OWASP Top 10 2021 Checklist: Best Practices to Protect Your Web Applications from Cyber Threats

Web application security is no longer an afterthought—it is a core business requirement. As digital transformation accelerates, cyber threats become more sophisticated, targets expand, and data breach costs reach record highs. For developers, DevOps engineers, and security teams, securing web applications requires a structured, proactive defense strategy.

The Open Web Application Security Project (OWASP) provides the gold standard for web application security. The OWASP Top 10 2021 list highlights the most critical security risks facing modern web applications, reflecting evolving architecture patterns like microservices, cloud deployments, and API-first designs.

This comprehensive guide breaks down the OWASP Top 10 2021 vulnerabilities into an actionable checklist, providing practical best practices to safeguard your applications against modern cyber threats.

What is the OWASP Top 10?

The OWASP Top 10 is a regularly updated awareness document based on real-world vulnerability data collected from thousands of organizations worldwide. Rather than focusing solely on individual exploits, it categorizes underlying software weaknesses and risk patterns.

By aligning your development lifecycle with the OWASP Top 10, your team can:

• Reduce attack surfaces before code reaches production.
• Meet compliance standards such as PCI-DSS, HIPAA, SOC 2, and GDPR.
• Foster a DevSecOps culture by integrating security early in the development pipeline.

The Complete OWASP Top 10 2021 Checklist

Here is the detailed breakdown of all ten security risk categories, complete with real-world context and actionable prevention checklists.

1. A01:2021 – Broken Access Control

Broken Access Control occurs when application policies fail to enforce proper user privileges. Attackers can exploit these flaws to access unauthorized data, view sensitive files, modify other users’ rights, or execute administrative functions.

Common Attack Vectors

• Circumventing access controls by modifying URLs, internal application state, or HTML pages.
• Primary key manipulation (e.g., changing user_id=101 to user_id=102 in an API call—Insecure Direct Object Reference or IDOR).
• Elevation of privilege by acting as an administrator without authorization.

Actionable Checklist & Best Practices

• [ ] Deny by default: Ensure all endpoints and API resources are closed to unauthorized users unless explicitly granted access.
• [ ] Enforce server-side authorization: Never rely on client-side controls, hidden HTML elements, or frontend JavaScript for access checks.
• [ ] Implement indirect reference maps: Use randomly generated UUIDs instead of sequential database IDs in URLs and API routes.
• [ ] Centralize access control logic: Write modular, reusable permission mechanisms instead of sprinkling if/else checks across individual controllers.
• [ ] Log access control failures: Monitor and alert on repeated unauthorized access attempts or privilege escalation patterns.

2. A02:2021 – Cryptographic Failures

Formerly known as “Sensitive Data Exposure,” Cryptographic Failures focus on weaknesses in how data is protected both at rest (in databases, files, logs) and in transit (across networks).

Common Attack Vectors

• Transmission of sensitive data (passwords, credit cards, health records) in cleartext via HTTP.
• Use of outdated cryptographic algorithms (e.g., MD5, SHA1, DES, RC4).
• Hardcoded cryptographic keys inside source code repositories.

Actionable Checklist & Best Practices

• [ ] Enforce strong encryption in transit: Require TLS 1.3 or TLS 1.2 across all web endpoints; enforce HTTP Strict Transport Security (HSTS).
• [ ] Encrypt sensitive data at rest: Use strong algorithms such as AES-256 for databases and file stores handling PII or credentials.
• [ ] Store passwords safely: Hash passwords using salted, work-factor-based hashing algorithms like Argon2id, bcrypt, or PBKDF2.
• [ ] Never hardcode secrets: Use dedicated secret management platforms (such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault).
• [ ] Disable legacy protocols: Turn off insecure protocols, weak ciphers, and outdated fallback mechanisms on web servers.

3. A03:2021 – Injection

Injection vulnerabilities occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data tricks the interpreter into executing unintended commands or accessing data without authorization. This category covers SQL Injection, Command Injection, LDAP Injection, and Cross-Site Scripting (XSS).

Common Attack Vectors

• SQL queries constructed via string concatenation incorporating raw user input.
• System commands executed via user-controlled inputs in server scripts.
• Reflecting unescaped user inputs back into HTML pages (Cross-Site Scripting).

