SEO and website audit glossary

An audit report or your agency keeps mentioning HSTS, LCP or DMARC? Each term is defined here in a sentence or two.

Terms are grouped by audit pillar, in report order, then listed alphabetically. Every report we deliver ends with a glossary like this one, covering only the terms that report uses.

When a term has its own guide, its name links there. You can also browse every guide, sorted by topic.

Security & encryption

CSP (Content Security Policy): A header that lists the sources a page may load scripts, styles and images from. A script from anywhere else does not run.
HSTS: A header that tells the browser to open the site over HTTPS only, for a set period, even when someone types the address without https.
HTTP security headers: Instructions the server sends with every page to tell the browser what to enforce or refuse. HSTS and CSP are two of them.
HTTPS and TLS: HTTPS is the encrypted version of the web’s protocol, used by every address that starts with https://. TLS is the encryption behind it, and it replaced SSL.
Mixed content: An image, script or stylesheet loaded over HTTP on a page served over HTTPS. Browsers block some of these files and may flag the page as not secure.
Secure, HttpOnly and SameSite cookies: Cookie attributes. Secure keeps the cookie to encrypted connections, HttpOnly hides it from page scripts, and SameSite limits whether it is sent with requests from other sites.
SSL/TLS certificate: A file that proves to the browser that the site really belongs to the domain name shown. It expires on a set date, and an expired certificate makes the browser show a warning instead of the page.

Performance

Blocking time: How long the page ignores clicks and taps because the browser is busy running JavaScript.
CLS (Cumulative Layout Shift): A measure of how much content moves unexpectedly while the page loads, like a button that jumps just as you tap it. Google rates it good up to 0.1 and poor above 0.25.
Core Web Vitals: The three metrics Google uses to judge page experience: LCP for loading, INP for responsiveness and CLS for visual stability.
INP (Interaction to Next Paint): The delay between a click, tap or key press and the page’s visible response. Google rates it good up to 200 milliseconds and poor above 500.
Lab data and field data: Lab data comes from testing the page on one machine under fixed, repeatable conditions. Field data reflects what real visitors experienced, and Google publishes it for sites with enough traffic.
LCP (Largest Contentful Paint): How long the largest visible element, often the main image or headline, takes to appear. Google rates it good up to 2.5 seconds and poor above 4.
TTFB (Time to First Byte): How long the server takes to send the first byte of the page. Everything else on screen waits for it.

SEO & search visibility

301 redirect: A permanent redirect from an old URL to a new one. Search engines eventually swap the old URL for the new one in their results.
404 error and soft 404: A 404 tells browsers and search engines that a page doesn’t exist. A soft 404 shows an empty page or an error message while telling search engines the page is fine.
Canonical tag: A tag that tells search engines which URL is the main one when several URLs serve the same content. Google treats it as a strong hint, not a command.
hreflang: Markup that tells search engines which pages are versions of the same page in other languages. Each version has to list all the others, and itself.
Indexing: When a search engine stores a page in its index. A page that isn’t indexed can’t show up in any result, however good it is.
JavaScript rendering: Building a page with a script in the browser after it loads. Not every crawler runs that script, and those that do may not run it right away.
robots.txt: A file at the root of a site that tells crawlers which parts they may visit. It does not stop a URL from appearing in search results.
Structured data: A description of a page’s content in a format machines can read, such as product, price, article or business details. Google uses it for some rich results.
Title tag and meta description: The clickable headline a search engine shows for a page, and the short summary that may appear under it. Google can rewrite either one if it doesn’t match the page well.
XML sitemap: A file that lists the URLs a site wants search engines to crawl. It helps them find pages but doesn’t guarantee those pages get indexed.

Accessibility

Accessibility statement: A page that states how accessible a site is, what still needs fixing and how to report a problem. It is mandatory for sites covered by the RGAA.
Alt text: A description of an image that screen readers read aloud and browsers display when the image fails to load. A decorative image gets an empty one.
Color contrast: The difference in brightness between text and its background. WCAG asks for a ratio of at least 4.5 to 1 for body text.
European Accessibility Act (EAA): An EU directive that, since June 28, 2025, requires many online services, including ecommerce, to be accessible. Microenterprises that provide services are exempt.
Focus indicator: A visible outline around the selected element when you navigate with a keyboard. Without it, you lose track of where you are on the page.
RGAA: France’s official method for checking that a website meets WCAG (Référentiel général d’amélioration de l’accessibilité). It applies to public bodies and some large companies.
Skip link: The first link on a page, letting users jump past the menu straight to the content. It mainly helps people who navigate with a keyboard.
WCAG: Web Content Accessibility Guidelines, the international web accessibility standard published by the W3C. Laws usually point to its A and AA levels.

