Frequently Asked Questions

What does ZAP test for?

ZAP supports:

For a full list of the HTTP active and passive scan rules see the Alert Details page.

By default ZAP comes with the following (HTTP) scan rules:

But you can also download and install:

from the ZAP Marketplace.

And there are also these scripts in the community scripts repo:

The full list of reserved scan ids is maintained in