Plain-English reference

Glossary of terms & acronyms

Every acronym and piece of jargon used in this playbook, explained in one sentence. Anywhere you see an underlined termLike thisHover (or focus) an underlined term to read its definition without leaving the page. on the site, hover it for the same definition.

Network & architecture

Anycast: A networking trick where one IP address is announced from many locations at once, so each user is automatically routed to the nearest Cloudflare data center.
backbonealso: private backbone: Cloudflare's own private, high-speed links between data centers — faster and less congested than the public Internet.
CDNalso: Content Delivery Network: Content Delivery Network — a worldwide set of servers that keep copies of your content close to users so pages load faster.
DNS: Domain Name System — the Internet's phone book, translating a domain name (example.com) into a server address.
egressalso: egress fees, egress costs: Data leaving a provider's network. Many clouds charge “egress fees” for it; Cloudflare's R2 has none.
IP addressalso: IP: A numeric address that identifies a device or server on the Internet.
latency: The delay before data starts transferring — essentially how long a user waits. Lower is better.
multi-tenantalso: multitenant: One shared platform serving many customers at once, with strong isolation between them.
originalso: origin server, origin servers: Your own web server or host where your website actually lives. Cloudflare sits in front of it.
PoPalso: PoPs, Point of Presence, points of presence: Point of Presence — a physical Cloudflare data center location where our servers process traffic. More PoPs means we're closer to more users.
reverse proxy: A server that sits between visitors and your origin, forwarding requests and applying services (security, caching) on the way. Cloudflare is a reverse proxy.
the edgealso: edge: “The edge” means Cloudflare's servers spread across the world, close to your users — as opposed to one central data center.

Security

APIalso: APIs: Application Programming Interface — how software talks to other software, e.g. a mobile app calling a server.
botalso: bots, automated traffic: Automated software making requests instead of a human. Some bots are good (search engines); many are malicious.
bot score: Cloudflare's 1–99 rating of how likely a request came from a bot (1) versus a real human (99).
credential stuffing: Using stolen username/password lists to try to break into many accounts at once.
CSPalso: Content Security Policy: Content Security Policy — a browser rule set that controls which scripts and resources a page is allowed to load.
CVEalso: CVEs: Common Vulnerabilities and Exposures — a publicly catalogued security flaw, each with a unique ID.
DDoSalso: Distributed Denial of Service: Distributed Denial of Service — an attack that floods a site with junk traffic from many sources to knock it offline.
HSTS: HTTP Strict Transport Security — tells browsers to only ever connect to your site over secure HTTPS.
HTTPS: The secure, encrypted version of HTTP (normal web traffic).
L3/4also: L3/4 DDoS, network-layer, network layer: Layers 3 and 4 — the Internet's “plumbing” layers, where raw volumetric network floods happen.
L7also: Layer 7, application-layer, application layer: Layer 7 — the application (HTTP) layer, where smart, web-specific attacks happen.
Magecart: A style of attack that injects card-skimming JavaScript into checkout pages to steal payment details.
managed rulesetalso: managed rules, managed rulesets: A set of security rules that Cloudflare writes and keeps up to date for you, so you don't have to maintain them.
mTLSalso: Mutual TLS: Mutual TLS — both the client and the server present certificates to prove who they are; strong two-way authentication.
OpenAPIalso: OpenAPI schema: A standard file format that describes an API's structure, so tools can automatically validate requests against it.
OWASP: Open Worldwide Application Security Project — a nonprofit best known for its “Top 10” list of common web security risks.
OWASP Top 10: The industry-standard list of the ten most critical web-application security risks, published by the OWASP nonprofit.
PCI DSSalso: PCI DSS 4.0, PCI: Payment Card Industry Data Security Standard — the security rules everyone handling credit-card data must follow.
schemaalso: schema validation: A definition of exactly what a valid request looks like; validation rejects anything that doesn't match.
SQL injectionalso: SQLi: An attack that sneaks malicious database commands in through input fields to steal or damage data.
supply-chain attackalso: supply chain: Compromising a trusted third-party component (like a script) to attack everyone who uses it.
TLSalso: SSL, SSL/TLS, TLS/SSL: Transport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser.
virtual patching: Blocking exploitation of a known vulnerability with an edge rule before you've fixed the underlying code.
WAFalso: Web Application Firewall: Web Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.
XSSalso: cross-site scripting: Cross-Site Scripting — an attack that injects malicious scripts into web pages other people view.
Zero Trust: A security model that trusts no request by default and verifies every single one, regardless of where it comes from.

Performance & reliability

Always Online: A Cloudflare feature that serves a cached copy of your site if your origin server goes down.
Argoalso: Argo Smart Routing: Cloudflare's smart-routing product that sends traffic over the fastest paths on our private backbone.
cachealso: caching, cached: Storing copies of content so it can be served quickly without fetching or recomputing it every time.
cache hit ratio: The percentage of requests served straight from cache — higher means more work kept off your origin.
failover: Automatically switching to a backup server when the primary one fails.
geo-steeringalso: geo steering, geosteering: Routing each user to the closest or best-performing server based on their location.
health checkalso: health checks: An automatic test of whether a server is up and responding; unhealthy servers are taken out of rotation.
load balancingalso: load balancer, load balancers: Spreading incoming traffic across multiple servers so no single one gets overwhelmed.
origin offloadalso: offload: Reducing how much traffic reaches your origin by serving it from Cloudflare's cache/edge instead.
Tiered Cache: Organizing Cloudflare data centers into layers so fewer requests ever reach your origin.
TTL: Time To Live — how long cached content is kept before it's refreshed.

Platform

isolatealso: isolates, V8 isolate, V8 isolates: A lightweight, sandboxed mini-environment (from the V8 engine) that lets Workers start in milliseconds.
serverless: Running code without managing any servers — you deploy a function and the platform scales it automatically.
Workersalso: Cloudflare Workers: Cloudflare's serverless platform for running your code at the edge, close to users.