Compliance & privacy

Consumer mediator: An out-of-court dispute resolution body that every business selling to consumers in France must appoint and name on its website.
Cookie consent: The permission a visitor gives before a site sets any tracker it doesn’t strictly need. In the EU, refusing has to be as easy as accepting, and no tracker may fire before the visitor answers.
GDPR: The EU General Data Protection Regulation, which governs how personal data is collected and used, including by websites. In France, the CNIL enforces it.
Legal notice (imprint): The information a business website must publish in France and other EU countries: who runs it, who hosts it and how to contact the publisher.
Session recording: A tool that replays a visitor’s journey on the site: mouse movements, clicks, scrolling, sometimes what they type.
Tracker: A cookie or script that stores or reads information in the browser, to measure traffic or target ads. A third-party tracker comes from a domain other than the site’s own.

Domain & network

CAA record: A DNS record that names the only certificate authorities allowed to issue certificates for the domain.
DKIM: A signature added to each outgoing email, which the receiving server checks against a key published in the domain’s DNS.
DMARC: A policy published in DNS that tells mailbox providers what to do with email that fails SPF and DKIM checks: let it through, send it to spam or reject it.
DNS: The internet’s directory, which turns a domain name into a server address. It also tells other servers where to deliver the domain’s email.
DNSSEC: Digital signatures on DNS answers. They let resolvers check that an answer really comes from the domain and wasn’t forged along the way.
Domain expiration: The date a domain registration ends if no one renews it. The site and email stop working, and after a grace period anyone can register the name.
Domain registrar: The company you register and renew a domain name with. It passes the domain’s settings, including DNSSEC, on to the registry.
SPF: A DNS record that lists the servers allowed to send email on the domain’s behalf.
WHOIS and RDAP: Public lookups that show a domain’s registrar and expiration date. RDAP is the successor to WHOIS.

Independence & resilience

CDN: Content Delivery Network: servers spread around the world that deliver a site’s files from a location close to each visitor.
CLOUD Act: A 2018 U.S. law that lets U.S. authorities demand data from a company under U.S. jurisdiction, even when that data is stored in Europe.
Data transfers outside the EU: Personal data sent to a country outside the European Union, for example when a page loads a tool hosted in the United States. The GDPR sets the conditions for it.
Single point of failure: A component whose failure alone takes the site down, because nothing can take over: a host or a DNS provider, for example.
Sovereign hosting: Hosting with a provider that answers only to EU law, not just a server that happens to sit in Europe.

Content & trust

AI crawlers: Bots that crawl the web to train a language model or answer its users’ questions, such as OpenAI’s GPTBot. A site can allow or block them in its robots.txt.
Answer engine: A service that answers a question with written text instead of a list of links, such as Google’s AI Overviews or ChatGPT.
E-E-A-T: Experience, Expertise, Authoritativeness and Trust: the criteria Google’s quality raters use to judge a page. Google says E-E-A-T is not a ranking factor in itself.
llms.txt: A text file at the root of a site that summarizes it and lists its main pages for language models. Google said in June 2026 that it doesn’t use it.
Placeholder text (lorem ipsum): Dummy text that holds the place of real copy while a site is being built. Left online, it shows visitors a page nobody finished.
Untranslated content: Text left in the original language on a translated version of a site, such as a button label or a whole paragraph.

User experience & reliability

Broken link: A link that leads to a page that’s gone or no longer responds.
Broken resource: An image, stylesheet or script a page asks for that the server doesn’t deliver. Visitors see an empty frame or a broken layout.
JavaScript error: A script on the page that stops on an error. Visitors don’t see the error itself, but a button, menu or form may stop working.
Responsive design: A layout that adapts to the screen width so the site stays readable and usable on a phone as well as a desktop.