What is the OWASP Top 10?
Short answer
The OWASP Top 10 is a widely used awareness list of the most critical web application security risks, such as broken access control, injection and security misconfiguration, published by the Open Worldwide Application Security Project. Teams use it to prioritize secure coding and testing.
The details
It is an awareness document, not a complete standard. For detailed requirements, teams often pair it with OWASP’s Application Security Verification Standard (ASVS). OWASP also publishes a separate Top 10 for LLM applications.
Useful next reads and tools
Terms explained
- OWASP Top 10
- The OWASP Top 10 is an awareness list of the most critical security risks to web applications, published by the Open Worldwide Application Security Project.
Sources
Related questions
Related Guides
GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more GuideWeb Security
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): How to Patch, Mitigate and Detect Attacks
Two critical PHP flaws allow unauthenticated remote code execution. See who is affected, the fixed versions, temporary mitigations and what to watch for in your logs.
Read more GuideWeb Security
A Practical Guide to HTTP Security Headers for Web Developers
Why modern web applications need CSP, HSTS, and X-Content-Type-Options, and how to configure them properly in Next.js and Nginx.
Read more