Overview

Wapiti crawls an application and tests its links, forms and scripts with payloads rather than examining source code. That makes it useful for assessing how a deployed application behaves, but it does not replace source-code analysis. The project offers installation with pip install wapiti3 and is released under the GNU General Public License version 2.

Scanning can cause malfunctions, crashes or data loss. Use it only with the target owner's consent and configure scope carefully; its ability to probe actively is useful for authorized assessments, but unsuitable for casual scans of systems you do not control.

Key features

Wapiti's checks include SQL and XPath injection, cross-site scripting, file disclosure, command execution, XXE, SSRF and open redirects. This range covers several important classes of web application weaknesses, while the crawler-and-payload approach focuses on exposed behavior rather than code-level defects.

Authenticated scanning supports Basic, Digest and NTLM authentication, login forms, browser cookie imports and custom Python code for complicated login cases. These options can reach areas hidden behind authentication, although custom code makes the most complex setups a task for users comfortable with Python. REST APIs can be scanned from an OpenAPI (Swagger) file.

Operators can route requests through HTTP, HTTPS or SOCKS5 proxies, set scan scope and crawler limits, and add custom HTTP headers. SQLite-backed sessions allow scans to be suspended and resumed. Reports are available in HTML, XML, JSON, TXT, CSV and Markdown, giving teams a choice of formats for reading or processing results.

Pricing

Wapiti's Free and open-source plan costs 0.00 USD per free under the GNU GPL version 2. It includes the scanner for on-premise use, with authenticated scans and JavaScript crawling. There are no paid tiers or seat and quota limits stated for this plan; the trade-off is that running and configuring it is the user's responsibility rather than a paid service.

Platforms

Wapiti supports Linux, macOS, Windows, API use and self-hosted deployment. The README requires Python 3.12, 3.13 or 3.14, and says Windows use can be done through WSL. Those requirements make it a better fit for people who can manage a Python environment than for readers seeking a managed browser-based scanner.

Who it's for

Wapiti suits developers and security practitioners who need to assess authorized web applications or REST APIs, especially when authenticated areas, proxy routing, scan controls or flexible report formats matter. It is less suitable for teams that need source-code analysis or want a hosted service to handle setup and scan execution.

Pros and cons

Pros: Free and open source, with authenticated scanning, REST API support from OpenAPI definitions, and six report formats.
Pros: Scope, crawler limits, proxies and resumable sessions give operators practical control over scan execution.
Cons: Python version requirements and custom authentication code can demand technical setup.
Cons: Active scans can disrupt targets or cause data loss, so consent and careful scope are essential.
Cons: It tests deployed behavior rather than source code, so it cannot stand in for code review.

Alternatives

Web Application Security Scanners is the broader category to browse if Wapiti's self-managed approach is not the right fit.

Choose Nuclei instead if you want a free, MIT-licensed standalone CLI; like Wapiti, it is available for Linux, macOS, Windows and self-hosting. OWASP ZAP is another free, open-source option for API and desktop-platform use, and its project explicitly invites contributions.

Beagle Security may suit readers who prefer a freemium web and API service: its free plan includes one lite test per month, monthly surface scan reports, and SSL and domain-expiry monitoring, with an Essential plan at 99.00 USD per month billed annually at $1188. Detectify Surface Monitoring is worth considering for surface monitoring: its Starter plan is 0.00 EUR per year with up to five users and one team, while Surface Monitoring costs extra per domain; Standard is 2500.00 EUR per year billed annually.

Qualys External Attack Surface Management offers a 30-day no-cost trial of CSAM with EASM, rather than a permanent free plan. ZeroThreat may fit readers seeking a limited freemium scan service, with five sign-up credits valid for 15 days, one scan credit per month and one target per account. ImmuniWeb is a mobile-focused alternative, with a 395.00 EUR per month subscription for unlimited scans of builds or versions of the same Android or iOS app. For an API-focused alternative, Pentest-Tools.com API Scanner has a NetSec plan from 95.00 USD per month with five assets; its price varies by asset count and billing cycle.

Verdict

Choose Wapiti if you can manage a Python-based scanner and want configurable, authenticated assessments of authorized web applications or REST APIs without a license fee. Its strongest reason to choose it is the combination of scan controls, authentication support and reporting flexibility. Look elsewhere if you need source-code review, or if the responsibility and disruption risk of active self-managed scans do not suit your workflow.

	ProxyMesh	Wapiti
Free plan	No	Yes
Free trial	No	No
Paid from	$10/mo	Free
Open source	No	No
Platforms	api, Web	api, Linux, macOS, self-hosted, Windows
Free plan	No	Yes
Deployment	cloud	on-premise
Authenticated scans	—	Yes
JavaScript crawling	—	Yes
API scanning	—	Yes

ProxyMesh vs Wapiti

ProxyMesh

Wapiti