PortSwigger Web Security Academy

Web Security Academy pairs explanations of application vulnerabilities with labs where you can investigate them safely. The useful feature is the connection between a written concept and observable application behavior. You can revisit a topic until you understand the request, the server's assumption, and the result of changing the input.

What you will learn

• Understand common web-application vulnerabilities
• Inspect HTTP requests and responses
• Practice vulnerability analysis in hosted labs
• Connect findings to the assumptions that caused them

Who this suits

Best for someone with basic web and HTTP knowledge who wants practical security exercises. Developers can use the labs to understand why defensive rules matter. Follow a beginner learning path first; jumping straight to difficult labs can obscure the underlying concept.

Before you enroll

Lab completion is more useful when you can explain the cause and mitigation without repeating a memorized payload. Keep testing within the academy or other systems where you have authorization. The academy's free training and PortSwigger's separate professional certification are distinct offerings.

Training material and academy labs are free. This listing does not include the separate paid certification exam or promise a completion credential.

Put it into practice

After solving a lab, write the flawed assumption in one sentence and propose a server-side change that addresses the cause.

Source and review

This overview is based on the provider's published information, checked on 11 October 2026. It is an editorial assessment, not a claim that we completed the resource. Time filters are approximate study ranges; projects and exercises can take longer.

View the curriculum and current access options at PortSwigger.

How YellowCourse describes and checks learning resources.