Plain-English glossary
What your website runs on — explained simply.
Use these definitions to work out what you own, where it lives, what it costs and what you can safely clean up.
Website building blocks
- Website
One website or app you keep track of here, together with every service it uses.
- Service
Anything your website relies on that another company runs for you — your domain, hosting, database, email sender and so on.
Most services charge monthly or yearly. Free ones still matter: they hold your data and logins.
- Provider
The company that runs a service for you — for example GoDaddy for a domain or Vercel for hosting.
- Domain
Your website’s name, like mycoolstartup.com. You rent it year by year from a domain registrar.
If a domain isn’t renewed, it expires and — after a short grace period — anyone can buy it.
- Domain registrar
The company you buy (rent) your website name from — e.g. Namecheap, Cloudflare, Porkbun or GoDaddy.
Common providers Namecheap · Cloudflare · Porkbun · GoDaddy
Billing hazard Registrars often bundle high-margin add-ons like “Domain Privacy” (which should be free) or premium email trials that auto-renew into paid plans.
- DNS (the traffic controller)
The internet’s address book: it tells a browser which computer to visit when someone types your domain.
DNS is usually run by your registrar, unless you moved it — often to Cloudflare.
Common providers Cloudflare · Route 53 (AWS) · Your domain registrar
- Nameservers
A setting on your domain that says which company runs its DNS. For example, ns1.hover.com means Hover is in charge of your traffic settings.
- SSL/TLS certificate (the padlock)
What makes your site load with https:// and a padlock. Standard certificates are free and usually added automatically by your host.
Common providers Let’s Encrypt (free) · ZeroSSL · Cloudflare
Billing hazard Never pay for a standard SSL certificate. Let’s Encrypt is free, and Cloudflare, Vercel, Netlify and Squarespace add certificates automatically.
- HTTPS
The secure version of a web address. Visitors’ data is scrambled on its way to your site, and browsers warn people away from sites without it.
- Website hosting
The company that stores your website and shows it to visitors — like Vercel, Netlify, Squarespace or Shopify.
Common providers Vercel · Netlify · Cloudflare Pages · GitHub Pages
- Server (backend / VPS)
A computer in the cloud that runs your app’s behind-the-scenes work all day — sending reminders, processing uploads, running reports.
Many simple websites don’t need one: their hosting does everything.
Common providers Hetzner · DigitalOcean · Linode (Akamai) · AWS EC2 · Render · Railway
- Database
The filing cabinet where your app keeps its users, accounts and everything they save.
Postgres (PostgreSQL), MySQL and MongoDB are popular types. Companies such as Supabase, Neon and DigitalOcean run them for you.
Common providers Supabase · Neon · PlanetScale · MongoDB Atlas
Billing hazard Database companies often charge a flat minimum ($5–$25 a month) even when nobody uses the app.
- Postgres (PostgreSQL)
A popular, free type of database. “Production Postgres” just means the live database your real users depend on.
- File storage (bucket)
Online storage for files people upload — photos, PDFs, videos. Each storage area is called a “bucket”.
Common providers AWS S3 · Cloudflare R2 · Backblaze B2 · Supabase Storage
- Automatic emails
Services that send your app’s automatic emails — password resets, receipts, welcome emails — so they reach the inbox, not spam.
Common providers Resend · Postmark · SendGrid · Mailgun
- Newsletter / marketing email
A tool that keeps your mailing list and sends the emails you choose to send to it — newsletters, offers and announcements.
The subscriber list is personal data. Laws such as GDPR, CAN-SPAM and CASL expect a working unsubscribe link in every email, and many places (the EU, the UK, Canada and Australia, for example) also expect people to agree before you email them. SlopDox gives compliance assistance only, not legal advice.
Common providers Mailchimp · Klaviyo · MailerLite · Kit · beehiiv · Brevo
- SPF & DKIM records
Settings in your DNS that prove emails really come from you, so they don’t land in spam.
- Login service (auth provider)
A ready-made sign-in system for your site: log in, sign up, reset password and two-factor codes. Examples: Clerk, Auth0.
Common providers Clerk · Auth0 · Kinde · Supabase Auth
- Payment gateway
The company that takes card payments for you and pays the money into your bank account — like Stripe.
