SEO title: How to Install and Configure OWASP ZAP Proxy on macOS
Meta description: Learn how to install OWASP ZAP on an Intel or Apple Silicon Mac, configure its proxy, install the ZAP root certificate, connect Chrome, Safari, or Firefox, and verify intercepted traffic.
Suggested URL: /install-configure-owasp-zap-proxy-macos
Updated: July 2026
Tested with: ZAP 2.17.0

Introduction

ZAP, commonly known as OWASP ZAP or Zed Attack Proxy, is a free and open-source web application security testing tool.

ZAP sits between your browser and a web application:

Browser
   |
   | HTTP or HTTPS request
   v
OWASP ZAP Proxy
   |
   | Request forwarded to application
   v
Web Application

This position allows ZAP to:

Capture browser requests and server responses
Passively inspect web traffic
Modify requests
Crawl web applications
Test authentication and sessions
Identify common web vulnerabilities
Perform active security scans
Generate security reports

This guide explains how to install and configure ZAP on macOS so that someone using it for the first time can follow every step.

Important Legal and Safety Warning

Only use ZAP against:

Applications you own
Applications running in your local lab
Training applications
Systems for which you have written authorization

An active ZAP scan sends attack payloads to the target. It can alter data, create records, trigger business operations, overload services or damage an application.

ZAP’s documentation distinguishes passive scanning—which observes proxied traffic—from active scanning, which sends real attack payloads. Active scanning must only be performed against authorized targets.

For this installation guide, begin in Safe Mode and use only passive browsing until you understand the tool.

What You Will Accomplish

By the end of this guide, you will be able to:

Identify whether your Mac uses Apple Silicon or Intel.
Download the correct ZAP installer.
Verify the downloaded installer.
Install and start ZAP.
configure its local proxy.
Launch a browser through ZAP.
Configure an existing browser manually.
install and trust the ZAP root certificate.
Verify that HTTP and HTTPS traffic reaches ZAP.
Troubleshoot common macOS issues.
safely remove the proxy and certificate when finished.

Prerequisites

You need:

A Mac running a maintained version of macOS
An administrator account
An internet connection
Approximately 1 GB of free disk space
Chrome or Firefox for the easiest browser-based testing
Permission to test your target application

The current macOS ZAP package includes Java 17, so you do not need to install Java separately when using the official macOS installer. The current stable release is ZAP 2.17.0, and separate installers are available for Intel and Apple Silicon Macs.

Part 1: Determine Your Mac Processor

Before downloading ZAP, determine whether your Mac uses an Apple Silicon or Intel processor.

Step 1: Open Terminal

Press Command + Space.
Type:

Terminal

Press Return.

Step 2: Check the processor architecture

Run:

uname -m

You will see one of the following results.

Result	Mac type	Installer required
`arm64`	Apple Silicon, such as M1, M2, M3, M4 or newer	Apple Silicon/aarch64
`x86_64`	Intel Mac	Intel/amd64

You can also check through the graphical interface:

Open the Apple menu.
Select About This Mac.
Look for either Chip or Processor.

Part 2: Choose an Installation Method

There are two common ways to install ZAP on macOS:

Method A: Official macOS installer

This is the recommended approach for beginners.

Advantages:

Official ZAP package
Separate Apple Silicon and Intel builds
Java is included
No package manager is required
Easy to troubleshoot

Method B: Homebrew

Homebrew currently supports:

brew install --cask zap

However, the Homebrew cask is marked as deprecated and scheduled to be disabled on September 1, 2026. Therefore, the official macOS installer is the safer long-term choice for this guide.

Part 3: Install ZAP Using the Official Installer

Step 1: Download ZAP

Open the official ZAP download page in your browser.

Select the installer matching your Mac:

For Apple Silicon

Download:

ZAP_2.17.0_aarch64.dmg

For Intel Mac

Download:

ZAP_2.17.0.dmg

The official release page lists both macOS packages and publishes SHA-256 checksums for verifying them.

Do not download ZAP from unknown software-download websites.

