Glossary — Static Shield Docs

The three pairs people mix up

If you read nothing else here, read these. Almost every support question traces back to one of them.

Serving Mode vs Shield posture: Serving Mode is how pages reach visitors — Fully Static, Static + Bridges, Hybrid. Shield posture is a broader summary that also accounts for Static-only serving and Timed Vault Access, and it is what vulnerability mitigation is calculated from. A site can be Hybrid (a modest serving mode) and still have a strong posture because its Vault is sealed.; Serving Mode answers "what do visitors get?". Posture answers "how reachable is WordPress?".
Serving Mode vs Access & Isolation: Two independent axes, not alternatives. Serving Mode controls page delivery; Access & Isolation controls who can reach wp-admin and the WordPress runtime at all. Any combination of the two is valid.
Feature mode vs classification: A feature mode applies to one feature of one plugin (Static, Shield Bridge, Blocked…). A classification — Full Static, Static + Bridge, Hybrid Supported, Partially Supported, Experimental — is the rollup of all that plugin's feature modes. See Feature modes.

Terms

Advisory: One published vulnerability report affecting a component. Often carries a CVE, but roughly one in five does not — a missing CVE means the identifier is absent, not that the issue is minor.
Attack surface: Which parts of your WordPress installation actually respond to a request from the public internet. Measured against live HTTP responses from outside, not inferred from configuration.
Bridge (Shield Bridge): A narrow, explicitly approved route that reaches WordPress for one specific purpose — a form submission, a comment, a scheduled job — while everything else stays static. Bridges are rate-limited.
Build: The process that crawls your published pages, renders each one, and writes the result as static files. A build produces a release; it does not, by itself, change what visitors are served — the webserver decides that.
Confidence: How sure an adapter is about its own classification of a plugin or feature. Not a measure of the plugin's quality. Low confidence marks the rows where a human judgement is worth making.
Coverage (static coverage): The share of discovered routes that rendered successfully in the last build. 100% means everything the crawler found was captured — not that every URL on your site is static, since a route never discovered was never counted.
CVSS score: The industry-standard 0–10 severity rating published with a vulnerability. It describes the flaw in the abstract, assuming the vulnerable code is reachable. See Shield posture & mitigation for how your site's own reachability is estimated alongside it.
Site DNA: A versioned fingerprint of your installation captured on every build: Code (plugin/theme versions), Content (post and page counts), Security (which modes are active, exposed endpoints), and Runtime (PHP and WordPress versions). Never includes post content, user data or settings.
Dynamic island: A small part of an otherwise static page that genuinely differs per visitor and is resolved in the browser rather than by a server request — a log-in/log-out link, for example.
Exposure state: Static Shield's verdict on whether a specific vulnerability's path is reachable on your site: Currently Isolated, Reduced, Partially Exposed or Exposed. Stronger evidence than posture inference, and used in preference to it when available.
Finding: One advisory matched against one component installed on one site. A finding has a state: Open, Acknowledged, Mitigated by Shield, Fixed by update, Removed component, No longer affected or Retracted. The last four are closed and are excluded from "open advisories" counts.
Fingerprint (site fingerprint): The passive signals that identify your site as WordPress and reveal its version — generator tags, discovery links, version query strings. Fingerprint Shield reduces these. It does not make WordPress undetectable.
Known exploited: The vulnerability is being actively used in real attacks, not merely published. Mitigation is hard-capped at 50% for these regardless of posture.
Lockdown: The strictest static-only serving state: every dynamic request is denied. Reversible from the command line — see Recovering access.
Static Shield Mitigation: An estimate of how much your site's posture reduces a vulnerability's practical reachability, shown as a level and a percentage. An estimate, never a recalculated CVSS, never a claim the flaw is fixed, and never 100%.
Shield posture: The single value summarising how this site currently serves and isolates WordPress — e.g. Timed Vault Access (sealed). Derived from Security DNA on each build, and the basis for every mitigation estimate.
Release: One complete set of static files produced by a build. A candidate release can be reviewed in Shield Preview before it goes live; publishing swaps it in.
Route: A URL path the crawler knows about — a page, post, archive, feed or endpoint. Routes are the unit builds and attack-surface scans are counted in.
Runtime tier: Which of the plugin's two bootstraps your server runs: modern (PHP 8.1+, namespaced classes, all features) or legacy safe mode (as far back as PHP 5.6, reduced feature set). Features built on the modern runtime — the Hybrid Compatibility Layer among them — are unavailable on the legacy tier, and the plugin says so rather than showing an empty screen.
Trusted locations: The addresses allowed to reach wp-login.php and wp-admin; everyone else is refused. The mildest of the three ways to restrict admin access. The list is kept in two places — locally in the plugin, and in your Tulapp account — and the two are added together, never replaced. See Trusted locations.
Timed Vault Access: No standing admin access at all, not even from your own address. Access is opened temporarily from Tulapp Cloud with a signed, time-boxed grant, and closes again on its own afterwards. The panel shows the window as open or closed.
Static-only serving: Default-deny for every request except static files, the Shield Bridge API, and your allowlisted admin path. Can block other plugins' AJAX, REST and webhook endpoints — that is the intent, and why it is externally verified rather than assumed.