Common providers Stripe · Lemon Squeezy · Paddle
- Code repository
The online home of your website’s code (on GitHub or GitLab). It keeps every version — and a buyer will need it.
- API key / secret key
A password that lets one service talk to another automatically. Treat it like a bank PIN: never paste it into emails, chats or documents.
SlopDox records where a key is kept, never the key itself.
Common providers GitHub · Your hosting dashboard · Your password manager
- Developer tool or licence
Paid software used to build or manage the site, like a database viewer. Licences usually belong to a person, not the website.
Common providers Supabase dashboard · DBeaver · TablePlus · Beekeeper Studio
- Two-factor authentication (2FA)
A second check when you log in — usually a code from your phone. It stops most account takeovers. Turn it on for every provider.
- As-built map
A diagram of how your services connect — from the address people type, to the website, to the data and services behind it.
Arrows show what depends on what. A red dot marks a service that holds personal data.
Bills and renewals
- Charge
One thing you pay for on a service — a plan, a seat, an add-on or a trial. A service can have several.
- Billing cycle
How often you’re charged: monthly, yearly, every few months, or just once.
- ≈ Monthly cost
What a charge works out to per month, so different bills can be compared. A $120 yearly charge is about $10 a month.
- Monthly run-rate
What all your services cost per month, added together (yearly charges are divided by 12).
- Auto-renew
The provider charges your card automatically when the period ends. Great for things you need, like your domain — but it’s also how forgotten trials and add-ons keep costing you.
- Renew by hand
Auto-renew is off, so the service stops at the end of the period unless you pay. For a domain, that can take your whole site offline.
- Trial converts
A free trial that turns into a paid plan on a set date unless you cancel it first.
- Card expires first
The card that pays this bill expires before the bill is due. When the company tries to charge it, the payment will fail — and the service can be suspended.
Example Your Amex ending 1004 expires 31 Oct, but the Clerk bill is due 3 Nov. Fix: put a valid card on your Clerk account before 3 Nov, then update it here.
- Payment method
The card or account that pays a bill. SlopDox only stores a nickname and the last four digits — never the card number.
- Personal card
A bill paid with your own card rather than a business one. Fine for a hobby, but messy for bookkeeping and tax — and it must be swapped before you sell the site.
- Add-on
An extra paid feature on top of a main plan — like domain privacy or premium DNS. Easy to forget and often unnecessary.
- Usage-based estimate (~)
The amount changes month to month with usage — like cloud storage — so the ledger records a typical figure.
- Free tier
A free plan that many providers offer for small websites, with usage limits.
- Clean-up scan
SlopDox checks your bills for common money leaks — paid SSL, privacy add-ons, double domain fees, two tools doing one job, monthly plans that cost less yearly, idle databases — and shows step by step how to fix each one.
- Spending report
Every charge between two dates, with totals by category and by card — ready to print for your accountant or tax return.
Amounts come from your billing schedules. Always check them against receipts or bank statements.
Clean-up and risk findings
- Paying for SSL
Standard SSL certificates are free (Let’s Encrypt), and hosts like Cloudflare, Vercel, Netlify and Squarespace add them automatically. Paying for one is usually wasted money.
- Domain (WHOIS) privacy
Hides your name, address and phone number from the public records of who owns a domain. Many registrars include it free; some charge for it.
- Double domain cost
Paying two companies for the same website name — for example a registrar and a website builder.
- Unused DNS add-on
You pay your registrar for premium DNS, but your domain’s traffic is handled by another company — so the add-on isn’t being used.
- Paying for a dormant site
The website is marked dormant but still pays for always-on services such as a database or server.
- Introductory price
A low price for the first term only. At renewal the provider charges its regular price, often two or three times as much — common with web hosting and domains.
- Two tools, one job
Paying two services that do the same thing — often because the old one kept billing after a move to a new one.
- Yearly billing
Many services charge less per month if you pay (or commit) for a year at a time. Worth it for anything you’ll keep all year.
- Lapsed
The renewal date passed with auto-renew off, so the service has probably stopped.
- Missing renewal date
Without a renewal date, SlopDox can’t warn you before the charge.
- Domain expiry
The day a domain registration ends. After a short grace period, anyone can register the name — including your competitors.
- Personal login
The account is registered to a personal email (like Gmail). If that inbox is lost, so is the account. Use a business address such as ops@yourdomain.