Step 2: Find the downloaded file

By default, the file should be in:

Finder → Downloads

You can also check from Terminal:

ls -lh ~/Downloads/ZAP*.dmg

You should see the downloaded DMG file.

Step 3: Verify the installer checksum

Checksum verification confirms that your downloaded file matches the file published by the ZAP project.

Open Terminal and move to the Downloads directory:

cd ~/Downloads

Verify the Apple Silicon package

shasum -a 256 ZAP_2.17.0_aarch64.dmg

The expected SHA-256 value for ZAP 2.17.0 is:

3b3c6c8b105a33cb2a7d718e7f9aa41418a6d8aae3887d94a42523b5eeac723b

Verify the Intel package

shasum -a 256 ZAP_2.17.0.dmg

The expected SHA-256 value is:

a3d246125dd6e576036af8fb29f90377fc72a0a5df8c89c54711972b449582c7

These values are published on the official ZAP 2.17.0 release page.

What should you check?

The value printed by Terminal must exactly match the official value.

If it does not match:

Delete the downloaded file.
Download it again from the official source.
Repeat the checksum verification.
Do not install a file whose checksum is incorrect.

Step 4: Open the DMG

Open Finder.
Open Downloads.
Double-click the ZAP DMG file.
Wait for macOS to mount the disk image.
Double-click the ZAP installer or application shown in the window.

Follow the installer prompts:

Read the license agreement.
Select Accept if you agree.
Choose Standard Installation.
Continue through the installation.
Select Finish when installation completes.

The Standard option is appropriate for most beginners. The Custom option is mainly useful when you need to change the installation location or included components.

Part 4: Handle the macOS Security Warning

ZAP releases may display a warning such as:

“ZAP.app” cannot be opened because the developer cannot be verified.

The official ZAP documentation currently warns that this may happen on macOS.

Do not disable macOS security globally.

Safe way to allow ZAP

Attempt to open ZAP once.
When the warning appears, select Cancel.
Open the Apple menu.
Select System Settings.
Open Privacy & Security.
Scroll down to the Security section.
Find the message saying ZAP was blocked.
Select Open Anyway.
Authenticate with Touch ID or your administrator password.
Confirm by selecting Open.

Apple documents this controlled override for applications from an unknown or unverified developer.

Only approve the application after downloading it from the official source and verifying its checksum.

Part 5: Start ZAP for the First Time

You can launch ZAP from:

Finder → Applications → ZAP

You can also press Command + Space, type:

ZAP

and press Return.

From Terminal, you may try:

open -a ZAP

Step 1: Accept the terms

On the first launch:

Read the displayed license or terms.
Select Agree if you accept them.
Wait for the ZAP desktop interface to load.

Step 2: Choose whether to save the session

ZAP will ask whether you want to persist the session.

You will normally see options similar to:

Persist the session with a chosen name and location
Persist the session using default settings
Do not persist this session

For your first test, select:

No, I do not want to persist this session at this moment in time

Then select Start.

A non-persistent session is deleted when ZAP exits. Persisted sessions retain captured requests, responses, sites, alerts and related testing data.

Security note

ZAP sessions can contain:

URLs
Authentication cookies
Request bodies
API parameters
Headers
Personal information
Application responses
Tokens and session identifiers

Store persistent sessions only in an approved and protected location.

Part 6: Understand the ZAP Interface

The main ZAP window contains several important areas.

Menu bar

The menu bar includes options such as:

File
Edit
View
Analyse
Report
Tools
Help

Toolbar

The toolbar provides quick access to:

Operating modes
Breakpoints
Add-ons
Browser launching
Scanning controls

Sites tree

The Sites tree appears on the left side.

It displays websites and endpoints observed through ZAP.

Example:

Sites
└── https://my-application.test
    ├── login
    ├── dashboard
    ├── api
    └── logout

Request and response area

When you select an entry, ZAP shows:

HTTP request headers
HTTP request body
HTTP response headers
HTTP response body

Information tabs

The lower area can show:

History
Alerts
Spider results
Active Scan progress
Output
WebSocket messages
Search results

The official ZAP guide describes these as the Tree Window, Workspace Window and Information Window.

