ZAP Review 2026: Free Web App Security Scanner (Formerly OWASP ZAP)

Short answer: ZAP is the most widely used free, open-source dynamic application security testing (DAST) tool. Developers and security teams use it to check their own web applications for common weaknesses — missing security headers, insecure cookies, injection flaws, cross-site scripting — by scanning the running app. It's no longer called "OWASP ZAP": the project left OWASP in 2023, and in September 2024 its core team joined Checkmarx, so it's now "ZAP by Checkmarx". It remains open source under the Apache 2.0 license. Only scan applications you own or are authorized to test.

ZAP at a glance

How teams use ZAP

1. Baseline scans in CI/CD

The baseline scan spiders your application and runs only passive checks — it doesn't attack the app — so it's safe to run against every build in a staging environment. It flags issues like missing Content-Security-Policy headers, insecure cookie flags and information disclosure. Many teams start here; see our guide to automating security in CI/CD.

2. Full scans in a test environment

Active scans send test payloads to find issues such as injection and cross-site scripting. Run these only against non-production copies of applications you own, because they can create data and trigger errors.

3. API scanning

Import an OpenAPI, GraphQL or SOAP definition so ZAP can test API endpoints that a spider wouldn't discover.

4. Manual review support

The desktop app acts as a proxy so developers can watch requests and responses while using their own app — useful for understanding what the browser sends.

Mapping findings to the OWASP Top 10

ZAP's alerts align with common risk categories in the OWASP Top 10, such as security misconfiguration, injection and broken access control. Treat its results as a starting list: confirm each finding, fix the root cause, then re-scan.

Limitations

• False positives need human review.
• Logic flaws (e.g., one user accessing another's data) are hard for any automated scanner to find; they need manual testing.
• Authenticated scanning takes configuration effort.
• Not a replacement for code review, dependency scanning (SCA) or static analysis (SAST).

ZAP vs. alternatives

• Burp Suite Professional: a commercial tool favored by professional testers, with more advanced manual-testing features (around $499 per user per year in 2026).
• Commercial DAST platforms (including Checkmarx's own): add scheduling, dashboards and enterprise support.

Verdict

ZAP is the best free DAST tool and an easy win for any team shipping web applications: add a baseline scan to your pipeline this week, then schedule full scans against staging.

Frequently asked questions

Is OWASP ZAP still free?

Yes. ZAP remains free and open source under Apache 2.0, though it's no longer an OWASP project and is now known as ZAP by Checkmarx.

Is ZAP safe to run against production?

Baseline (passive) scans are generally safe. Run active scans only against test environments you own, since they can change data.

What's the difference between ZAP and a SAST tool?

ZAP tests the running application from the outside (DAST). SAST tools analyze source code. Most teams benefit from both.

Sources

• ZAP, ZAP has joined forces with Checkmarx
• ZAP, ZAP ownership and No longer an OWASP project
• ZAP, Baseline scan documentation