A state-changing request is any action sent to a system that changes something, such as updating settings, starting or stopping a service, creating or deleting data, or issuing control commands. In web applications, these are the requests that do more than read information: they modify the system’s state.
In cyber security, state-changing requests matter because they often require stronger protection than simple page views. If an attacker steals an authenticated session cookie or abuses cross-site scripting, they may be able to send requests as a trusted user and trigger privileged actions without knowing the password. Defenders reduce this risk with authentication, CSRF protections, input encoding, least-privilege permissions, and monitoring for unusual administrative actions. In industrial systems, these requests can be especially sensitive because they may affect configuration, program management, or even process behavior.