Guide OWASP ZAP · Reading a web scan report
OWASP ZAP alerts explained: what to fix first
Short answer: ZAP rates every alert by risk (how bad it would be) and confidence (how sure it is). Fix High-risk alerts first, after checking that they're real. Then fix the Medium-risk ones that affect pages with logins, checkouts or forms. Most Low and Informational alerts are hardening work you can schedule.
Don't panic at the count. ZAP lists an alert once for every URL it appears on. A report with 200 rows is often five problems, each fixed by one setting.
What OWASP ZAP is
ZAP (Zed Attack Proxy) is a free, open-source web application scanner, started under the OWASP foundation and one of the most widely used tools of its kind. It works in two passes:
- Crawl and passive scan. ZAP follows links through your site and inspects every response it gets back: headers, cookies, page content. This finds missing security headers, insecure cookies and information leaks without sending anything unusual.
- Active scan. ZAP then sends test inputs to the pages and form fields it found, looking for injection flaws such as SQL injection and cross-site scripting. Because it submits forms, an active scan can leave test entries behind, such as contact-form messages. Only run it on sites you own or have permission to test.
Risk levels: how bad it would be
| Risk | What it means | Typical alerts |
|---|---|---|
| High | Can lead directly to stolen data, a taken-over account or server, if real. | SQL Injection, Cross Site Scripting (Reflected / Persistent), Remote OS Command Injection, Path Traversal |
| Medium | A missing protection or an exposure that makes attacks easier. | Content Security Policy (CSP) Header Not Set, Missing Anti-clickjacking Header, Absence of Anti-CSRF Tokens, Directory Browsing, Vulnerable JS Library |
| Low | Hardening gaps that limit damage when something else goes wrong. | Strict-Transport-Security Header Not Set, X-Content-Type-Options Header Missing, Cookie No HttpOnly Flag, Cookie Without Secure Flag, Cookie without SameSite Attribute, Server Leaks Version Information |
| Info | Observations, not problems. Useful context for a tester. | Information Disclosure - Suspicious Comments, Modern Web Application, Re-examine Cache-control Directives, User Agent Fuzzer, Session Management Response Identified |
The rating is ZAP's general estimate. Adjust it to your site: a missing CSP on a brochure site with no logins matters far less than on a shop with customer accounts.
Confidence: how sure ZAP is
If you run ZAP yourself, every alert also carries a confidence level: Low, Medium, High, or Confirmed (marked by a person). Risk and confidence are separate. "High risk, Low confidence" means "this would be serious, but ZAP isn't sure it's real". Treat those as "check by hand", not as "ignore" or "panic".
Header and cookie alerts are usually High confidence, because ZAP can see exactly what your server sent. Injection alerts are inferences from how the page reacted, so they deserve a manual check before you schedule work or tell a customer you were breached.
Why the same alert appears dozens of times
ZAP raises an alert for each URL where it sees the problem. If your server never sends a Content-Security-Policy header, every page it crawled gets its own alert. In one Deep Scan we ran, ZAP listed the same CSP alert on 10 URLs and the same server-header alert on 14.
- 443 Content Security Policy (CSP) Header Not Set Found on 10 URLs (Deep Scan) Medium
- 443 Server Leaks Version Information via "Server" HTTP Response Header Field Found on 14 URLs Low
- 443 Information Disclosure - Suspicious Comments Found on 3 URLs Info
FreshScanSentry's Deep Scan groups these into one row per alert and shows how many URLs it was found on. Each row links to a plain-language guide where one exists, and the report's A to F grade counts each grouped alert once. Informational alerts never lower the grade.
Common false positives
A false positive is an alert that is technically accurate but harmless on your site, or simply wrong. These come up most often:
- Absence of Anti-CSRF Tokens on site search, filters, or newsletter sign-ups on a site without logins. Those forms don't change anything worth protecting. See the anti-CSRF guide for how to sort them.
- Timestamp Disclosure on large numbers that merely look like dates, such as IDs or cache keys.
- Information Disclosure - Suspicious Comments on words like "TODO", "admin" or "user" inside minified JavaScript libraries you didn't write.
- Cookie alerts on third-party cookies from analytics or chat widgets. You can't set their flags; your own session cookie is the one that matters. See the cookie flags guide.
- Most Informational alerts. "Modern Web Application" just means the site uses JavaScript.
Don't dismiss High-risk injection alerts this way. Reproduce them, or ask your developer to, before deciding.
What to fix first
- Confirmed High risk: SQL injection and cross-site scripting. These are fixed in the application code, so involve your developer or plugin vendor straight away.
- Outdated software: "Vulnerable JS Library" and old server versions. Updating usually closes several alerts at once. See outdated server software.
- Exposures: Directory Browsing and anything that reveals files, backups or error details.
- Missing protections on pages that matter: CSRF tokens on logged-in forms, a Content-Security-Policy and anti-clickjacking header.
- One-line hardening: HSTS,
X-Content-Type-Options: nosniff, cookie flags, and hiding version numbers. Most are set once in the web server or CDN and clear dozens of rows.
Common questions
Is a ZAP scan the same as a penetration test?
No. ZAP is an automated scanner. It's very good at finding missing headers, insecure cookies and common injection flaws, but it doesn't understand your business logic, such as whether one customer can see another's orders. A penetration test adds a person who looks for those.
Can a ZAP scan break my website?
The crawl only reads. The active scan sends many requests and submits test input to forms, so it can create test records, send contact-form emails or add load to a small server. Run it outside busy hours and only on sites you own.
Our report shows 0 High alerts. Are we secure?
It means ZAP didn't find the common serious flaws it tests for on the pages it could reach. Pages behind a login aren't crawled unless the scan is given an account, so keep your software updated and re-scan after big changes.
Should I run ZAP myself?
You can: it's free from zaproxy.org and gives you full control, including authenticated scans. FreshScanSentry's Deep Scan runs it for you from an isolated machine, adds a full Nmap scan of the server, and explains each finding in plain language, which saves time if you're not a security specialist.
Sources: ZAP alert details · ZAP: Alerts (risk and confidence) · ZAP: Passive scan · ZAP: Active scan · OWASP Top 10