---
name: OWASP ZAP
slug: owasp-zap
url: https://www.zaproxy.org/
category: Dynamic testing
bestFor: "Exercising a running site you are allowed to test, with a proxy aimed at people who are new to security testing."
freeTier: unknown
price: "Not stated"
checks:
  - live-url
freeTierNote: "The OWASP ZAP homepage describes ZAP as a tool with a quick start guide for people new to security testing, plus automation options. The homepage on 2026-10-13 did not state a price or a license. Read the download page before treating it as free."
verifiedOn: "2026-10-13"
sources:
  - https://www.zaproxy.org/
unknowns:
  - "License and whether a paid support offering exists."
  - "Which checks it runs by default."
---

ZAP talks to a running app. That can find issues a source scanner never sees, and it can also break or flood a site. Only point it at an app you own or have permission to test. Do not run it against a production URL you share with customers until you know what the scan does.

It is a poor first step if you have not checked row level security and secret keys. Those are faster to check by hand.