GreenLight Glossary
Plain-language definitions of the terms GreenLight checks. Each entry says what it is, why it matters, and how to fix it. Run a scan, then click “Learn more” on any finding to land on the right entry here.
Want a fixing plan, not just definitions? The Learn guide walks the fixes tool by tool: Security, SEO, AI search, Monetization, Accessibility, Speed, Social, PWA, Local, Email.
Advice vs education (the YMYL line)
Standard: Google Search / E-E-A-T · YMYL disclaimer ↗
YMYL stands for “Your Money or Your Life”: pages about money, health, safety, or other big decisions. Google and ad networks hold these to a higher bar, because bad information can do real harm. The biggest trap is framing. A page that reads as personal advice (a flat verdict to load up on gold, or a promise of certain returns) is treated as high-risk; the same facts framed as education (“here’s how the gold-silver ratio works, and the factors to weigh”) are low-risk and ad-friendly. The fix is never to delete your expertise. It’s to teach the reader how to decide instead of telling them what to do, and to add a clear “not financial advice” disclaimer. Education is the framing these systems reward; a verdict is the one they reject.
HTTPS: the gaps people miss
Standard: Browser security / OWASP · HTTPS everywhere ↗
Having HTTPS is table stakes; the traps are the gaps around it. Without HSTS, a visitor’s very first request can still be silently downgraded to insecure HTTP before your redirect fires. A single piece of mixed content (one http:// image or script on an otherwise-secure page) quietly breaks the padlock. And if the bare http:// version doesn’t 301-redirect to https://, old links and bookmarks strand people on the insecure copy. Those are the three to actually check, not whether a certificate exists.
HSTS (Strict-Transport-Security)
Standard: OWASP Secure Headers · Strict-Transport-Security ↗
HSTS is a short instruction your site sends that tells browsers, "always use my secure version, never the insecure one." Without it, a visitor's very first request can be quietly downgraded to insecure HTTP before your redirect kicks in. You switch it on with a single response header. It is "sticky", browsers remember it for a long time, so only turn it on once your HTTPS is rock solid.
Content-Security-Policy (CSP)
Standard: OWASP Secure Headers · Content-Security-Policy ↗
A CSP is a rulebook your site hands the browser that says which scripts and resources are allowed to run. It is the main defense against cross-site scripting, where an attacker sneaks their code onto your page. Start it in "report-only" mode so it watches without breaking anything, tune it, then enforce. Allowing 'unsafe-inline' or 'unsafe-eval' weakens it: move inline scripts into files and use a nonce so you can drop those.
X-Content-Type-Options: nosniff
Standard: OWASP Secure Headers · X-Content-Type-Options ↗
This header stops the browser from "guessing" a file's type. Without it, a file you serve as plain text could be mis-read as a script and run. One header value, nosniff, switches the guessing off.
X-Frame-Options (clickjacking)
Standard: OWASP Secure Headers · X-Frame-Options / CSP frame-ancestors ↗
This stops another website from loading yours inside a hidden frame to trick your visitors into clicking things they cannot see, a trick called clickjacking. SAMEORIGIN allows only your own site to frame your pages.
Referrer-Policy
Standard: OWASP Secure Headers · Referrer-Policy ↗
This controls how much of your page's address is shared with another site when a visitor clicks a link away from you. strict-origin-when-cross-origin shares only your domain, not the full, possibly private, URL.
Permissions-Policy
Standard: OWASP Secure Headers · Permissions-Policy ↗
This is the switchboard for powerful browser features, camera, microphone, and location. Without it, anything embedded on your page (an ad, a widget, an iframe you do not control) can ask the browser for those features in your site's name. You turn them off with one header listing the features you do not use, for example Permissions-Policy: geolocation=(), camera=(), microphone=(). The empty parentheses mean "nobody, not even me", so allow only what you actually need.
Server / X-Powered-By disclosure
Standard: OWASP Secure Headers · Remove Server / X-Powered-By ↗
These headers can advertise the exact software and version your site runs (for example, "PHP 8.1.2"). That hands an attacker a shopping list of known bugs to try against you. Remove or blank them in your server or app config. A bare CDN name like "cloudflare" with no version is fine, that is reported on purpose.
