What Is the OWASP Top 10 2025? A Web App and API Checklist

Which risk categories are in the OWASP Top 10 2025?

The OWASP Top 10 is an awareness document for developers and web application security. The 2025 release lists Broken Access Control; Security Misconfiguration; Software Supply Chain Failures; Cryptographic Failures; Injection; Insecure Design; Authentication Failures; Software or Data Integrity Failures; Security Logging and Alerting Failures; and Mishandling of Exceptional Conditions.

A category name begins a conversation; it is not a list of individual defects. Broken Access Control might appear when a user changes an ID to read another person's record, calls an administrative endpoint from a standard account or performs an action hidden by the interface. Testing requires an understanding of objects, roles, state and business consequences.

• ✓A01–A03: access control, configuration and software supply chain.
• ✓A04–A06: cryptography, injection and insecure design.
• ✓A07–A08: authentication and software or data integrity.
• ✓A09–A10: logging, alerting and exceptional-condition handling.

The OWASP Top 10 helps a team ask the first useful questions. A sound security programme turns them into requirements, test cases, evidence and remediation ownership.

Why is the OWASP Top 10 not a complete testing checklist?

OWASP explicitly describes the Top 10 as an awareness document and a starting point. Risk categories do not always map directly to one test case. Insecure Design requires scrutiny of assumptions and architecture, while Logging and Alerting requires evidence that events produce useful alerts and receive an operational response.

For verifiable requirements, OWASP recommends the Application Security Verification Standard. ASVS 5.0.0 contains numbered requirements for architecture, authentication, sessions, access control, data, cryptography, communications, APIs and configuration. WSTG adds testing approaches. A tool claiming complete automated coverage of the OWASP Top 10 should therefore be treated with caution.

• ✓Use the Top 10 for awareness and prioritising discussion.
• ✓Use ASVS to define requirements and verification rigour.
• ✓Use WSTG to organise contextual web testing methods and test cases.
• ✓Combine threat modelling, code review, scanners and manual testing as complementary layers.

A practical checklist for websites and web applications

Start with assets and trust boundaries: which domains are production, who controls DNS and hosting, what data is handled, which roles exist and which third-party systems are trusted. Build an action matrix by role and object. Every read, update, delete, export and privilege change must be enforced by the server rather than merely hidden in the interface.

Configuration and supply-chain review covers frameworks, dependencies, plugins, secrets, debug modes, headers, TLS, CI/CD and deployment rights. Input review includes queries, forms, files, URLs and integration data. Authentication review covers MFA for privileged accounts, recovery, session rotation and service accounts. Finally, trigger a controlled error to confirm that logs, alerts and the runbook work in practice.

• ✓Role-level and object-level authorisation.
• ✓Production configuration, secrets, dependencies and change permissions.
• ✓Validation, encoding, uploads, queries and business-logic errors.
• ✓Sign-in, recovery, sessions, MFA and service accounts.
• ✓Important-event logging, owned alerts and recovery capability.

What additional checks do APIs need?

An API can return more data than the interface displays and commonly serves several clients. Check permission on each object and property, not only whether a token is present. Compare two accounts with the same role, two different roles and the before-and-after state of one resource. Old endpoints, experimental APIs and webhooks also need an owner, version and explicit limits.

The OWASP API Security Top 10 2023 highlights Broken Object Level Authorization, Broken Authentication, Broken Object Property Level Authorization, Unrestricted Resource Consumption and inventory risks. Test cases can vary IDs, fields, HTTP methods, batch requests, pagination, rate limits and error responses; every check must remain authorised and use suitable test data.

• ✓Object-level and property-level authorisation.
• ✓Token scope, expiry, revocation and service accounts.
• ✓Rate limits, pagination, batches, uploads and costly resources.
• ✓Endpoint inventory, old versions, webhooks and stale documentation.

Turn risk categories into an operating process

Do not wait until the day before launch to run a long checklist. During discovery, identify high-consequence data and actions. During design, threat-model boundaries and abuse cases. During development, provide secure defaults, code review, dependency scanning and permission tests. Before release, conduct a scoped security review; after remediation, retest and put lessons into the shared backlog and standards.

Measure the share of applications reviewed, time to close findings by impact, recurring defect patterns and high-risk changes reviewed before release. Friday Works can support scoped website, web app and API security reviews that create a baseline and remediation backlog. This is not described as complete OWASP coverage or a replacement for a full penetration-testing or Red Team programme when greater assurance is required.