Wapiti

At a glance

• Editor score
  7.4 / 10
• Pricing
  Free plan
• Best for
  Developers wanting free command-line DAST
• Free plan
  Yes
• Paid from
  Free
• Authenticated scans
  Yes
• Facts checked
  19 Sep 2026

• Where it wins

  • Free, GPLv2-licensed, and open source
  • Authenticated crawling with JavaScript and headless-browser support
  • Scans REST APIs and exports reports in six formats

• Where it doesn't

  • Runs locally rather than as a hosted service
  • Command-line operation may require technical security expertise
  • No paid tiers or commercial plan structure

Our verdict on Wapiti

Wapiti is a free, open-source command-line web application vulnerability scanner for developers, security professionals, and system administrators. It performs black-box testing against deployed websites by crawling links, forms, and inputs, then injecting payloads to identify security weaknesses. Local deployment supports Windows, Linux, macOS, and self-hosted environments, making it a fit for teams that want command-line DAST without a hosted service.

Its strongest area is scan coverage for modern web applications. Wapiti supports authenticated testing through Basic, Digest, NTLM, login forms, cookies, and custom authentication scripts. JavaScript URL extraction and Firefox headless-browser crawling extend coverage beyond simple static pages, while OpenAPI or Swagger imports support REST API scanning. Detection modules cover SQL injection, cross-site scripting, SSRF, XXE, CSRF, file disclosure, and command injection, alongside TLS configuration and security-header checks. Integrations with Wappalyzer and sslscan add related application and TLS inspection capabilities.

The published product model is straightforward: Wapiti is distributed as free open-source software under the GPLv2 license, with no tiered commercial structure described. Reports can be exported in HTML, XML, JSON, TXT, CSV, and Markdown, and SQLite session databases allow scans to be suspended and resumed. That flexibility suits developers and security practitioners who can work with a local command-line workflow and want control over scan output. Organizations seeking a hosted interface, scheduled scanning, or a commercial support model should choose a product designed around those requirements instead.

Your product? Our editors can test Wapiti in depth and publish a review, labelled as paid · from $149/mo →

Wapiti pricing

Wapiti fact sheet

Wapiti integrations

Wapiti lists 3 integrations on its own site.

• OpenAPI/Swagger
• Wappalyzer
• sslscan

Alternatives to Wapiti

• ZeroThreatDeep web and API coverage with flexible free, cloud, pay-per-scan, and on-premises options.9.4
• Burp Suite DASTBroad, enterprise-focused DAST for authenticated web apps, APIs, and CI/CD workflows.9.3
• EscapeDeep testing for complex applications, APIs, workflows, and access controls.9.2

See all Wapiti alternatives →

Featured on iTechGuides

Wapiti is listed in our Web Application Security Scanners directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/wapiti-web-application-security-scanner/"><img src="https://www.itechguides.com/best/badge/wapiti-web-application-security-scanner.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update