Side by side
OWASP ZAP vs Wapiti
Both stand on dynamic application security testing software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan Open source APIExtensionLinux+3
ZAP combines web scanning with automation, API imports, and CI options at no charge. Check installer requirements and the project's release-support limits before choosing it.
Visit OWASP ZAP Free plan LinuxMacSelf-hosted+1
Choose Wapiti if you need a free, self-hosted scanner with authenticated web scanning, API scanning, and configurable reports. It may be a poor fit if you need a graphical-only tool or cannot meet its Python installation requirements.
Visit WapitiThe facts
| OWASP ZAP | Wapiti | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | Not published |
| Runs on | API, Extension, Linux, Mac, Self-hosted, Windows | Linux, Mac, Self-hosted, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 2 | 1 |
| Maker | Not published | Not published |
| Website | zaproxy.org | wapiti-scanner.github.io |
| On dynamic application security testing software | #1 of 26 | #4 of 26 |
OWASP ZAP: what it does well
- Free and open source.
- Active and passive scans, spidering, alerts, and scan policies.
- YAML automation supports API imports and report generation.
- GitHub Actions support baseline, full, and API scans.
- Dynamically installable add-ons usually need no restart.
What to know first
- Windows and Linux installers require Java 17 or higher.
- The team supports only the latest full release.
- Current releases are unsigned, though checksums are provided.
Wapiti: what it does well
- Free and open source under the GNU General Public License version 2.
- Scans web applications and REST APIs described by OpenAPI files.
- Supports several HTTP authentication methods and login forms.
- Exports reports in six formats.
- Provides controls for scope, exclusions, crawler behavior, and scan time.
What to know first
- It is a command-line tool installed with pip.
- Installation instructions require Python 3.12, 3.13, or 3.14.
- Scans may cause target malfunctions, crashes, or data loss.
Alternatives to OWASP ZAP Alternatives to Wapiti The whole list