About the WSTG
The Web Security Testing Guide (WSTG) is a comprehensive guide to testing the security of web applications and web services. Created by the collaborative efforts of cybersecurity professionals and dedicated volunteers, the WSTG provides a framework of best practices used by penetration testers and organizations all over the world.
Contributions to the guide should be made via the OWASP/wstg repository.
Citing Scenarios
Prefer versioned links when citing scenarios. Identifiers use the form WSTG-<category>-<number> (for example WSTG-INFO-02).
For version-specific citations use WSTG-<version>-<category>-<number> (for example WSTG-v42-INFO-02).
Linking
Linking to Web Security Testing Guide scenarios should be done using versioned links not stable or latest which will change with time. For example: https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server/.
Note: As of late 2026, WSTG links use a subdomain (wstg.owasp.org) and version components use a period separator (e.g., v4.2). While the project team intends these versioned links to remain stable, the project team does not control the long-term stability or availability of links on the owasp.org domain.