What Is ZAP (Zed Attack Proxy) and What Is zaproxy.org?

Updated

ZAP (Zed Attack Proxy) is a free, open-source web application security scanner, and zaproxy.org is its official project website. The site is the place to download ZAP, read documentation, follow the blog, watch videos, and find community resources. According to the site, ZAP is "the world's most widely used web app scanner," is community-based, and is presented by Checkmarx.

What ZAP Is

ZAP is a security testing tool for web applications. The homepage describes it as free and open source, and as a GitHub Top 1000 project that anyone can contribute to. It is an independent open-source project, with the site noting it is "by Checkmarx."

The site positions ZAP for two broad audiences:

  • People new to security testing — the homepage explicitly says ZAP "has you very much in mind" and points beginners to the Quick Start Guide.
  • People who want to automate security testing — ZAP offers a range of automation options, documented in its automation docs.

What zaproxy.org Provides

The website is the project's central hub. Based on the homepage, it offers:

Resource What it gives you
Download The ZAP application itself
Documentation Quick Start Guide and automation docs
Blog Project news and updates
Videos Including an intro video
Community Ways to engage with the project and contributors
ZAP Marketplace Community-contributed add-ons that extend ZAP

The Marketplace is worth noting if you want to extend ZAP's capabilities: add-ons are contributed by the community, and the site explains how to add them.

Who It Suits

Choose ZAP if you want an open-source web app scanner and are either learning security testing or looking to automate it. The site's own framing makes the starting path clear: beginners should begin with the Quick Start Guide, while those focused on automation should go to the automation documentation. If you want to extend the tool, the Marketplace is the place to look.

The homepage does not state pricing beyond "free and open source," and it does not describe login requirements, so treat those details as unconfirmed until you check the download and documentation pages directly.