The OWASP Web Security Testing Guide Is Still Being Written—Here's How to Help

You've probably used the OWASP Web Security Testing Guide at some point, whether you realized it or not. It's the reference penetration testers reach for when they need a consistent framework for testing web applications, and it's been shaped by volunteers for years. The catch is that version 5.0 is still in progress, and the project is actively looking for people to help finish it. If you've ever benefited from the guide, this is a good moment to give something back.

What It Does

The WSTG is a comprehensive guide to testing the security of web applications and web services. It's a framework of best practices used by penetration testers and organizations around the world, built through the collaborative efforts of security professionals and dedicated volunteers. In practical terms, that means a structured set of test scenarios covering different categories of weaknesses—information gathering, and so on—each with its own identifier so you can reference it precisely.

The identifiers follow a format of WSTG-<category>-<number>, where the category is a four-character uppercase string and the number runs from 01 to 99. So WSTG-INFO-02 is the second Information Gathering test. The README recommends that reports, tools, and other documents use a versioned format instead—WSTG-<version>-<category>-<number>—because identifiers can change between versions. That's a small detail, but it matters if you're citing tests in a client report or wiring them into tooling.

The project is currently working on release 5.0, which you can read directly in the repository's document folder. The last stable release, 4.2, is available as a GitHub release and also online.

Why It's Cool

• It's a real community artifact. The guide exists because a lot of people volunteered time to write, review, and edit it. Contributors who put in the work get listed as authors, reviewers, or editors. That's a nice bit of recognition for what's often invisible labor.

• The versioning discipline is smarter than it looks. Most documentation projects let links rot or drift. The WSTG explicitly asks people to link to versioned URLs rather than stable or latest, with the stated intention that versioned links won't change. If you've ever had a security report cite a test that got renumbered in the next release, you'll appreciate why that matters.

• There's room for every skill level. The contribution options range from fixing spelling mistakes and grammatical errors to choosing an existing issue and submitting a pull request, helping with translations, or opening a new issue to flag an improvement. You don't need to be a senior pentester to be useful here.

• It's an OWASP flagship project. That badge isn't just decoration—it means the guide carries weight in the security community and is used as a reference by organizations worldwide. Contributing to it is contributing to something people actually rely on.

• Translations are an explicit priority. The README calls out translation efforts as a way to help, which is a meaningful path for non-English speakers or bilingual security folks who want to widen the guide's reach.

How to Try It

You don't install anything—this is documentation, so "trying it" means reading it and then pitching in.

1. Read the current draft. The in-progress 5.0 document lives in the document folder of the repo. If you want the stable version, grab release 4.2 or read it online.

2. Read the contribution guide. Before you open a pull request, go through CONTRIBUTING.md. It covers how to contribute successfully, including the translation process.

3. Pick your entry point. Fix a typo, claim an existing issue, or open a new one describing an improvement you've spotted. If it's your first time contributing to this repo, GitHub's first-time contributor suggestions will point you at approachable issues.

4. Say hello. The project has a chat channel (linked in the README) and a Twitter/X account if you want to follow along or ask questions before diving in.

The repository is at github.com/owasp/wstg.

Final Thoughts

The WSTG isn't a shiny new tool—it's a long-running reference document that's still being finished, which is exactly why it needs hands right now. If you work in application security, you've likely drawn on it already; contributing a fix or a translation is a low-friction way to pay that back. It's also a genuinely good first open-source contribution for anyone in security, since the barrier is writing and reviewing rather than shipping code. The guide gets better as more people read it closely and file what they find—so if something in there trips you up, that's probably a signal worth acting on.