OWASP Top 10 explained for business owners
The OWASP Top 10 is the industry list of the most common web security risks. Each category in one plain sentence, with what it means for a business website.
The short answer
The OWASP Top 10 is a list, maintained by the Open Worldwide Application Security Project, of the ten most common categories of security weakness in web applications. The current edition is the 2025 one, and the ten below follow its order in our own words rather than its category names, so the descriptions keep working when the names change again. It is updated every few years from real-world data and it is the shared vocabulary of web security: scan reports, penetration tests, tenders and security questionnaires all refer to it.
You do not need to understand the internals of each category. You need to know they exist, what each one means for a business website in one sentence, and that whoever builds and runs your site designs against them.
The ten, in plain language
| Category | In one sentence | What it means for a business site |
|---|---|---|
| Access that is not checked | People can reach or change things they should not | A customer viewing another’s invoice by changing a number in the address; an admin page with no check |
| Settings left as they came | Defaults left on, features exposed, headers missing | Directory listings, verbose error pages, missing security headers, sample files still installed |
| Weakness in what the site is built from | The packages, tools and services a site depends on can each carry a problem, and not only a published vulnerability | An abandoned plugin; a build tool nobody vets; a script from a supplier that changes without notice |
| Data not protected properly | Weak or missing protection in transit or at rest | No HTTPS, weak certificates, passwords stored badly, personal data unencrypted |
| Input treated as instructions | What a visitor types is run rather than read | A form field used to run a database query or inject a script into a page |
| Designed without thinking about abuse | The flow itself allows something it should not | A password reset that can be guessed; a discount that can be applied twice |
| Logins that can be bypassed | Identity is not established properly | No two-factor, weak password rules, sessions that never expire |
| Code or data trusted without checking | Something is accepted because of where it came from | Scripts loaded from third parties without integrity checks; updates from untrusted sources |
| Nothing logged, nobody alerted | Attacks happen and nobody notices in time | No logs, no alerts, incidents discovered by customers |
| Errors handled badly | The unexpected case is where the system gives something away | A failure that reveals internals, or leaves the system open because the error path was never designed |
Which ones bite small businesses most
- Weakness in what the site is built from. The plugin with a published hole, the abandoned dependency, the supplier script that changes without notice. On a site assembled from many parts, this is where the known problems live.
- Settings left as they came. Missing headers, exposed files, default settings. Cheap to fix and found by every scan.
- Access that is not checked. The moment a site has logins, this is the category that exposes other people’s data, which is what makes it the expensive one.
- Logins that can be bypassed. No two-factor on the admin, reused passwords, no limits on login attempts.
- Nothing logged, nobody alerted. Not a breach in itself, but the reason breaches last for months.
How to use this as a business owner
Ask your supplier how the OWASP Top 10 is addressed in what they build and run for you. A competent answer names concrete practices: headers set, dependencies updated on a routine, access control tested with two accounts, two-factor enforced, logs and alerts in place, scans and tests reported by category. A blank look, or “we use a security plugin”, tells you where you stand.
What this means for you
You now have the vocabulary. Use it in three places: when choosing a supplier, when reading a security report, and when a tender or client questionnaire asks about security. The categories that matter most for a small business are outdated components, misconfiguration, access control and authentication, and all four are addressed by routine rather than heroics.
Frequently asked questions
Is the OWASP Top 10 a certification?
No. It is an awareness document from a non-profit community, updated every few years from real-world data. Nobody is certified against it, but it is the common vocabulary for web security risks, which is why security reports, tenders and questionnaires use it.
Does a static website still have OWASP risks?
Fewer, because several categories concern server-side code and databases that a static site does not run in front of visitors. It still has forms, headers, third-party scripts and any functions behind it, so misconfiguration, vulnerable components and injection through forms remain relevant.
How do I know if our site is exposed to these?
A security scan reports findings mapped to these categories for the parts a scanner can see. A penetration test covers the rest, especially access control and logic. Ask for the report to reference the categories, so you can see which apply and which were checked.
Sources
- OWASP Top 10 (2025 edition) (accessed 2026-09-14)