OWASP Web Security Testing Guide
The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.
Version 4.2 introduces new testing scenarios, updates existing chapters, and offers an improved writing style and chapter layout. Download the v4.2 PDF here.
Version 4.1 serves as a post-migration stable version under the new GitHub repository workflow. Download the v4.1 PDF here.
Download the v4 PDF here.
A printed book is also made available for purchase.
View a presentation (PPT) previewing the release at the OWASP EU Summit 2008 in Portugal.
Download the v2 PDF here.
The guide is also available in Word Document format in English (ZIP) as well as Word Document format translation in Spanish (ZIP).
Version 1.1 is released as the OWASP Web Application Penetration Checklist.
Download the v1.1 PDF here.
Historical archives of the Mailman owasp-testing mailing list are available to view or download.
Project Resources
Project Information
Flagship Project
Classification
Documentation
Language
Python
License
Creative Commons Attribution Share Alike 4.0 International
Latest Version
4.2
Contributors
184
GitHub Stars
9950
Downloads
247378
Corporate Supporters
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
Quick Links
Legal & Governance
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.