Part 7: Put ZAP in Safe Mode

Before connecting a browser, switch ZAP to Safe Mode.

Steps

Look at the main ZAP toolbar.
Find the mode selection dropdown.
Open the dropdown.
Select:

Safe Mode

Safe Mode restricts potentially dangerous operations.

This is the best starting mode for:

Learning the interface
Capturing browser traffic
Inspecting requests
Running passive analysis
Confirming proxy configuration

The official getting-started guide specifically recommends Safe Mode when you want to prevent ZAP from performing potentially harmful actions.

Part 8: Update the ZAP Add-ons

ZAP uses add-ons to provide scanners, spiders, browser integration, reporting and other features.

Steps

Start ZAP.
Find the Manage Add-ons button in the toolbar.

Alternatively, open the relevant option from the ZAP marketplace or tools menu.

Open the Updates or Installed section.
Install available updates.
Restart ZAP if requested.

The ZAP Marketplace provides free add-ons and can be accessed directly from the desktop toolbar.

For your first setup, ensure that commonly used components are installed, including:

Quick Start
Network
Passive scanner rules
Browser integration
Client Spider
Report generation
Selenium-related browser support, when required

Do not install every available experimental add-on immediately. Start with the default stable components.

Part 9: Check the ZAP Proxy Address and Port

By default, ZAP listens on:

Address: localhost
Port: 8080

localhost means that only applications running on your Mac can connect to that listener.

Steps

Open ZAP.
Select Tools.
Select Options.
Expand Network.
Select Local Servers/Proxies.
Locate Main Proxy.

Confirm that it shows:

Address: localhost
Port: 8080

Depending on the displayed values, you may also see:

127.0.0.1

This is equivalent to the IPv4 loopback address for your local Mac.

ZAP’s main proxy is configured under Network → Local Servers/Proxies, and the browser must use the same address and port.

Recommended beginner configuration

Use:

Address: 127.0.0.1
Port: 8080

Do not use:

0.0.0.0

for a basic local setup.

Binding ZAP to 0.0.0.0 may make it accessible through other network interfaces. That is unnecessary and potentially unsafe for a beginner workstation.

Part 10: Check Whether Port 8080 Is Available

Open Terminal and run:

lsof -nP -iTCP:8080 -sTCP:LISTEN

When ZAP is running, you should see a Java or ZAP-related process listening on port 8080.

If another application is already using port 8080, either stop that application or change ZAP to another port, such as:

To change the port:

Open Tools → Options.
Open Network → Local Servers/Proxies.
Select the main proxy.
Change the port from 8080 to 8090.
Save the settings.
Configure the browser to use the same new port.

The browser port and the ZAP port must always match.

Part 11: Recommended Browser Configuration for Beginners

There are two ways to send browser traffic through ZAP.

Option 1: Launch a browser directly from ZAP

This is the recommended approach.

Option 2: Manually configure your normal browser

This is useful when you need:

Your existing browser profile
Installed browser extensions
Stored development credentials
A specific browser configuration
Persistent testing sessions

Start with Option 1.

Part 12: Launch a Preconfigured Browser from ZAP

A browser launched by ZAP is automatically configured to use the ZAP proxy.

ZAP also creates a temporary browser profile, so your normal browser profile is not modified.

Steps

Start ZAP.
Open the Quick Start tab.
Select Manual Explore.
Enter a URL you are authorized to access.

For a simple proxy verification, you may use:

https://example.com

Do not run an active scan against it. Use it only to verify normal browsing and passive traffic capture.

Select Chrome or Firefox.
Leave Enable HUD disabled for your first test.
Select Launch Browser.

ZAP will open a new browser window with a temporary profile.

Browsers launched through the Quick Start Manual Explore feature are preconfigured to use ZAP and ignore the certificate warnings that would otherwise occur during HTTPS interception.

Verify the captured traffic

In the launched browser:

Open the target website.
Navigate through one or two pages.
Return to ZAP.
Look at the Sites tree.
Open the History tab.

You should see entries such as:

GET https://example.com/

Select an entry.