HTTP to HTTPS redirect
Standard: Browser security · HTTP→HTTPS redirect ↗
Even with a secure site, the old insecure http:// address usually still works. A permanent (301) redirect automatically sends every http:// visitor and link to the secure https:// version, so no one is left stranded on the insecure one.
Mixed content
Standard: W3C Mixed Content · No insecure subresources ↗
Mixed content is when a secure (HTTPS) page loads a piece of itself, an image, script, or stylesheet, over insecure HTTP. Browsers block or warn on it, which can break the page and the padlock. The fix is to change those resource links to https:// (or protocol-relative //).
Secure / HttpOnly cookie flags
Standard: OWASP · Cookie Secure / HttpOnly / SameSite ↗
These are small flags on the cookies your site sets. Secure keeps a cookie off insecure connections. HttpOnly hides it from JavaScript, so a script bug cannot steal a logged-in session. SameSite limits when the cookie is sent from other sites. Set all three where you can.
Exposed sensitive files
Standard: OWASP · Sensitive file exposure ↗
Files like .env, .git, or database backups sometimes end up publicly downloadable by accident. They often contain passwords, API keys, or your source code, enough to fully compromise a site. Block public access to those paths in your server config, and treat any key that was exposed as already compromised, so rotate it.
Title tag
Standard: Google Search Essentials · Title links ↗
The title tag is the clickable headline that shows in Google results and the browser tab. It is one of the strongest ranking signals and the first thing a searcher reads, so make each page's title unique and about 50-60 characters (longer gets cut off).
Noindex
Standard: Google Search Essentials · Block indexing (noindex) ↗
A noindex tag tells Google "do not list this page in search." It is handy for thank-you or admin pages, but it is often left on by accident after a site goes live, which quietly hides real pages from search.
H1 heading
Standard: Google Search Essentials · Headings & structure ↗
The H1 is the main on-page heading. It tells Google and screen readers what the page is about. Use exactly one H1 per page, then H2 and H3 for sub-sections.
Meta description
Standard: Google Search Essentials · Snippets / meta description ↗
The short summary Google shows under your title in results. It does not directly change ranking, but a clear 140-160 character description gets more clicks. Leave it blank and Google writes its own, usually worse.
Alt text
Standard: WCAG 2.2 · SC 1.1.1 Non-text Content · Level A ↗
A short text description of an image, read aloud to blind visitors and shown if the image fails to load. It is the baseline of web accessibility and helps image search. Describe meaningful images; use empty alt (alt="") for purely decorative ones.
Canonical link
Standard: Google Search Essentials · Canonicalization ↗
A tag that tells search engines "this is the main version of this page." When the same content is reachable at several URLs, the canonical stops them from competing and splitting your ranking.
Mobile viewport
Standard: Google Search Essentials · Mobile-first indexing ↗
A small tag that tells phones to scale the page to the screen. Without it, your site shows zoomed-out and tiny on mobile, which hurts both visitors and Google's mobile-first ranking.
Page language
Standard: WCAG 2.2 · SC 3.1.1 Language of Page · Level A ↗
The lang attribute on the html tag (for example lang="en") tells browsers and screen readers what language the page is in, so they pronounce it correctly and search engines target the right region.
Thin content
Standard: Google Search Essentials · Helpful, reliable content ↗
Pages with very little original text. They rank poorly and can trip ad networks' "low value content" filters. Aim for substantive, genuinely useful content rather than a bare heading and an image.
Open Graph
Standard: Open Graph protocol · Required properties (og:title, og:type, og:image, og:url) ↗
The tags (og:title, og:image, og:description) that control how your link looks when shared on Facebook, LinkedIn, Slack, and messaging apps. Without them, a shared link shows a bare or wrong preview.
Structured data (JSON-LD)
Standard: Google Search / schema.org · Structured data ↗
A small block of machine-readable data that tells search engines and AI exactly what a page is (an article, a product, an FAQ, a business) instead of making them guess. It unlocks rich results like star ratings and FAQ drop-downs.
Time To First Byte (TTFB)
Standard: Core Web Vitals / web.dev · Time to First Byte (TTFB) ↗
How long the server takes to start sending the page after a request. A slow TTFB (over about 1.5 seconds) delays everything after it and drags down Core Web Vitals and ranking. Caching, lighter database queries, and a CDN all help.
