The wiki · page 17 of 25

The reference desk for winning online.

Evergreen guides — kept current, backed by our own scan data, written in plain talk. Every article opens with the answer, not a preamble.

10 — E-commerce

What Is Shopify Checkout?

Shopify Checkout is the hosted, secure payment process every Shopify store uses to turn a shopping cart into a completed order. It collects the customer's contact, shipping, and payment details, calculates taxes and shipping, processes the payment, and creates the order, all on Shopify's PCI-compliant infrastructure. It includes Shop Pay, an accelerated one-tap checkout that remembers returning customers' details across Shopify stores. Because checkout is where sales are won or lost, Shopify heavily optimizes it for speed, mobile, and conversion rather than letting merchants build their own from scratch.

UPDATED 2026-07-10 · READ →

What Is Online Ordering?

Online ordering is letting customers browse your menu or products, build an order, and pay for it directly on your website or app, rather than by phone or in person. For a restaurant it means picking dishes, choosing pickup or delivery, and paying online; for retail it means adding items to a cart and checking out. The system captures the order, takes payment, and sends it to your kitchen or fulfillment team automatically. Done well, online ordering increases average order size, reduces phone errors, and captures sales around the clock without extra staff.

UPDATED 2026-07-10 · READ →

11 — Security & Compliance

What Is ADA Website Compliance?

ADA website compliance means making your website usable by people with disabilities, consistent with the Americans with Disabilities Act. The ADA itself never mentions websites, but the Department of Justice has long taken the position that business websites are covered, and courts largely agree. In practice, compliance means meeting WCAG 2.1 Level AA, the technical standard regulators and courts reference most, covering things like alt text, color contrast, keyboard access, and properly labeled forms.

UPDATED 2026-07-09 · READ →

Website Privacy Laws Explained: GDPR, CCPA and More

There is no single US privacy law for websites; instead, a growing patchwork of state laws applies based on whose data you collect. California's CCPA/CPRA leads, joined by comprehensive laws in Virginia, Colorado, Texas, and more than a dozen other states, most with revenue or volume thresholds that exempt very small businesses. Europe's GDPR applies only if you offer goods or services to people in the EU. Nearly every business site still needs an accurate privacy policy, because collecting form data and analytics triggers disclosure duties.

UPDATED 2026-07-09 · READ →

What Is a Web Application Firewall (WAF)?

A web application firewall (WAF) is a security layer that sits between your website and the internet, inspecting incoming traffic and blocking malicious requests before they reach your server. It filters out common web attacks such as SQL injection, cross-site scripting, and bad bots by applying rules that recognize dangerous patterns. Unlike a traditional network firewall, a WAF understands web traffic specifically, making it a frontline defense for sites, e-commerce stores, and web applications.

UPDATED 2026-07-09 · READ →

What Is DDoS Protection?

DDoS protection is a set of defenses that keep a website online during a distributed denial-of-service attack, where thousands of compromised devices flood a server with traffic to overwhelm it and knock it offline. Protection works by detecting the abnormal surge, filtering out malicious requests, and absorbing or rerouting the flood so legitimate visitors can still reach the site. It is typically delivered through cloud networks with enormous capacity that soak up attacks before they reach your server.

UPDATED 2026-07-09 · READ →

What Is Website Malware?

Website malware is malicious code injected into a website to harm visitors, steal data, hijack the site, or spread to other systems. It can redirect visitors to scam pages, skim credit card details at checkout, display spam, mine cryptocurrency, or add the site to a network of infected machines. Malware usually enters through outdated software, weak passwords, or vulnerable plugins, and an infected site can be blacklisted by Google, harming traffic and reputation until it is cleaned.

UPDATED 2026-07-09 · READ →

What Is Two-Factor Authentication (2FA)?

Two-factor authentication (2FA) is a security method that requires two separate forms of proof to log in: something you know, like a password, plus something you have, like a code from your phone. Even if an attacker steals your password, they cannot access the account without the second factor. 2FA dramatically reduces account takeovers and is one of the simplest, most effective protections for website admin panels, hosting accounts, email, and any system holding sensitive data.

UPDATED 2026-07-09 · READ →

What Is a Security Patch?

A security patch is a software update that fixes a specific vulnerability or flaw that attackers could exploit. When developers discover a weakness in a program, plugin, or operating system, they release a patch to close it. Applying patches promptly is critical because once a vulnerability is publicly known, attackers rush to exploit any system that has not updated. For websites, timely patching of the CMS, plugins, themes, and server software is one of the most important defenses against hacking and malware.

UPDATED 2026-07-09 · READ →

What Is a Vulnerability Scan?

