Statistics on ZAP

Active Scan Rule Stats Last Month

Mon, 01 Jan 0001 00:00:00 +0000

This page shows the statistics for the top 30 (by alert count) Active Scan rules last month. You can sort on any column - just click on the column headers.

For more details on what the stats mean see the blog post: Monthly Active Scan Rule Statistics

Alert	Status	Alert Count	False Positive %	Average Time in Secs
User Agent Fuzzer	release	44429269	0.002	247
HTTPS Content Available via HTTP	beta	2424190	0	17
Proxy Disclosure	beta	660160	0.052	25
Cookie Slack Detector	beta	604092	0.04	7
SOAP Action Spoofing	beta	517443	0	4
SQL Injection	release	431526	35.427	68
Hidden File Found	release	400742	0.067	20
CORS Header	beta	256283	0	18
Directory Browsing	release	248562	0	18
GET for POST	release	176538	0	7
Backup File Disclosure	beta	147213	1.333	28
Insecure HTTP Method	beta	131341	0.577	6
SOAP XML Injection	beta	128903	0	3
.htaccess Information Leak	release	108339	0	8
Format String Error	release	75459	0.019	8
Buffer Overflow	release	68186	0.04	7
Trace.axd Information Leak	release	67898	0	10
Cross Site Scripting (Reflected)	release	66792	0.002	31
Relative Path Confusion	beta	59465	0	6
HTTP Only Site	beta	59300	0.006	1
.env Information Leak	release	58312	0	8
Path Traversal	release	57590	0.008	125
SQL Injection - SQLite	release	42652	0.636	14
Parameter Tampering	release	30052	0	24
Bypassing 403	beta	26497	0.212	8
Cross Site Scripting (DOM Based)	release	20416	0	217
Anti-CSRF Tokens Check	beta	18459	0.044	4
Integer Overflow Error	beta	14404	0.001	9
Source Code Disclosure - File Inclusion	beta	13523	2.43	4
NoSQL Injection - MongoDB	alpha	13434	1.91	11

Bar Charts

Mon, 01 Jan 0001 00:00:00 +0000

We measure and record a range of statistics related to ZAP, some of which are made public here.

The blog post: Collecting Statistics for Open Source Projects explains how this all works.

Check for Updates

The number of Check for Update requests received per month. From 2.9.0 the suffix 'd' indicates ZAP is running as a daemon rather than the desktop.

The ‘devw’ label is used for the development version of ZAP, these stats were not reliably recorded before 2020-11-01.

Highest False Positives Last Month

Mon, 01 Jan 0001 00:00:00 +0000

These were the alerts most frequently flagged as false positives using Alert Filters last month.

Note that this does not necessarily mean they are false positives, it could mean that the people using ZAP are not interested in these specific vulnerabilities.

Position	Alert	Status	Rule Type
1	Cookie without SameSite Attribute	release	Passive
2	Information Disclosure - Suspicious Comments	release	Passive
3	Session ID in URL Rewrite	release	Passive
4	Cross-Domain Misconfiguration	release	Passive
5	SQL Injection	release	Active
6	X-Content-Type-Options Header Missing	release	Passive
7	Source Code Disclosure - PHP	beta	Passive
8	Retrieved from Cache	release	Passive
9	Re-examine Cache-control Directives	release	Passive
10	Loosely Scoped Cookie	release	Passive
11	Content Security Policy (CSP) Header Not Set	release	Passive
12	Strict-Transport-Security Header	release	Passive
13	Cross-Domain JavaScript Source File Inclusion	release	Passive
14	Session Management Response Identified	beta	Passive
15	CSP	release	Passive
16	HTTP Server Response Header	release	Passive
17	Timestamp Disclosure - Unix	release	Passive
18	Sub Resource Integrity Attribute Missing	beta	Passive
19	Modern Web Application	release	Passive
20	Backup File Disclosure	beta	Active

Pie Charts

Mon, 01 Jan 0001 00:00:00 +0000

Some stats are shown for all pings and for desktop only pings. The desktop pings show a significantly different profile, possibly because many automated ZAP scans run in the cloud and many cloud providers are located in the USA. We also know that quite a few companies run ZAP as a SaaS offering which will also skew the stats.

Top ZAP Add-Ons Last Month

Mon, 01 Jan 0001 00:00:00 +0000

These were the most frequently installed optional add-ons last month.

Note that this does not mean they were the most used add-ons - that is harder to quantify.

Position	Add-On	Status	ID	Last Updated
1	Import/Export	beta	exim	2026-05-07
2	Database	alpha	database	2025-12-15
3	Spider	release	spider	2026-04-02
4	Requester	beta	requester	2026-03-02
5	Postman Support	alpha	postman	2025-12-15
6	Authentication Helper	beta	authhelper	2026-05-06
7	Passive Scanner	alpha	pscan	2025-12-15
8	Client Side Integration	alpha	client	2026-05-27
9	Scan Policies	alpha	scanpolicies	2026-03-31
10	Sequence	beta	sequence	2025-12-15
11	Passive scanner rules (beta)	beta	pscanrulesBeta	2026-04-14
12	Insights	alpha	insights	2026-04-23
13	Active scanner rules (beta)	beta	ascanrulesBeta	2026-05-06
14	Passive scanner rules (alpha)	alpha	pscanrulesAlpha	2026-04-14
15	Access Control Testing	alpha	accessControl	2026-04-14
16	Plug-n-Hack Configuration	beta	plugnhack	2022-10-27
17	gRPC Support	alpha	grpc	2024-07-02
18	HTTPS Info	alpha	httpsInfo	2026-03-31
19	Community Scripts	alpha	communityScripts	2024-07-01
20	Active scanner rules (alpha)	alpha	ascanrulesAlpha	2026-05-06