WordPress glossary

The words WordPress uses, each explained in a sentence or two, with where you meet it and what to do about it.

301 redirect: A 301 redirect is a server's answer that an address has moved for good, with the new address attached. Browsers go there by themselves, and Google shows the new address in its results. Use one whenever a page's address changes permanently.
Action Scheduler: Action Scheduler is the background job queue that ships inside WooCommerce and other plugins. It runs tasks such as subscription payments, webhooks and emails later, in batches, and logs each one. When its queue stops moving, those jobs wait.
Application password: An application password lets a program reach a WordPress site as one user, through the REST API or XML-RPC, without that user's main password. It does not work on the login screen. Each one is made and revoked on the user's profile, and the feature needs HTTPS.
Backdoor: A backdoor is a way back into a site that an attacker leaves behind, so that they can return without the login and without the hole they first used. It is why a WordPress site that was cleaned gets infected again.
Block theme: A block theme is a WordPress theme built entirely from blocks, so the header, the footer and the layout of every page are edited on screen in the Site Editor. A classic theme builds them in PHP files and is set up in the Customizer.
Brute force attack: A brute force attack is a program trying one username and password after another until one works. On WordPress it is aimed at wp-login.php and xmlrpc.php. Failed attempts in a log are not a break-in, but enough of them can slow a site down.
Canonical URL: A canonical URL is the one address chosen to stand for a page that can be reached at several. WordPress names it in a rel="canonical" link on single posts and pages. Search engines treat that link as a hint and may choose another address.
CDN (content delivery network): A CDN is a network of servers in many places that keeps copies of a site's files and answers each visitor from a server near them. On a WordPress site it mostly serves images, stylesheets and scripts. It does not make a slow server build pages any faster.
Checksum: A checksum is a short string worked out from a file's contents. If the file changes, so does the string. WordPress.org publishes one for every file in WordPress and in its plugins, so a site's files can be compared with the originals.
Child theme: A child theme is a small theme that takes its design and features from another theme, its parent, and holds only your changes to it. The parent can then be updated without those changes being lost.
Core Web Vitals: Core Web Vitals are three measurements Google defines for how a page feels to a visitor: how soon the main content appears, how fast the page reacts, and whether the layout stays still. They are taken from real visits in Chrome, not from a test.
Database table prefix: The table prefix is the few characters at the start of every WordPress database table's name, wp_ unless it was changed at setup. It is set in wp-config.php and it is also written inside the database, which is why changing it by hand locks administrators out.
debug.log: debug.log is the file where WordPress records PHP errors, warnings and notices while its debug log is switched on. It is the first place to look when a page is blank or shows a critical error, and by default anyone who knows its address can read it.
DNS propagation: DNS propagation is the wait after a DNS record changes, while resolvers around the world still hold the old answer in their caches. Nothing is sent out. Each cached copy lasts until its TTL runs out, so the TTL decides how long the wait is.
Heartbeat API: The Heartbeat API is a script in the WordPress dashboard that checks in with the server on a timer. WordPress uses it to keep post locks, carry autosaves and notice an expired login. Each check-in is a request to admin-ajax.php, which is why it shows up in load problems.
.htaccess: .htaccess is a settings file the Apache web server reads from a website's own folder each time a page is requested. WordPress writes its permalink rules there. One line the server cannot read takes every page of the site down.
Lazy loading: Lazy loading means the browser fetches an image or an embed only when the visitor scrolls near it, not when the page opens. WordPress does it by itself, for images since 5.5 and for iframes since 5.7. It must never apply to the main image at the top of a page.
Malware: Malware is software written to do harm. On a WordPress site it is code someone planted to send visitors elsewhere, publish spam pages, take what people type or keep a way back in. A warning or a scan result is a reason to check, not proof either way.
Minification: Minification rewrites a CSS or JavaScript file without the comments, spaces and long names a browser does not need, so the same code downloads smaller. It is not compression and it is not combining files. WordPress already ships its own files minified.
Must-use plugin (mu-plugin): A must-use plugin is a PHP file in wp-content/mu-plugins that WordPress runs on every request. It is always on, cannot be deactivated from the dashboard and gets no update notices, so it is the plugin most easily overlooked.