Text compression
Standard: web.dev · Enable text compression ↗
Shrinking HTML, CSS, and JavaScript before sending them, using gzip or Brotli. It is a one-time server setting that can cut page weight by well over half, most noticeable on mobile.
Heavy HTML
Standard: web.dev · DOM size / payload ↗
A single page whose HTML is very large (over about 150KB) is slow to download and parse, delaying the first paint. Trim inline content, defer non-critical markup, and paginate very long pages.
Render-blocking scripts
Standard: web.dev · Eliminate render-blocking resources ↗
A normal <script> in the page head stops the browser from showing anything until it downloads and runs. Adding async or defer (or moving scripts to the end of the page) lets the page paint first.
Layout shift (CLS)
Standard: Core Web Vitals / web.dev · Cumulative Layout Shift (CLS) ↗
When images or ads load without reserved space, the page jumps as they appear and visitors mis-click. Setting an image's width and height (or a CSS aspect-ratio) reserves the space and stops the shift. CLS is one of the Core Web Vitals.
Lazy loading
Standard: web.dev · Lazy-load offscreen images ↗
Loading images only as the visitor scrolls near them, rather than all at once. Adding loading="lazy" to below-the-fold images frees bandwidth for what is actually on screen, speeding the first paint.
Accessible name
Standard: WCAG 2.2 · SC 4.1.2 Name, Role, Value · Level A ↗
The text a screen reader or voice control announces for a control. A button with only an icon and no text or aria-label is silent to those users. An aria-label gives it a name.
Form label
Standard: WCAG 2.2 · SC 1.3.1 Info and Relationships · Level A ↗
A visible label connected to an input so screen-reader users know what to type. Connect them with the for and id attributes (or wrap the input in the label). A placeholder alone is not a label.
Main landmark
Standard: WCAG 2.2 · SC 1.3.1 Info and Relationships · Level A ↗
The <main> element marks a page's primary content, letting screen-reader and keyboard users skip straight past the header and nav to the real content. Every page should have exactly one.
Descriptive link text
Standard: WCAG 2.2 · SC 2.4.4 Link Purpose (In Context) · Level A ↗
Link text should say where it goes. Screen-reader users often pull up a list of just the links, so "click here" and "read more" out of context tell them nothing. "See our pricing" does.
Pinch-to-zoom
Standard: WCAG 2.2 · SC 1.4.4 Resize Text · Level AA ↗
Some sites disable zoom with user-scalable=no in the viewport tag. That blocks low-vision visitors who rely on pinching to enlarge text. Remove the zoom block.
Color contrast
Standard: WCAG 2.2 · SC 1.4.3 Contrast (Minimum) · Level AA ↗
The difference in lightness between text and its background, measured as a ratio. WCAG AA wants at least 4.5:1 for normal text (3:1 for large text). Low-contrast text, like light gray on white, is hard to read for low-vision visitors and in bright sunlight. GreenLight computes the ratio straight from your CSS colors (theme variables included); text sitting over an image or gradient still benefits from a human look.
Twitter/X card
Standard: X (Twitter) Cards · twitter:card markup ↗
A tag that tells X how to show your link: a big image card instead of a plain line. It reuses your Open Graph title and image, so it is one extra line to add.
Share image (og:image)
Standard: Open Graph protocol · og:image (resolvable, sized) ↗
The single image platforms pull when your link is shared. You set it once with og:image and every platform reads the same tag. Size it 1200×630 (1.91:1): that is Facebook’s and LinkedIn’s recommendation, and it is what X (Twitter) shows for a summary_large_image card. Keep the logo and text centered, because X crops closer to 2:1, so the top and bottom can be trimmed. Minimum 600×315 or Facebook falls back to a small thumbnail; keep it under about 5 MB, PNG or JPG, on a public HTTPS URL.
This is not your logo. The favicon/logo (the browser-tab and install icon) is a separate, much smaller set: a 32×32 PNG or an SVG favicon, a 180×180 apple-touch-icon for iOS, and 192×192 + 512×512 icons for install (PWA). A 1200×630 share image and a 512×512 app icon are different files for different jobs.
llms.txt
Standard: llms.txt spec · /llms.txt file ↗
An emerging standard: a plain markdown file at your site root that lists your most important pages with a one-line summary of each, formatted for AI crawlers (ChatGPT, Perplexity) to read quickly. Think of it as a sitemap written for AI.
