients that do not execute the page — it is not a human CAPTCHA and not fingerprinting.
- Verified crawler
- A bot confirmed as legitimate (for example a search engine) by reverse-DNS plus forward-confirm, never by user-agent string alone, so a spoofed user agent cannot impersonate it.
- Rate limiting
- Bounding how many requests a client or identity can make in a window, enforced at the edge to contain spikes, scraping, brute force, and abuse.
- DDoS
- A distributed denial-of-service attack that overwhelms a target with traffic. Edge protection absorbs and sheds volumetric and application-layer floods using rate controls, reputation, and challenges.
- Zero trust
- A model that verifies every request before it reaches the origin, applying least privilege and never trusting a request based on network location alone.
- Non-Human Identity (NHI)
- The identity of a service, workload, automation, or AI agent — as opposed to a human user. Securing machine-to-machine and agent traffic depends on giving each non-human caller a scoped identity.
- mTLS
- Mutual TLS, where both client and server present certificates to authenticate each other — a common way to establish trust for machine-to-machine traffic.
- Key custody
- Where private key material is held. ArxLayer keeps custody behind a dedicated boundary so the enforcement layer never holds a private key — only opaque references travel the config bus.
- IP reputation
- A signal about how trustworthy an IP has been across traffic. Reputation can allow, greylist, or deny a client, and is computed privacy-preservingly from a hashed IP rather than a raw address.
- Credential stuffing & account takeover (ATO)
- Attacks that replay stolen username/password pairs against login endpoints to hijack accounts. Rate limits, challenges, reputation, and identity checks on auth paths raise the cost.
- Agent gateway
- A protection layer for AI-agent endpoints and tools: request-level enforcement, abuse controls, and identity-aware policy for agent-to-app traffic — not a model-safety layer.
Put the vocabulary to work
Start free and protect your first surface — web app, API, or AI agent.