Nonce: A WordPress nonce is a short token in a form or a link that shows the request came from a page WordPress built for you. Despite the name, it is not used once. It lasts between 12 and 24 hours, and when one fails you see "The link you followed has expired."
Object cache: WordPress's object cache keeps data it has read from the database, so the same data is not fetched twice. By default it lasts for one request. A persistent object cache keeps it between requests, which speeds up the pages a page cache cannot hold.
OPcache: OPcache is the part of PHP that keeps the compiled form of each PHP file in memory, so the server does not read and compile WordPress's code on every request. Your host switches it on and sets its size. WordPress reports on it in Site Health.
Page cache: A page cache keeps the finished HTML of a page and hands that copy to the next visitor, so WordPress does not build the page again. It is the biggest single speed gain on most sites, and it must leave out every page built for one person.
Permalink: A permalink is the full, permanent address of a post, page or archive on a WordPress site. One setting decides the pattern every post's address follows, and changing that pattern changes the address of every post at once.
PHP memory limit: The PHP memory limit is the most memory one request to a site may use before PHP stops it. WordPress asks for 40 MB on ordinary pages and 256 MB in the dashboard unless you set otherwise, and it can only raise the limit as far as the host allows.
Post revisions: A revision is a stored copy of a post or page as it was at an earlier save. WordPress records one for each saved draft or published update, keeps every one by default, and lets you compare and restore them. An autosave is a separate, single copy per user.
Render-blocking resources: A render-blocking resource is a stylesheet or a script the browser must download and process before it draws the page. Until that is done the visitor sees a blank screen. On WordPress they are the CSS and JavaScript files that themes and plugins load in the head.
REST API: The WordPress REST API lets programs read and change a site by exchanging JSON with addresses under /wp-json/. The block editor is built on it. When a firewall, a plugin or a missing rewrite rule blocks it, saving and publishing fail.
Salts and security keys: WordPress salts and security keys are eight long random strings in wp-config.php. WordPress uses them to make the login cookies and form tokens it hands out. Replace them and everyone who is logged in has to log in again.
Shortcode: A shortcode is a short tag in square brackets, such as [gallery], that WordPress replaces with content when it shows the page. The plugin that defines the tag supplies the content, so when that plugin is gone the page shows the bracketed text instead.
Slug: A slug is the part of a web address that names one post, page, category or tag. WordPress makes it from the title, in lowercase with hyphens for spaces. You can change it, and changing it changes the page's address.
SSL certificate: An SSL certificate is a file on your web server that lets browsers open an encrypted https connection and check that they reached your domain. The protocol is now called TLS, and the name SSL stayed. It proves control of a domain, not who runs the site.
Staging site: A staging site is a private copy of a live website at its own address, where updates and changes are tried before visitors see them. It helps only if the copy is kept quiet. It must not email customers, take real payments or be open to search engines.
Transient: A transient is a piece of data that WordPress or a plugin stores under a name for a limited time, so it does not have to be worked out again. Without a persistent object cache, transients are rows in the options table. With one, they live in the cache.
TTFB (Time to First Byte): TTFB, Time to First Byte, is how long a browser waits between starting to load a page and receiving the first byte of the answer. Nothing else on the page can begin until then, so a slow first byte holds back every later figure.
Two-factor authentication (2FA): Two-factor authentication asks for a second proof after the password, usually a code from an app on your phone. WordPress does not include it, so a plugin adds it. A recovery code is a spare that works once, for the day the phone is not there.
Web application firewall (WAF): A web application firewall reads each request sent to a website and refuses the ones that match its rules for known attacks. It can run inside WordPress as a plugin, on the web server, or in front of the site. Where it sits decides what it can stop.
wp-config.php: wp-config.php is the file that holds a WordPress site's own settings, starting with the database name, user and password. WordPress reads it at the start of every request, so one wrong character in it can take the whole site down.
WP-Cron: WP-Cron is WordPress's scheduler. It publishes scheduled posts, checks for updates and runs plugins' timed jobs. It has no clock of its own. Page loads start it, so on a quiet site, or one that cannot reach itself, tasks run late or not at all.
XML-RPC: XML-RPC is an older way for outside programs to work with a WordPress site, through the file xmlrpc.php. Jetpack and the mobile apps still use it. Its calls that need a login carry a username and password, which makes the file a target for password guessing.