- Backup / snapshot
A saved copy of your data at a moment in time, so you can restore it later. Always take one before deleting anything.
Buying and selling a website
- Website status
Where a website is in its life: thinking of buying, building or launching soon, live, dormant, for sale, sold, or didn’t buy.
Your plan counts the websites you’re looking after right now. Sold sites and sites you decided not to buy are archived: kept for your records, never counted.
- Due diligence (thinking of buying)
You’re researching a website before buying it. Its costs show as projected — not counted in your spending or alerts — and you get a before-you-buy checklist.
- Building or launching soon
Not open to visitors yet, including a site you are about to launch. Costs count, and the clean-up scan watches for trials and add-ons.
- Live
Real people use the site. Everything is tracked and renewal alerts are on.
- Dormant
Still online but you’ve stopped working on it. The clean-up scan suggests shutting down paid tiers you no longer need.
- For sale
You’re preparing to sell. The handover dossier and migration plan come to the front.
- Sold / handed over
The site belongs to someone else now. It’s kept for your records and tax, but left out of your spending totals and alerts — and it doesn’t count towards your plan.
- Didn’t buy
You researched this site but decided not to buy it. Your notes and the seller’s figures are kept for reference, and it doesn’t count towards your plan.
- Due diligence
Checking everything about a website before you buy it — real running costs, who owns each account, what data it holds, and hidden risks.
- Handover dossier
A print-ready document for selling a website: every service, a map, a step-by-step transfer plan and safety warnings.
- Escrow
A neutral company holds the buyer’s money until both sides confirm the handover is complete. It protects buyer and seller.
- Rotating keys
Replacing a secret key with a new one and switching off the old one, so anyone who had the old key is locked out.
Personal data and security
- Personal data
Any information about an identifiable person — names, emails, addresses, health notes, photos. Privacy laws control how you collect, store and protect it.
If a service holds personal data, you’re responsible for keeping it safe even though another company runs it.
- Sensitive data
Extra-protected personal data such as health, ethnicity, religion, sexuality or biometrics. Stricter rules and bigger penalties apply.
- Encryption at rest
Stored data is scrambled so it’s unreadable if a disk or backup is stolen. Most modern providers switch it on by default — check, and record it here.
- Data location (region)
The country where a provider stores your data. Some privacy laws limit sending personal data overseas.
- Publicly accessible
Anyone on the internet could reach it. For files and databases holding personal data, this should almost always be “No”.
- Processor and DPA
A company that handles personal data for you (your host, database, email sender) is a “processor”. Privacy laws expect a contract with each — usually called a DPA.
- Data breach
Personal data lost, stolen or seen by someone who shouldn’t see it. Many laws require you to report serious breaches within days.
Laws and regulations
- Compliance notice
A plain-English heads-up about a law that may apply to your website: what it means, what to do, and where the law says it. SlopDox gives compliance assistance only — general information, not legal advice.
Notices come from your answers about the website. You can also tick any law to review yourself — for example the EU AI Act because some clients are in the EU.
- GDPR (European Union)
Europe’s privacy law. It applies if you handle personal data of people in the EU — even if your business is elsewhere.
- UK GDPR
The United Kingdom’s version of GDPR, enforced by the ICO.
- Australian Privacy Act
Australia’s main privacy law, built around 13 Australian Privacy Principles. Health businesses are covered whatever their size.
- Aged Care Act 2024 (Australia)
Australia’s law for aged-care providers, in force since 1 November 2025 — including duties to keep records and protect residents’ information.
- HIPAA (United States)
US law protecting health information handled by healthcare providers, insurers and the companies that serve them.
- CCPA/CPRA (California)
California’s privacy law: residents can see, delete and correct their data and stop it being sold.
- PCI DSS
The card industry’s security rules for anyone who handles card numbers. Using a hosted checkout (like Stripe Checkout) keeps most of it off your plate.
- FTC Safeguards Rule (GLBA)
US rules requiring financial businesses — including many fintech apps — to protect customer information.
- DORA (European Union)
EU rules on the technology resilience of financial firms, including keeping a register of tech suppliers.
- COPPA (United States)
US law requiring parental consent before collecting personal information from children under 13.