Actionable Checklist & Best Practices

• [ ] Use parameterized queries: Utilize prepared statements or Object-Relational Mapping (ORM) frameworks for all database access.
• [ ] Validate and sanitize input: Apply strict positive “allow-list” server-side input validation on all parameters, headers, and form fields.
• [ ] Context-aware output encoding: Encode all dynamic data rendered in HTML, JavaScript, CSS, or attribute contexts to block XSS.
• [ ] Implement Content Security Policy (CSP): Deploy robust CSP HTTP headers to restrict execution of unauthorized inline scripts.
• [ ] Limit database permissions: Apply the Principle of Least Privilege to database user accounts; application services should only have necessary permissions.

4. A04:2021 – Insecure Design

Insecure Design is a category introduced in 2021 that focuses on risks related to architectural and design flaws. Unlike implementation bugs, an insecure design cannot be fixed simply by rewriting a snippet of code; it represents a fundamental lack of security controls during the planning phase.

Common Attack Vectors

• Lack of rate limiting on sensitive business workflows (e.g., password resets, ticket purchases).
• E-commerce systems failing to handle concurrent state modifications properly.
• Missing threat modeling during application design phases.

Actionable Checklist & Best Practices

• [ ] Conduct Threat Modeling: Perform threat modeling sessions (e.g., STRIDE) during early architecture and feature planning.
• [ ] Establish secure design patterns: Build and maintain a library of approved, reusable security components (authentication templates, payment logic).
• [ ] Design with defense-in-depth: Ensure applications maintain multiple layers of security rather than relying on a single perimeter.
• [ ] Implement business logic controls: Add rate limiting, anti-automation controls, and workflow state validation to prevent abuse.
• [ ] Engage security champions: Involve security professionals or trained team leads during system design reviews.

5. A05:2021 – Security Misconfiguration

Security Misconfiguration remains one of the most widespread vulnerabilities. It happens when security settings are defined, implemented, or maintained with default, incomplete, or insecure values.

Common Attack Vectors

• Leaving default credentials unchanged on web servers, database administration interfaces, or CMS platforms.
• Enabling detailed error messages (stack traces) in production environments.
• Leaving unused ports, services, cloud storage buckets, or administrative pages open.

Actionable Checklist & Best Practices

• [ ] Harden operating systems and servers: Disable unnecessary features, services, framework components, and sample application code.
• [ ] Automate configuration management: Use Infrastructure as Code (IaC) tools like Terraform or Ansible to enforce repeatable server configurations.
• [ ] Disable verbose error messages: Display generic error pages to users while logging detailed error traces internally.
• [ ] Audit cloud storage permissions: Ensure AWS S3 buckets, Azure Blob stores, and database instances are private by default.
• [ ] Implement secure HTTP headers: Configure headers such as X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

6. A06:2021 – Vulnerable and Outdated Components

Modern software relies heavily on open-source libraries, third-party frameworks, and nested dependencies. If any component in your software supply chain contains a known vulnerability (CVE), your whole application becomes an attractive target.

Common Attack Vectors

• Running outdated versions of frameworks (e.g., Log4j, Apache Struts, Spring Boot).
• Unmonitored nested dependencies pulled automatically via package managers (npm, Maven, PyPI).

Actionable Checklist & Best Practices

• [ ] Maintain a Software Bill of Materials (SBOM): Inventory all direct and indirect dependencies used in your application.
• [ ] Automate Software Composition Analysis (SCA): Integrate dependency scanning tools (e.g., Snyk, Dependabot, OWASP Dependency-Check) into your CI/CD pipeline.
• [ ] Establish a patching policy: Regularly update libraries, runtime environments, and base operating system images.
• [ ] Remove unused dependencies: Prune unnecessary packages, features, and components to minimize the application’s attack surface.
• [ ] Monitor security advisories: Subscribe to vulnerability databases and threat feed notifications for software stacks you use.

7. A07:2021 – Identification and Authentication Failures

Previously known as “Broken Authentication,” this category covers failures in establishing a user’s identity, session handling, and authentication state management.

Common Attack Vectors

• Permitting credential stuffing, brute-force attacks, or dictionary attacks.
• Allowing weak, easily guessable, or common passwords.
• Exposing session identifiers in URLs or handling session tokens insecurely.

Actionable Checklist & Best Practices

• [ ] Enforce Multi-Factor Authentication (MFA): Implement MFA for all sensitive accounts, administrative portals, and user systems.
• [ ] Implement credential brute-force protection: Use IP rate limiting, account lockout policies, or CAPTCHA controls on login endpoints.
• [ ] Enforce strong password policies: Reject common passwords against list databases (e.g., Have I Been Pwned API) rather than relying on arbitrary complexity rules.
• [ ] Secure session handling: Generate new random session IDs upon login; invalidate sessions on logout or period of inactivity.
• [ ] Configure secure cookie flags: Set HttpOnly, Secure, and SameSite=Strict (or Lax) flags on authentication cookies.