ZAP should show:

The request method
The requested URL
Request headers
Response status
Response headers
Response content

Your ZAP proxy is now working.

Part 13: Understand Passive Scanning

ZAP automatically performs passive scanning on traffic that passes through the proxy.

Passive scanning examines requests and responses without sending additional attack requests.

It may detect issues such as:

Missing security headers
Insecure cookies
Information disclosure
Cache-control weaknesses
Content-type problems
Cross-origin policy issues
Suspicious response content

The ZAP documentation states that passive scanning does not modify application responses and runs in the background while you explore the application.

To view the findings:

Open the Alerts tab.
Expand a risk category.
Select an alert.
Review:
- Risk
- Confidence
- Description
- Evidence
- URL
- Parameter
- Recommended solution
- Reference information

An alert is not automatically proof of a vulnerability. Review the evidence and confirm the result manually.

Part 14: Manually Configure Chrome or Safari on macOS

Chrome and Safari can use the macOS system proxy.

This method changes the proxy for applications that follow the macOS network proxy configuration—not just one browser.

Before proceeding

Keep ZAP running. If you configure the system proxy and then close ZAP, applications may lose internet access until you disable the proxy again.

Steps

Open the Apple menu.
Select System Settings.
Select Network.
Select your active connection:
- Wi-Fi, or
- Ethernet
Select Details.
Select Proxies.

Apple documents this path as:

System Settings → Network → Network service → Details → Proxies

Configure the HTTP proxy

Enable:

Web Proxy (HTTP)

Enter:

Server: 127.0.0.1
Port: 8080

Do not enable proxy authentication.

Configure the HTTPS proxy

Enable:

Secure Web Proxy (HTTPS)

Enter:

Server: 127.0.0.1
Port: 8080

Again, do not enable proxy authentication.

Apple’s proxy settings provide separate entries for HTTP and HTTPS proxy servers.

Save the configuration

Select OK or Done.
Close System Settings.
Keep ZAP running.
Open Chrome or Safari.
Browse to a test URL.
Confirm that the request appears in ZAP.

Part 15: Configure Firefox Manually

Firefox can either use the macOS system proxy or maintain its own proxy configuration.

Recommended Firefox configuration

Open Firefox.
Open Settings.
Select General.
Scroll down to Network Settings.
Select Settings.
Select Manual proxy configuration.
Enter:

HTTP Proxy: 127.0.0.1
Port: 8080

Enable the option to use the same proxy for HTTPS, when displayed.

Alternatively, select:

Use system proxy settings

when you have already configured the macOS proxy.

Mozilla documents both manual proxy configuration and use of the operating system’s proxy settings.

Part 16: Why HTTPS Requires a ZAP Certificate

Plain HTTP traffic is not encrypted.

HTTPS traffic is encrypted between the browser and the web server.

To inspect HTTPS, ZAP creates two encrypted connections:

Browser
   |
   | HTTPS encrypted with a ZAP-generated certificate
   v
ZAP
   |
   | HTTPS encrypted with the real server certificate
   v
Web Server

ZAP dynamically generates a certificate for each HTTPS hostname and signs it using its own ZAP Root CA certificate.

Your browser does not trust this private certificate authority by default. Therefore, a manually configured browser may display certificate errors until you trust the ZAP Root CA.

ZAP documents this as a manipulator-in-the-middle process in which its Root CA signs the certificates generated for intercepted HTTPS websites.

Part 17: Export the ZAP Root CA Certificate

You do not normally need this when using a browser launched directly from ZAP.

You need it when manually proxying an existing browser or another HTTP client.

Steps

Open ZAP.
Select Tools.
Select Options.
Expand Network.
Select Server Certificates.
Locate the Root CA certificate section.
Select Save.
Save the certificate somewhere easy to find, such as:

Downloads

Use a recognizable filename:

zap-root-ca.cer

ZAP generates a Root CA during the first run. When the browser-launch feature is not used, the certificate must be installed in the browser or client that sends HTTPS traffic through ZAP.

Part 18: Install the ZAP Certificate in macOS Keychain

Step 1: Open Keychain Access

Press Command + Space.
Type:

Keychain Access

Press Return.