- EU AI Act
Europe’s law on artificial intelligence. If your site uses AI — chatbots, AI-written content or automated decisions — some duties may apply.
Its transparency duties — telling people when they’re talking to an AI, and labelling realistic AI-made content — apply from 2 August 2026. Rules for high-risk uses such as hiring or credit decisions apply from 2 December 2027. For questions about what it means for your business, see the GlassBots Q&A; its AI Assistant keeps up to date with the Act.
Companies you might use
- Clerk
A login service: it runs the sign-in, sign-up and password-reset screens for websites and apps.
- Auth0
A login service (owned by Okta) for adding sign-in to websites and apps.
- Kinde
A login service for adding sign-in and user accounts to apps.
- Supabase
Runs a Postgres database for you, plus file storage and logins. Has a free tier and paid plans.
- Neon
Runs Postgres databases in the cloud, with a free tier for small websites.
- PlanetScale
Runs cloud databases for apps.
- MongoDB Atlas
Runs MongoDB databases in the cloud.
- Vercel
Website hosting, popular for modern web apps. Free for hobby sites; paid plans for teams and commercial use.
- Netlify
Website hosting with free SSL and a generous free plan.
- Cloudflare
Runs DNS, security and free SSL for millions of websites. Also sells domains at cost and offers file storage (R2).
- Namecheap
A domain registrar — where you buy website names. Also sells hosting, email and add-ons.
- GoDaddy
A large domain registrar and website company. Often sells add-ons such as privacy, email and SSL certificates.
- Porkbun
A low-cost domain registrar that includes domain privacy and SSL for free.
- Squarespace
A website builder that hosts your site. It also sells domains (it took over Google Domains).
- Shopify
An online-store platform: hosting, checkout and card payments in one monthly plan.
- Railway
A cloud platform for running app servers, background jobs and databases. Billed by usage.
- Render
A cloud platform for websites, app servers and databases.
- DigitalOcean
A cloud provider for servers (“Droplets”) and managed databases, billed monthly or hourly.
- Hetzner
A German cloud provider known for low-cost servers.
- Amazon Web Services (AWS)
Amazon’s cloud platform: servers, file storage (S3), databases and domains (Route 53).
- Backblaze B2
Low-cost cloud file storage.
- GitHub
Where developers keep website code. Private repositories are free.
- GitLab
A place to keep website code, similar to GitHub.
- Resend
Sends your app’s automatic emails — password resets, receipts, notifications.
- Postmark
Sends your app’s automatic emails, known for reliable inbox delivery.
- SendGrid
Sends automatic and marketing emails (owned by Twilio).
- Mailgun
Sends automatic emails for apps.
- Klaviyo
Email and SMS marketing for online stores — newsletters and abandoned-cart emails. Priced by number of contacts.
- Mailchimp
A newsletter and email-marketing tool (owned by Intuit). Priced by the number of contacts on your list.
- MailerLite
A low-cost newsletter and email-marketing tool, with a free plan for small lists.
- Kit (formerly ConvertKit)
A newsletter tool popular with creators. It was called ConvertKit until 2024.
- beehiiv
A newsletter platform for writing, sending and growing a newsletter, with optional paid subscriptions.
- Brevo (formerly Sendinblue)
Sends newsletters and marketing campaigns, and can also send your site’s automatic emails.
- Stripe
Takes card payments online and pays them into your bank. Charges a fee per payment rather than a monthly price.
- Paddle
Sells software for you as the “merchant of record”, handling payments and sales tax.
- Lemon Squeezy
Sells digital products for you as the “merchant of record”, handling payments and sales tax.
- TablePlus
An app developers use to look inside databases. Sold as a one-off personal licence.
Infrastructure clean-up checklist
Looking at a card statement and not sure what you’re paying for? Check these first — SlopDox’s clean-up scan checks them automatically and shows you how to fix each one.
- Double domain costs. Check whether you bought a domain at one registrar (e.g. GoDaddy) but also pay a website builder (Squarespace, Wix) a second fee for the same name.
- Paid SSL add-ons. Cancel any recurring item labelled “SSL Certificate” or “Web Security Bundle”. Cloudflare, Vercel, Netlify and Squarespace issue certificates for $0.
- Dormant database tiers. Idle or abandoned websites still pay minimum database fees. Take a final backup, then delete the database or move it to a free plan.