AI citation bots
Standard: robots.txt / AI crawlers · Allow AI citation bots ↗
The crawlers ChatGPT, Perplexity, and Google AI Overviews use to read and cite your pages (OAI-SearchBot, PerplexityBot, Google-Extended). If your robots.txt blocks them, you stay out of AI answers. Blocking training-only bots like GPTBot is a separate, reasonable choice.
Bingbot
Standard: Bing Webmaster · Allow bingbot ↗
Microsoft's crawler. Bing's index feeds Copilot and parts of ChatGPT and Perplexity, so if bingbot cannot crawl you, you are absent from the index those AI engines read. Allow it in robots.txt.
Bing Webmaster verification
Standard: Bing Webmaster · Site verification (msvalidate.01) ↗
Adding a verification tag proves you own the site so you can use Bing Webmaster Tools: submit sitemaps, watch indexing, and enable IndexNow. Since Bing feeds many AI engines, this is where AI visibility via Bing starts.
Organization schema (sameAs)
Standard: schema.org · Organization / sameAs ↗
JSON-LD that names your business and links its profiles (sameAs to your social and directory pages). It lets search engines and AI tie scattered mentions of you across the web to one clear identity.
FAQ schema (FAQPage)
Standard: schema.org · FAQPage ↗
Structured data that lists question-and-answer pairs in a machine-readable way. AI engines lift those answers directly into responses, so it is one of the highest-value ways to get cited.
Question-style headings
Standard: Google Search · Helpful, people-first content ↗
Sub-headings phrased as the questions people actually ask (and type into AI), like "How much does it cost?" instead of "Pricing." Matching the question makes your content easy for AI to quote.
Article interlinking
Standard: Google Search Essentials · Internal linking ↗
Linking your articles to other related articles on your site. A connected cluster of guides on a topic signals authority to search and AI; an article that links nowhere reads as a one-off.
HowTo schema
Structured data that marks up step-by-step content as an ordered list of steps. Google retired HowTo rich results in 2023, so it no longer changes your search appearance — but a big share of AI prompts are "how do I…", and HowTo still helps an engine reproduce your steps as a clean numbered answer. Worth it only on genuine step-by-step pages.
Affiliate disclosure
Standard: FTC Endorsement Guides · Material connection disclosure ↗
A clear, conspicuous note that you earn from affiliate links (a "material connection"). The FTC requires it — put it near your affiliate links or on a disclosure page, in plain language readers can't miss. Reviewers and readers both look for it as a trust signal.
rel="sponsored" on affiliate links
Standard: Google Search · Qualify outbound links ↗
An attribute that tells Google a link is paid or affiliate: <a href="..." rel="sponsored"> (or "nofollow"). Untagged paid links can trigger a link-spam action against your whole site, so qualify every affiliate or paid outbound link.
Privacy policy
Standard: Google AdSense Program Policies · Privacy policy required ↗
A page describing what data your site collects, how cookies and ads use it, and how to contact you. Ad networks require one, and a missing privacy policy is among the most common rejection reasons. Free generators can draft a starting point.
About & Contact pages
Standard: Google AdSense Program Policies · Site identity / About ↗
Ad-network reviewers look for an About page (who runs the site and why) and a Contact page (a form or email) as basic trust and identity signals. Add both and link them in your nav or footer.
ads.txt
Standard: Google AdSense / IAB ads.txt · ads.txt authorized sellers ↗
A small text file at your site root that authorizes who may sell your ad space. AdSense needs it to contain your real publisher id (pub-...). A missing file, or a "PENDING" placeholder, blocks ads from serving.
Google crawlability
Standard: Google AdSense Help · Give the AdSense crawler robots.txt access ↗
Ad networks can only approve pages Google can read. A site-wide Disallow: / in robots.txt for the catch-all (or Googlebot) group blocks the whole site from Google. A Disallow aimed only at AI-scraper bots is fine.
Author and E-E-A-T
Standard: Google Search Essentials · E-E-A-T / helpful content ↗
E-E-A-T is Google's shorthand for Experience, Expertise, Authoritativeness, and Trust. For articles, that starts with a named human author (a Person byline in schema plus an author page), not an anonymous Organization. It is a repeat rejection reason for money and health content.