A vulnerability scan is an automated check that examines a website, server, or network to find security weaknesses attackers could exploit, such as outdated software, misconfigurations, weak settings, or known flaws. The scanner compares what it finds against databases of known vulnerabilities and produces a report ranking the issues by severity. Regular scanning helps businesses discover and fix weaknesses before attackers find them, making it a core part of proactive website security and many compliance requirements.

UPDATED 2026-07-09 · READ →

What Is GDPR?

GDPR (General Data Protection Regulation) is a European Union privacy law that governs how organizations collect, use, and protect the personal data of people in the EU and UK. It applies to any business worldwide that handles EU or UK residents' data, including US companies with European visitors or customers. GDPR requires clear consent, transparency about data use, strong security, and respect for individual rights like access and deletion, with heavy fines for violations.

UPDATED 2026-07-09 · READ →

What Is CCPA?

CCPA (California Consumer Privacy Act) is a state privacy law giving California residents rights over the personal information businesses collect about them, including the right to know, delete, and opt out of the sale of their data. It applies to for-profit businesses that meet certain size or data thresholds and handle California residents' information, even if the business is based elsewhere. Strengthened by the CPRA, it is the most prominent US state privacy law and a model others follow.

UPDATED 2026-07-09 · READ →

What Is a Cookie Banner?

A cookie banner is a notice that appears when someone first visits a website, telling them the site uses cookies and, depending on the law, asking permission before non-essential cookies load. It typically offers Accept, Reject, and Manage Preferences options. Cookie banners exist to satisfy privacy laws like the EU's GDPR and California's CPRA, giving visitors transparency and control over tracking, analytics, and advertising technologies running in their browser.

UPDATED 2026-07-09 · READ →

What Is a Privacy Policy?

A privacy policy is a legal document on a website that explains what personal information the business collects, how it uses that data, who it shares the data with, and what rights visitors have over their information. It covers things like names, emails, payment details, cookies, and analytics. Privacy laws such as California's CCPA/CPRA and the EU's GDPR require most sites that collect any personal data to publish a clear, accurate privacy policy.

UPDATED 2026-07-09 · READ →

What Is a Terms of Service?

Terms of service is a legal agreement between a website or business and its users that sets the rules for using the site, product, or service. Also called terms and conditions or terms of use, it typically covers acceptable use, intellectual property, payment and refund terms, disclaimers, limitation of liability, and how disputes are resolved. Terms of service protect the business by defining responsibilities and limiting legal exposure when someone uses its website or buys its services.

UPDATED 2026-07-09 · READ →

What Is a Data Breach?

A data breach is a security incident in which sensitive, confidential, or protected information is accessed, stolen, or exposed by someone without authorization. On a website, that often means customer names, emails, passwords, or payment card data being taken by attackers or leaked through a misconfiguration. Data breaches can trigger legal notification duties, financial penalties, and lost trust. Every US state now has a breach-notification law requiring affected individuals to be told when their personal information is compromised.

UPDATED 2026-07-09 · READ →

What Is a Website Backup Strategy?

A website backup strategy is a documented plan for regularly copying a website's files and database, storing those copies safely, and being able to restore them quickly when something goes wrong. It defines how often backups run, where they are kept, how long they are retained, and how restoration is tested. A good strategy protects against hacks, server failures, botched updates, and human error, letting a business recover its site instead of rebuilding it from scratch.

UPDATED 2026-07-09 · READ →

What Is a CAPTCHA?

A CAPTCHA is a challenge on a website designed to tell humans and automated bots apart, usually by asking the visitor to do something easy for people but hard for machines, like identifying objects in images or checking a box. The name stands for Completely Automated Public Turing test to tell Computers and Humans Apart. Websites use CAPTCHAs to block spam form submissions, fake account signups, credential-stuffing attacks, and other automated abuse.

UPDATED 2026-07-09 · READ →

What Is SQL Injection?

SQL injection is a web security vulnerability where an attacker inserts malicious SQL code into a website's input fields, tricking the database into running commands it should not. If a site builds database queries by directly combining user input without proper handling, an attacker can read, modify, or delete data, bypass logins, or even take over the server. SQL injection is one of the oldest and most damaging web vulnerabilities, and it is almost entirely preventable with secure coding.

UPDATED 2026-07-09 · READ →

What Is Cross-Site Scripting (XSS)?

Cross-site scripting, or XSS, is a web security vulnerability that lets an attacker inject malicious scripts into a website, which then run in other visitors' browsers. Because the script appears to come from the trusted site, it can steal session cookies, capture keystrokes, redirect users, or deface pages. XSS happens when a site displays user-supplied input without properly sanitizing it. It is one of the most common web vulnerabilities and is prevented by validating input and encoding output.

UPDATED 2026-07-09 · READ →

What Is a Mixed Content Warning?

