OWASP ZAP
The most widely used open-source web application scanner.
What it does
ZAP crawls your entire site and actively attacks its own forms, parameters, headers and sessions, testing thousands of ways an attacker could break your specific code — from injection and cross-site scripting to broken authentication and insecure configuration.
What data you get
A ranked list of findings with severity, the exact URL and parameter affected, evidence of the issue, and a description of how to reproduce and fix each one.
Why it matters to your site
This is the broadest look at flaws that live in code you wrote or configured — the ones no public vulnerability database can warn you about because they are unique to your site.
More in this category
Other general-purpose tools
Wapiti
Black-box scanner that audits your site by injecting real payloads.
Skipfish
High-speed active reconnaissance and security probe.
Vega
GUI-driven scanner and intercepting proxy in one.