Core Web Vitals (LCP, INP, CLS)
Google's three measured signals for how a page feels in use: LCP (how fast the main content appears), INP (how quickly the page responds when you tap or click), and CLS (how much the layout jumps around). They feed ranking, and they are scored on real visitors rather than a lab test, so the person on a mid-range phone and slow data is who counts. GreenLight can’t see those real-visitor scores; it flags the on-page signals that tend to move them.
Largest Contentful Paint (LCP)
The time until the biggest thing on screen, usually the hero image or headline block, has loaded. Aim for under 2.5 seconds. The usual culprits are a heavy hero image, a slow server (TTFB), or render-blocking CSS holding up the paint.
Interaction to Next Paint (INP)
How long the page takes to visibly respond after you tap, click, or type. It replaced FID in 2024 and is stricter. Heavy JavaScript that ties up the main thread is the usual cause; aim for under 200 milliseconds.
Render-blocking CSS
Standard: web.dev render-blocking resources · Eliminate render-blocking resources ↗
A stylesheet loaded normally in the head stops the browser from painting anything until it downloads. One big render-blocking stylesheet is among the most common reasons a page is slow to appear. The fix is to inline the little bit of CSS the top of the page needs and load the rest without blocking, with a preload swap or by splitting the file so each page ships only what it uses.
DOM size
Standard: web.dev DOM size · Avoid an excessive DOM size ↗
The number of HTML elements on a page. A very large DOM (Lighthouse warns above about 800 elements and flags it above 1,400) costs memory and makes every style and layout calculation slower, which shows up as jank when people scroll or tap. The usual cause is deep nesting of wrapper elements or a huge unpaginated list.
Third-party scripts
Standard: web.dev third-party · Reduce the impact of third-party code ↗
Code your page loads from someone else's domain: analytics, chat widgets, ad tags, fonts, embeds, a charting or auth library. Each one is a separate connection and runs on your main thread, so a handful of them is often the real reason a page feels slow. Load them with async or defer, only on the pages that need them, and drop any you no longer use.
robots.txt
A plain text file at your site root that tells crawlers where they may and may not go. The dangerous line is Disallow: /, which blocks everything. It is a request, not a lock: well-behaved bots obey it, it does not hide a page from people, and a noindex tag, not robots.txt, is what actually keeps a page out of results.
301 vs 302 redirect
Both send a visitor from one URL to another; the difference is what search engines do with it. A 301 is permanent and passes the old page's ranking to the new one. A 302 is temporary and leaves the ranking on the old URL. Using a 302 for a permanent move is a quiet way to strand your ranking on a dead page.
Crawl budget
Roughly how many pages a search engine will crawl on your site in a given window. It only matters at scale (thousands of pages), where junk URLs, endless filter combinations, and redirect chains waste it so your real pages get crawled less often. For a small site it is rarely the problem.
hreflang
A tag for sites that publish the same content in several languages or regions. It tells Google which version to show which audience, so your Spanish page does not outrank your English one for English searchers. Skip it entirely if you have one language; set up wrong, it does more harm than leaving it off.
Duplicate content
The same or near-identical text living at more than one URL, whether across your own pages or copied from elsewhere. Search engines pick one version to show and bury the rest, so you can outrank yourself by accident. A canonical tag resolves the within-site case; original writing handles the rest.
nofollow, sponsored, ugc
Values on a link's rel attribute that tell search engines how to treat it. nofollow means "do not pass my ranking through this link," sponsored marks a paid or affiliate link, and ugc marks user-generated links like comments. Paid links without one of these can earn a manual penalty.
Backlinks
Links from other websites to yours. They are still one of the strongest ranking signals, and they are how a brand-new site earns trust. A handful from real, relevant sites beats hundreds from low-quality directories, which can actively hurt.
Service worker
Standard: MDN PWA · Service workers ↗
A small script that runs in the background and lets a site work offline, load instantly on repeat visits, and be installable. It is the engine behind a PWA. Registration usually lives inside your JavaScript, which is why a page-only scan often cannot confirm it is active.
Web app manifest
Standard: W3C Web App Manifest · Manifest document ↗
A small JSON file (manifest.webmanifest) that gives your site an app name, icons, colors, and a start URL, so a phone or desktop can install it like an app. Missing the 192 and 512 pixel icons is the most common reason the install prompt never appears.
