OWASP Web Security Testing Guide

The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.

About OWASP Web Security Testing Guide

Contributions

Any contributions to the guide itself should be made via the guide’s project repo. Contributions should only be made in the proper repo against the latest content. Please don’t open PRs here for versioned or stable content, they represent point-in-time state.

• https://github.com/OWASP/wstg

Latest

We are currently developing release version 5.0. You can read the latest development documents in our official GitHub repository or view the bleeding-edge content at latest.

Versioned Releases

v4.2 is currently available as a web-hosted release and PDF. Previous releases are available as PDFs and in some cases web content via the Release Versions tab.

• https://wstg.owasp.org/v4.2/

Project Resources

• WSTG Project Repo

• Download the v4.2 PDF

• Download the v4.1 PDF

• GitHub Issues

• Slack channel, #testing-guide

• @owasp-wstg.bsky.social

Project Leaders

Rick Mitchell

Leader

Elie Saad

Leader

Project Information

Language

Python, HTML, JavaScript

License

CC-BY-SA-4.0

Latest Version

4.2

Contributors

181

GitHub Stars

9800

Corporate Supporters

OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.

Quick Links

Projects Chapters Corporate Supporters Events News Community Visit Store

Legal & Governance

About OWASP Contact Impact Report 2025 Strategic Plan 2026 Board Board EU Finance & Governance Finance (all documents)Legal Staff Awards

Socials

Slack LinkedIn GitHub X Mastodon Bluesky YouTube

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.