Wapiti

7.1easy start · #6 of 31
in Web Application Security Scanners

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on api, Linux, Mac, self-hosted, Windows.

Wapiti is ranked #6 of 31 in web application security scanners on The Geeks Club. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

Wapiti plans and pricing

All plans

Free and open-source Free GNU GPL version 2 github.com · 3 Oct 2026

Compared on web application security scanners

Free plan: Yes
Deployment: on-premise
Authenticated scans: Yes
JavaScript crawling: Yes
API scanning: Yes

Best Wapiti alternatives

See all 12

Qualys External Attack Surface Management 0 of 4 in the starter kit Lesson 17.6 ZeroThreat 0 of 4 in the starter kit Lesson 27.6 Beagle Security 0 of 4 in the starter kit Lesson 37.5 Nuclei 0 of 4 in the starter kit Lesson 47.3 Pentest-Tools.com API Scanner 0 of 4 in the starter kit Lesson 57.1 Burp Suite DAST 0 of 4 in the starter kit Lesson 77.0

The record

Purpose: Wapiti is a Python web vulnerability scanner that audits websites and web applications.
Scan method: It crawls deployed web applications and tests links, forms, and scripts with payloads without examining source code.
Vulnerability coverage: Its listed checks include SQL and XPath injection, XSS, file disclosure, command execution, XXE, SSRF, and open redirects.
Reports: It generates reports in HTML, XML, JSON, TXT, CSV, and Markdown formats.
Authentication: It supports Basic, Digest, and NTLM authentication, login forms, browser cookie imports, and custom Python code for complicated authentication cases.
Traffic and scan controls: It supports HTTP, HTTPS, and SOCKS5 proxies, configurable scan scope, crawler limits, and custom HTTP headers.
Scan sessions: It can suspend and resume scans using sessions stored in SQLite databases.
Requirements: The README lists Python 3.12, 3.13, or 3.14 as requirements and says Windows use can be done through WSL.
Installation: The project homepage offers installation with pip install wapiti3.
Support: The project README directs users to its FAQ and invites bug reports through GitHub issues.
Safety and limits: The README warns that assessments may cause target malfunctions, crashes, or data loss, and says users need the target owner's consent.
License: The README states that Wapiti is released under the GNU General Public License version 2.
Latest listed release: The project's SourceForge files page lists version 3.3.2 dated 2026-08-19.
Price from: Free

Where it ranks on The Geeks Club

Best Web Application Security Scanners in 2026#6 of 31

Is Wapiti yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Wapiti

Sources

github.com/wapiti-scanner/wapiti/blob/master/READM· checked 3 Oct 2026
wapiti.sourceforge.io· checked 3 Oct 2026
sourceforge.net/projects/wapiti/files/· checked 3 Oct 2026