Free learning · Step-by-step guide
How to Learn Web Security Free With PortSwigger Web Security Academy
Start free ethical web security training with interactive labs, a beginner study plan and safe practice boundaries.
What to know first
You can learn web application security without paying for a subscription or experimenting on strangers' websites. PortSwigger Web Security Academy offers free learning material and interactive practice labs on topics such as SQL injection, cross-site scripting and access control. The key is to begin with fundamentals, track what you understand and use only systems you are explicitly permitted to test.
1Begin with the official learning portal
Visit portswigger.net/web-security and explore the learning topics. The Academy describes its training and labs as free; optional account features can help track progress. Start by reading the introduction to a topic before opening exercises. The goal is to understand why a vulnerability exists and how a developer can prevent it, not simply copy a solution into a challenge.
2Choose a sequence that makes sense
If you are new to HTTP, first review requests, responses, cookies, sessions and the difference between client-side and server-side code. Then study authentication and access control before moving to SQL injection and cross-site scripting. Complete beginner-level labs in order. Keep a concise note about the vulnerable behavior, the mitigation and what evidence distinguishes a real finding from a false alarm.
3Practice only in authorized labs
Use the Academy's own interactive lab environments and software that you own or have permission to assess. Do not reproduce attack payloads against public websites without authorization. Some exercises introduce the Burp Suite toolkit; the Community Edition can support learning at no cost, although its capabilities differ from paid editions. Read lab descriptions carefully and follow their intended scope.
4Build a weekly free learning routine
Try three sessions per week: one for reading, one for guided practice and one for explaining the lesson in your own words. For example, record the difference between authentication and authorization, then solve a beginner lab that demonstrates the distinction. Avoid racing through challenges only to increase a score. A small reproducible understanding is more valuable than a long list of copied answers.
5Turn learning into responsible portfolio evidence
Create a personal study log describing lab titles, your own explanations and remediations without exposing private tokens or sensitive data. You can publish a general learning diary or a defensive checklist. Academy progress does not automatically confer a professional qualification or permission to test real services. Keep practicing within the rules of legitimate bug bounty programs and authorized testing environments.
Common questions
Is the Web Security Academy really free?
Yes. PortSwigger advertises the Academy, its learning material and its training labs as free. Optional tools and career certificates are separate questions.
Do I need to know coding first?
Basic HTTP and JavaScript knowledge helps, but you can begin with introductory learning material and build skills alongside the labs.
Official sources and further reading
Check the provider’s current instructions before relying on menus, prices or account restrictions.