What it does
ZAP is an open-source web application security scanner and intercepting proxy. It can map a site with spiders, passively inspect browser traffic, and actively probe selected pages and parameters with known attack patterns. The project provides desktop downloads and automation options for teams that want repeatable security checks.
A first assessment can start in ZAP's Quick Start tab: enter the full URL of an application you are authorized to test, then launch an automated scan. ZAP crawls pages and passively checks responses before its active scanner sends attack traffic to discovered functionality and parameters. For JavaScript-heavy applications, the getting-started guide recommends considering the slower Client spider because the traditional HTML spider may miss parts of modern sites. Review the site map and alerts by risk category, and treat findings as a starting point for security work.
Active scanning is a real attack on the selected target, not a harmless read-only audit. The ZAP docs explicitly say not to scan applications you do not own, and they warn that automated scans cannot find logical issues such as broken access control. ZAP releases are also currently unsigned according to the download page, which may trigger operating-system trust prompts.
Strengths
- The proxy, site map, passive checks, and active scanner give security testers multiple ways to inspect a web application's behavior.
- Quick Start lowers setup friction, while the project also documents automation and multiple spider options.
- The independent project is free and open source under Apache License 2.0.
Watch out for
- Active scans send real attack traffic and should be limited to systems the operator owns or has explicit permission to test.
- Automated scans cannot detect logical vulnerabilities such as broken access control, so manual security testing remains necessary.
- The official download page warns that releases are unsigned and may be flagged by operating-system security prompts.
Best for
- Security engineers who need a proxy-based view of web requests plus repeatable scans against authorized test environments
- Development teams that want to surface common web vulnerability signals before a manual security review
Sources
- ZAP (Oct 25, 2026)
- ZAP - Getting Started (Oct 25, 2026)
- ZAP - Active Scan (Oct 25, 2026)
- ZAP - Download (Oct 25, 2026)
- LICENSE - zaproxy/zaproxy (Oct 25, 2026)