Step 2: Choose a keychain

In the left panel, select:

login

for your current user.

For a system-wide installation, select:

System

System-wide installation normally requires administrator privileges.

Step 3: Import the certificate

You can import it in either of these ways:

Method A

Drag zap-root-ca.cer from Finder into Keychain Access.

Method B

Use the import option from the Keychain Access menu and choose the certificate file.

Apple confirms that certificates can be added by selecting the login or System keychain and dragging the certificate file into Keychain Access.

Part 19: Trust the ZAP Certificate

Importing a certificate does not always mean it is trusted automatically.

Steps

In Keychain Access, select Certificates.
Search for:

ZAP

or:

Zed Attack Proxy Root CA

Double-click the certificate.
Expand the Trust section.
Change:

When using this certificate

to:

Always Trust

Close the certificate window.
Enter your administrator password or use Touch ID.
Restart the browser.

Apple’s Keychain Access documentation explains that certificate trust is changed by opening the certificate, expanding Trust and selecting a new trust setting.

Certificate security warning

Trusting the ZAP Root CA allows that ZAP installation to generate certificates your Mac considers trusted.

Therefore:

Export the certificate only from your own ZAP installation.
Do not download a ZAP root certificate from another person.
Do not share a certificate that includes its private key.
Do not install an unknown interception certificate.
Remove the certificate when it is no longer required.
Do not perform personal banking or other sensitive browsing through the ZAP proxy.

For daily work, a temporary browser launched by ZAP is usually safer and easier than changing the Mac-wide proxy and certificate configuration.

Part 20: Test HTTP Proxying from Terminal

You can test ZAP without a browser by using curl.

Keep ZAP running and execute:

curl -x http://127.0.0.1:8080 http://example.com -I

Explanation:

curl sends an HTTP request.
-x specifies the proxy.
127.0.0.1 is your Mac.
8080 is the default ZAP proxy port.
-I requests response headers only.

Return to ZAP and open the History tab.

You should see the request.

If you changed ZAP to port 8090, use:

curl -x http://127.0.0.1:8090 http://example.com -I

Part 21: Safely Test an Application

For an initial test:

Put ZAP in Safe Mode.
Open Quick Start.
Select Manual Explore.
Enter the URL of an application you own or are authorized to test.
Launch Chrome or Firefox from ZAP.
Browse through the application normally.
Log in with a dedicated testing account.
Visit each authorized function.
Return to ZAP.
Review the Sites, History and Alerts tabs.

During manual exploration, ZAP builds the site tree and passively scans all requests and responses passing through it. ZAP recommends combining browser-based manual exploration with automated crawling because manual navigation can reach authenticated forms and workflows that spiders may not understand.

Do not select Attack or start an active scan during this setup verification.

Part 22: When to Persist a ZAP Session

Once the setup works, you may want to preserve your work.

Use a persistent session when:

Testing takes place over several days
Findings must be reviewed later
You need to preserve request history
You need to preserve contexts or authentication settings
You are preparing a report
You need an auditable test record

Do not persist a session when:

You are only testing the installation
The traffic contains highly sensitive production data
Your organization prohibits storing session tokens
You do not have an approved storage location

When saving a session, use a meaningful filename:

customer-portal-staging-2026-07-26.session

Never commit ZAP sessions to a public Git repository.

Part 23: Recommended Beginner Configuration

Use the following baseline.

ZAP listener

Address: 127.0.0.1
Port: 8080

ZAP operating mode

Safe Mode

Browser

Browser launched through Quick Start → Manual Explore

Session

Do not persist for the first test

Add-ons

Install stable updates
Avoid experimental add-ons initially

Scanning

Passive scanning only

Target

Local, lab, staging or explicitly authorized application

Certificate

Do not install system-wide unless an existing browser profile is required

This configuration minimizes accidental scanning and avoids changing the Mac-wide proxy unnecessarily.

Part 24: Common Problems and Solutions

Problem 1: ZAP cannot be opened

Symptom

“ZAP.app” cannot be opened because the developer cannot be verified.