8. A08:2021 – Software and Data Integrity Failures

This risk focuses on code and infrastructure that does not protect against integrity violations. Examples include relying on untrusted software updates, unvalidated CI/CD pipelines, or insecure deserialization of data structures.

Common Attack Vectors

• Compromised third-party Content Delivery Networks (CDNs) injecting malicious scripts.
• Exploiting insecure deserialization to execute arbitrary code on the server.
• Attackers tampering with build pipelines or source repositories (supply chain attacks).

Actionable Checklist & Best Practices

• [ ] Use Subresource Integrity (SRI): Verify the cryptographic hashes of external scripts and stylesheets loaded from CDNs.
• [ ] Verify digital signatures: Ensure all third-party software updates, plugins, and dependencies are digitally signed and verified.
• [ ] Secure the CI/CD pipeline: Restrict code repository access, require code reviews, and sign build artifacts.
• [ ] Avoid insecure deserialization: Use safe data formats like JSON or XML with strict schema validation instead of native object serialization.
• [ ] Review code changes: Enforce strict peer code reviews and automated code analysis before merging to production.

9. A09:2021 – Security Logging and Monitoring Failures

Without adequate logging, real-time monitoring, and timely incident response, malicious activity can go unnoticed for months. Attackers leverage this window to pivot to other systems, tamper with data, or extract sensitive information.

Common Attack Vectors

• Failing to log critical events such as failed logins, privilege escalations, or input validation errors.
• Storing logs locally in cleartext without central backup or tamper protection.
• Failing to establish automated alerts for anomalous activity.

Actionable Checklist & Best Practices

• [ ] Log all security events: Capture authentication attempts, access control failures, server-side validation errors, and administrative actions.
• [ ] Centralize log management: Send application logs to a secure, centralized SIEM (Security Information and Event Management) platform.
• [ ] Protect log integrity: Ensure log records do not contain sensitive user data (PII, passwords) and are append-only to prevent tampering.
• [ ] Set up real-time alerting: Establish automated alerts for suspicious activity patterns, such as sudden spikes in failed logins or administrative changes.
• [ ] Create an Incident Response Plan: Test and practice your incident response workflow regularly through tabletop exercises.

10. A10:2021 – Server-Side Request Forgery (SSRF)

SSRF vulnerabilities occur when a web application fetches a remote resource based on a user-supplied URL without properly validating the destination address. Attackers exploit SSRF to force the server to issue requests to internal networks, cloud metadata services, or loopback interfaces.

Common Attack Vectors

• Forcing the application server to query internal metadata services (e.g., [http://169.254.169.254](http://169.254.169.254)) to steal cloud IAM credentials.
• Scanning internal network ranges hidden behind firewalls.
• Interacting with internal database microservices or administrative interfaces.

Actionable Checklist & Best Practices

• [ ] Restrict outgoing network traffic: Implement network segmenting and firewall egress rules to block application servers from reaching internal resources or metadata endpoints.
• [ ] Validate destination URLs: Enforce strict allow-lists for external domains, scheme protocols (allow https only), and IP ranges.
• [ ] Disable HTTP redirections: Prevent the application from following HTTP redirects automatically when fetching remote resources.
• [ ] Do not send raw responses: Avoid returning raw server response bodies or headers directly back to the client.
• [ ] Isolate resource-fetching services: Run URL-fetching services in dedicated, restricted sandbox networks isolated from primary application data.

OWASP Top 10 2021 Summary Matrix

Integrating OWASP Best Practices into the DevSecOps Lifecycle

Addressing the OWASP Top 10 is not a one-time project—it must be integrated continuously throughout your development lifecycle:

1. Planning Phase: Conduct threat modeling and establish clear security requirements.
2. Development Phase: Utilize SAST (Static Application Security Testing) tools and peer code reviews.
3. Build & CI/CD Phase: Run SCA (Software Composition Analysis) dependency scans and container security checks.
4. Testing Phase: Perform DAST (Dynamic Application Security Testing) and regular penetration testing.
5. Production Phase: Deploy Web Application Firewalls (WAF), enforce continuous SIEM monitoring, and execute periodic security audits.

Final Thoughts

Web application security requires continuous vigilance, proper tooling, and an engineering culture that treats security as a core quality attribute. By embedding this OWASP Top 10 2021 Checklist into your team’s development workflows, code reviews, and release criteria, you can significantly shrink your attack surface and protect both your user data and brand reputation.

Penulis: W.S