PWA (installable site)
A Progressive Web App is a normal website that can install to a home screen and run full-screen and offline, without an app store. It needs three pieces: HTTPS, a manifest, and a service worker. Miss one and it simply will not offer to install.
CDN (content delivery network)
A network of servers that keeps copies of your site close to visitors, so someone across the world loads it from a nearby city instead of your single origin server. It cuts TTFB and absorbs traffic spikes, and most also add free HTTPS and basic attack protection.
Modern image formats (WebP, AVIF)
Newer image formats that are far smaller than JPG or PNG at the same quality, often by half or more. Since images are usually the heaviest thing on a page, switching is one of the biggest speed wins available, and every current browser reads WebP.
Skip link
Standard: WCAG 2.2 · SC 2.4.1 Bypass Blocks · Level A ↗
A "Skip to main content" link, usually hidden until a keyboard user tabs to it, that jumps past the header and nav straight to the content. Without it, keyboard and screen-reader users tab through the same menu on every page before they reach anything new.
Visible focus
The outline that shows which element a keyboard user is currently on. Some sites strip it for looks (outline: none) without adding a replacement, which leaves keyboard users with no cursor and no idea where they are. Style the focus ring; do not delete it.
Reduced motion
A system setting some visitors turn on because animation makes them dizzy or ill. The prefers-reduced-motion media query lets your CSS honor it and cut the large animations for those users. Ignoring it can make a site genuinely unusable for them.
Breadcrumbs (BreadcrumbList)
The "Home / Section / Page" trail near the top of a page. Marked up with BreadcrumbList structured data, it can replace the bare URL in Google results with a readable path, and it helps both people and crawlers understand where a page sits.
AI Overviews
Google's AI-written answer that now sits above the normal blue links for many searches. When it answers the question outright, fewer people scroll, so being one of the few sources it cites can matter more than ranking first beneath it. What earns a citation is the same structured data, clear answers, and letting the AI bots in.
NAP (Name, Address, Phone)
Standard: Google Business Profile / Local SEO · Consistent NAP ↗
Your business Name, Address, and Phone — the core facts local search runs on. Google and customers both expect them to be easy to find and identical everywhere: your site, your Google Business Profile, and every directory listing. A missing or inconsistent NAP is the number-one local-SEO gap. Put it in the footer of every page and on a Contact page, keep one canonical phone number, and make the phone a tap-to-call link (<a href="tel:+15551234567">) so a visitor on a phone can call in one tap.
LocalBusiness schema
Standard: schema.org LocalBusiness · LocalBusiness ↗
A block of structured data that tells Google exactly who you are, where you are, and how to reach you — your name, address, phone, hours, and map location, in machine-readable form. It powers the map pack, the knowledge panel, and rich results. Add a LocalBusiness JSON-LD block with address, telephone, geo, and openingHoursSpecification. Publishing your hours also answers one of the most common local searches: “what time do they close?”
SPF (Sender Policy Framework)
Standard: RFC 7208 (SPF) · sender authorization ↗
A DNS record that lists which mail servers are allowed to send email for your domain. Without it — or if it ends in +all instead of -all / ~all — anyone can send email that looks like it came from you, the classic phishing setup. Publish a TXT record at your domain like v=spf1 include:your-mail-provider ~all (tighten to -all once you have confirmed every legitimate sender). SPF is one leg of the SPF + DKIM + DMARC trio.
DKIM (DomainKeys Identified Mail)
Standard: RFC 6376 (DKIM) · key record ↗
A cryptographic signature added to every email you send, so the receiving server can confirm the message really came from you and was not altered on the way. You switch it on in your email provider and publish the public key they give you in DNS, at selector._domainkey.yourdomain. DKIM is the second leg of SPF + DKIM + DMARC — together they decide whether your mail lands in the inbox or the spam folder.
DMARC
Standard: RFC 7489 (DMARC) · policy (p=) ↗
A DNS record that tells receiving servers what to do with email that fails SPF or DKIM, and sends you reports on who is trying to send as you. Without it — or at the monitor-only policy p=none — spoofed email in your name still reaches inboxes. Publish a TXT record at _dmarc.yourdomain like v=DMARC1; p=quarantine; rua=mailto:you@yourdomain. Start at p=none to watch the reports, then move to p=quarantine, then p=reject.