Solution

Verify that you downloaded ZAP from the official source.
Verify its SHA-256 checksum.
Attempt to open it once.
Open System Settings → Privacy & Security.
Select Open Anyway.
Authenticate and confirm.

Do not disable Gatekeeper globally.

Problem 2: Port 8080 is already in use

Run:

lsof -nP -iTCP:8080 -sTCP:LISTEN

If another program is using the port:

Stop that program, or
Change ZAP to port 8090.

Then update the browser proxy to:

127.0.0.1:8090

Problem 3: Browser has no internet connection

Possible causes:

ZAP is not running.
The browser is configured to use ZAP.
The system proxy is still enabled.
The browser proxy port does not match ZAP.
A VPN or corporate proxy is interfering.

Solution

Start ZAP.
Confirm ZAP listens on the configured port.
Check the browser proxy address.
If finished testing, disable the macOS proxy.
Restart the browser.

Problem 4: HTTPS websites show certificate warnings

Possible causes:

The ZAP Root CA was not installed.
The certificate was imported but not trusted.
The browser was not restarted.
The certificate came from a different ZAP installation.
The ZAP root certificate has expired or changed.

Simplest solution

Use:

Quick Start → Manual Explore → Launch Browser

The launched browser is configured by ZAP.

Existing-browser solution

Export the current Root CA from ZAP.
Import it into Keychain Access.
Set it to Always Trust.
Restart the browser.

Problem 5: No requests appear in ZAP

Check the following:

Is ZAP running?
Does the browser use 127.0.0.1:8080?
Does ZAP listen on port 8080?
Did you configure both HTTP and HTTPS?
Are you using the browser launched by ZAP?
Is a browser extension overriding the proxy?
Is a VPN or corporate security tool controlling the proxy?

Test with:

curl -x http://127.0.0.1:8080 http://example.com -I

If the curl request appears in ZAP, the ZAP listener works and the problem is probably in the browser configuration.

Problem 6: Localhost application does not appear

Browsers may treat loopback destinations differently.

For a local application, the easiest approach is:

Start ZAP.
Open Manual Explore.
Enter the complete local URL, for example:

http://localhost:3000

Launch the browser from ZAP.

This avoids many manual browser bypass problems.

Problem 7: Firefox does not trust the certificate

First try using the Firefox instance launched directly by ZAP.

For an existing Firefox profile:

Confirm the ZAP certificate is trusted in macOS Keychain.
Open Firefox network settings.
Select Use system proxy settings.
Restart Firefox.

Modern Firefox versions can use third-party root certificates from the operating system’s certificate store, subject to the browser’s certificate settings.

Problem 8: ZAP consumes too much memory

ZAP stores traffic, site data, responses and scan results.

To reduce usage:

Start a new session for each assessment.
Avoid browsing unrelated websites through ZAP.
Exclude large media files where appropriate.
Do not capture your entire system’s traffic.
Close unused tabs.
Do not run several spiders or scans simultaneously.
Delete temporary sessions after testing.

Part 25: Disable the macOS Proxy After Testing

This step is extremely important when you manually changed the macOS proxy.

Steps

Open the Apple menu.
Open System Settings.
Select Network.
Select your active Wi-Fi or Ethernet connection.
Select Details.
Select Proxies.
Disable:
- Web Proxy (HTTP)
- Secure Web Proxy (HTTPS)
Select OK or Done.
Restart the browser if necessary.

Your browser should now connect directly to the internet.

If you forget this step and close ZAP, Chrome, Safari and other applications using the system proxy may appear to have no internet connection.

Part 26: Remove the ZAP Certificate After Testing

Remove the Root CA when you no longer need to intercept HTTPS through your normal browser.

Steps

Open Keychain Access.
Select the keychain where you installed the certificate.
Select Certificates.
Search for:
- ZAP
- Zed Attack Proxy
- ZAP Root CA
Confirm that you selected the certificate installed for your own ZAP instance.
Right-click it.
Select Delete.
Enter your administrator password if requested.
Restart your browser.

Do not delete unrelated corporate or operating-system certificates.

