Website Vulnerability Scan with OWASP ZAP

What this test checks

Site crawl

ZAP's spider follows links on your site for up to 2 minutes, 3 levels deep, without leaving your site.

Passive security rules

Every response from the crawl is checked against ZAP's passive rules, which read the traffic without sending attack payloads.

Header and cookie issues

Missing or weak security headers, and cookies without the Secure, HttpOnly or SameSite flags.

Information disclosure

Error messages, version details, revealing comments and other data that responses should not expose.

Risk levels and affected URLs

Alerts grouped into high, medium and low risk, with the CWE reference, a suggested solution and up to 5 affected URLs each.

Detected technologies

The servers, frameworks and libraries ZAP recognizes on your site, listed separately and not scored.

How it works

OWASP ZAP runs on our test server in Virginia, USA, using an automation plan with a spider job, a passive-scan job and a report.
The spider runs for up to 2 minutes at a depth of 3, and the passive scan gets up to 3 more minutes to process what was found.
Only passive rules run: ZAP inspects the requests and responses of the crawl and sends no attack payloads.
Before the scan starts, the URL must use http or https on port 80 or 443 and resolve to public IP addresses.
A scan typically takes about 3 minutes and is stopped after 7 minutes at most.

How it is scored

The score starts at 100 and loses 25 points for each high-risk alert, 8 for each medium and 2 for each low, with a floor of 0; each alert type counts once however many URLs it affects, and informational alerts are not counted. Grades follow our scale: A+ 95+, A 90+, B 80+, C 70+, D 60+, F below 60.

Check	Good	Needs work	Poor
High-risk alerts	None	—	Any (−25 points each)
Medium-risk alerts	None	—	Any (−8 points each)
Low-risk alerts	None	Any (−2 points each)	—
Score after deductions	90–100 (A or A+)	70–89 (B or C)	Below 70 (D or F)

Grades: A+ 95–100 · A 90–94 · B 80–89 · C 70–79 · D 60–69 · F below 60.

FAQ

Is the OWASP ZAP scan safe to run on a live website?

This test uses only passive rules: ZAP crawls your pages and inspects the responses without sending attack payloads. Like ZAP's standard spider, it may submit forms it finds with placeholder values, so a contact form can receive a few test entries. The crawl adds some traffic for a few minutes, which is one reason the test only runs on domains you have verified.

What does a passive scan find?

Passive rules look for problems that are visible in normal traffic: missing or weak security headers, cookies without protective flags, information leaks in error pages and comments, and similar weaknesses. They do not test whether a form is open to SQL injection or cross-site scripting, which would require active attacks.

What do the ZAP risk levels mean?

ZAP rates each alert high, medium, low or informational by its likely impact. In this test a high-risk alert costs 25 points, a medium one 8 and a low one 2, and informational alerts are listed without affecting the score. Each alert type counts once, however many URLs it affects.

How do I verify my domain to run the ZAP scan?

Sign in, open Domains and add your site. Verify it with a DNS TXT record or by uploading a small verification file to your site's root folder, then run the scan from this page. The scan itself needs a paid plan or pass.

Do I need a paid plan for the ZAP scan?

Yes. Load tests and security scans are part of paid plans, from $5 for a 1-day pass, and they run only on domains you have verified. The other tests on Web-PSQC stay free.