A mixed content warning appears when a secure HTTPS web page loads some resources, like images, scripts, or stylesheets, over insecure HTTP. Because part of the page travels unencrypted, the browser flags the page as not fully secure, showing a warning icon instead of the padlock, and often blocking the insecure elements. Mixed content undermines the protection of HTTPS and commonly appears after a site migrates to SSL but still references old HTTP URLs in its code.

UPDATED 2026-07-09 · READ →

What Is a Browser Cookie?

A browser cookie is a small text file that a website stores in your browser to remember information about you between page loads and visits. Cookies keep you logged in, hold shopping cart contents, remember preferences, and let sites and advertisers track behavior for analytics and marketing. They are sent back to the server with each request, giving the otherwise stateless web a memory. Cookies come in first-party and third-party forms and are regulated by privacy laws worldwide.

UPDATED 2026-07-09 · READ →

What Is OAuth?

OAuth is an open standard that lets you grant one app limited access to your data on another service without sharing your password. It is the technology behind 'Sign in with Google' and 'Connect to Facebook' buttons. Instead of handing over your login, you approve a specific permission — say, letting a design tool read your Google Drive files — and the service issues the app a temporary access token scoped to just that. You can revoke that access anytime, and your password is never exposed.

UPDATED 2026-07-10 · READ →

What Is a JWT (JSON Web Token)?

A JWT, or JSON Web Token, is a compact, self-contained token used to securely pass identity and permission information between systems. It packs data — such as who a user is and when the token expires — into a signed string of three parts separated by dots. Because the signature lets any server verify the token without a database lookup, JWTs enable stateless authentication: a user logs in once, receives a token, and includes it with each request to prove who they are.

UPDATED 2026-07-10 · READ →

What Is CORS?

CORS, or Cross-Origin Resource Sharing, is a browser security mechanism that controls whether a web page on one domain may request data from a different domain. By default, browsers block such cross-origin requests. CORS lets a server opt in by sending special HTTP headers that tell the browser which outside origins are allowed to read its responses. When you see a 'blocked by CORS policy' error, it usually means the server has not granted the calling website permission — a configuration issue, not a bug in your code.

UPDATED 2026-07-10 · READ →

What Is a HIPAA-Compliant Website?

A HIPAA-compliant website is a healthcare-related site built and operated to meet the U.S. Health Insurance Portability and Accountability Act's rules for protecting patient health information. If a site collects, stores, or transmits protected health information, PHI, such as appointment requests, intake forms, or patient messages, it must safeguard that data with encryption, access controls, audit logging, and signed agreements with vendors that handle it. HIPAA compliance is about how patient data is handled end to end, not a badge you buy. Getting it wrong can mean serious fines and lost patient trust.

UPDATED 2026-07-10 · READ →

What Is an SSL Connection Error?

An SSL connection error is a browser warning that appears when the secure, encrypted HTTPS link between a visitor and a website cannot be trusted, so the browser blocks or warns to protect the user. It typically stems from an expired or invalid SSL/TLS certificate, a name mismatch with the domain, an incomplete certificate chain, or a wrong system clock. Because browsers treat these warnings seriously, an SSL error can scare visitors away even when the site is fine. Fixing it means restoring a valid, correctly installed certificate.

UPDATED 2026-07-10 · READ →

What Is a Mixed Content Error?

A mixed content error occurs when a web page loaded securely over HTTPS also tries to load some of its resources, such as images, scripts, or stylesheets, over insecure HTTP. Because those insecure elements could be tampered with in transit, browsers either block them or downgrade the page's security indicator, removing the padlock and sometimes breaking features. It commonly appears after a site moves to HTTPS but still references old HTTP URLs. The fix is to update every resource link to HTTPS so the whole page loads securely.

UPDATED 2026-07-10 · READ →

12 — Email & Deliverability

What Is Email Deliverability?

Email deliverability is the ability of your emails to reach recipients' inboxes rather than being blocked, bounced, or filtered into spam folders. It is measured as the percentage of sent messages that actually land in the inbox, and it depends on your sender reputation, authentication setup, list quality, and content. Strong deliverability ensures appointment reminders, invoices, and marketing emails from your local business actually get seen, while poor deliverability quietly sends important messages to spam.

UPDATED 2026-07-09 · READ →

What Is Email Bounce Rate?

Email bounce rate is the percentage of emails you send that fail to be delivered and are returned by the recipient's mail server. It splits into hard bounces, permanent failures like invalid or nonexistent addresses, and soft bounces, temporary failures like a full mailbox or a server that is down. A high bounce rate signals list-quality problems, damages your sender reputation, and hurts overall deliverability, so keeping it low is essential for reaching inboxes.

UPDATED 2026-07-09 · READ →

Looking for news, case studies, and opinion pieces? That's the blog →