The OWASP Top 10 is an awareness document that ranks the most critical web application security risks. It is built from vulnerability data and community survey. The 2021 edition has ten categories, A01 to A10. It is a starting point for secure development and testing, not a complete standard.
Free account needed to download. You come straight back to the file.
Who it is for. Development teams, security testers and buyers of web applications. Many contracts and audit frameworks ask for testing against the OWASP Top 10.
What this list covers. OWASP Top 10, 2021 edition: 10 risk categories. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it asks for |
|---|---|---|
| A01 | Broken access control | Enforce access rules on the server for every request, so users cannot act outside their permissions or reach other users' data. |
| A02 | Cryptographic failures | Protect sensitive data in transit and at rest with current algorithms, sound key handling and no needless storage. |
| A03 | Injection | Keep untrusted input separate from commands and queries, using parameterised interfaces, validation and escaping. |
| A04 | Insecure design | Consider abuse cases and threats during design, and use secure patterns, not just secure code. |
| A05 | Security misconfiguration | Harden every layer, remove defaults and unused features, and keep configurations consistent and reviewed. |
| A06 | Vulnerable and outdated components | Know every library and platform you run, track their advisories and patch or replace them. |
| A07 | Identification and authentication failures | Protect sign-in and sessions against guessing, stuffing and hijacking, with multi-factor authentication where possible. |
| A08 | Software and data integrity failures | Verify updates, dependencies and pipelines, and do not trust serialised data or code from unverified sources. |
| A09 | Security logging and monitoring failures | Log security-relevant events with context, protect the logs and alert on suspicious activity. |
| A10 | Server-side request forgery | Validate and restrict URLs your server fetches, so it cannot be used to reach internal services. |
No. It is an awareness document. Standards such as PCI DSS refer to it, but meeting the Top 10 does not make an application secure or compliant.
The Top 10 names risks. The OWASP Application Security Verification Standard lists detailed, testable requirements, and is the better basis for a checklist.
The 2021 edition. OWASP revises the list every few years, so check the project site for the current version before citing it.
Yes. Our vulnerability assessment and penetration testing cover each category, and the free website security check reads the outward-facing signs of several of them.