Part 27: Update ZAP

The ZAP project recommends using the latest full release and only officially supports the latest full version.

For an installation created with the official package:

Check the official ZAP download page.
Compare your installed version.
Download the latest matching macOS package.
Verify its checksum.
Install the update.
Open Manage Add-ons.
Install available add-on updates.

To see your current version:

ZAP → About ZAP

or:

Help → About

depending on the displayed macOS menu layout.

Part 28: Uninstall ZAP

Remove the application

Quit ZAP.
Open Finder.
Open Applications.
Locate ZAP.
Move it to the Trash.
Empty the Trash when appropriate.

Remove associated security configuration

Also remember to:

Disable the HTTP proxy.
Disable the HTTPS proxy.
Delete the ZAP Root CA certificate from Keychain Access.
Remove unneeded ZAP sessions and reports.
Review retained testing files for sensitive data.

Homebrew uninstall

For an installation created through Homebrew:

brew uninstall --cask zap

Certificate and proxy cleanup must still be performed manually.

Complete Verification Checklist

Your configuration is complete when all of the following are true:

[ ] Correct Apple Silicon or Intel installer was downloaded
[ ] Installer checksum was verified
[ ] ZAP starts successfully
[ ] Stable add-ons are updated
[ ] ZAP is in Safe Mode
[ ] Main proxy listens on 127.0.0.1:8080
[ ] A browser launches from Manual Explore
[ ] Browsed URLs appear in the Sites tree
[ ] Requests appear in the History tab
[ ] HTTPS works in the ZAP-launched browser
[ ] Passive alerts can be reviewed
[ ] No unauthorized active scan was performed
[ ] System proxy can be disabled after testing
[ ] Root certificate can be removed when no longer required

Recommended Workflow for a New ZAP User

Use this sequence during your first few sessions:

1. Start ZAP
2. Choose a temporary session
3. Select Safe Mode
4. Update stable add-ons
5. Open Quick Start
6. Select Manual Explore
7. Enter an authorized URL
8. Launch Chrome or Firefox from ZAP
9. Browse the application normally
10. Review Sites
11. Review History
12. Review passive Alerts
13. Close the temporary browser
14. Exit ZAP

Avoid manually configuring the entire Mac until you specifically need your normal browser profile.

Final Summary

The safest and easiest macOS setup for a beginner is:

Official macOS ZAP installer
        +
Correct Intel or Apple Silicon package
        +
Checksum verification
        +
Safe Mode
        +
Quick Start Manual Explore
        +
ZAP-launched temporary browser
        +
Passive scanning only

The browser launched by ZAP already uses the correct proxy configuration and handles the testing certificate. This avoids most proxy and HTTPS problems.

Manual browser configuration is needed only when you want to use an existing browser profile. In that case:

ZAP listener:
127.0.0.1:8080

macOS HTTP proxy:
127.0.0.1:8080

macOS HTTPS proxy:
127.0.0.1:8080

You must also export the ZAP Root CA certificate, import it into macOS Keychain Access and explicitly trust it.

After testing, always disable the system proxy and remove the ZAP certificate when it is no longer needed.

DevSecOps School

How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner’s Guide

OWASP Dependency-Check vs OWASP Dependency-Track: Features, Differences, Evolution, Milestones and Best Use Cases

From OWASP ZAP to ZAP: The Evolution of a Leading Web Security Tool

How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner’s Guide

OWASP Dependency-Check vs OWASP Dependency-Track: Features, Differences, Evolution, Milestones and Best Use Cases

From OWASP ZAP to ZAP: The Evolution of a Leading Web Security Tool

How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner’s Guide

OWASP Dependency-Check vs OWASP Dependency-Track: Features, Differences, Evolution, Milestones and Best Use Cases

From OWASP ZAP to ZAP: The Evolution of a Leading Web Security Tool

How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner’s Guide

OWASP Dependency-Check vs OWASP Dependency-Track: Features, Differences, Evolution, Milestones and Best Use Cases

From OWASP ZAP to ZAP: The Evolution of a Leading Web Security Tool