PortSwigger Web Security Academy

What the Web Security Academy is

The Web Security Academy is a free online training center for web application security, run by PortSwigger, the company that makes Burp Suite. The page title reads "Free Online Training from PortSwigger", and the Academy home page says: "It's also why the Academy is 100% free." It is a learner product: anyone who wants to understand how web applications get hacked, from developers and students to bug bounty hunters and professional pentesters, can read the material, solve the labs and track progress with an account. The home page says the Academy "exists to help anyone who wants to learn about web security in a safe and legal manner."

PortSwigger's home page gives the scale: over 270 labs in the Web Security Academy, over 90,000 practitioners worldwide, over 18,000 Discord members, Burp Suite used in over 170 countries, and "Over 400k labs attempted annually." The company describes Burp Suite Professional as "The world's #1 web penetration testing toolkit" and says that "For over 20 years, Burp Suite has set the standard for web security testing."

What learners get

The Academy is built around topics. Each topic is "fully explained in text", many "also include video content to summarize key points", and each comes with interactive labs, described as "realistic puzzles designed to test your skills as a hacker." The page's own summary of the cycle is short: learn about security vulnerabilities, practice hacking like a professional, test yourself in the interactive labs, and track your progress.

The topic list covers most of what a web tester meets in practice: SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), clickjacking, CORS, XXE, SSRF, request smuggling, command injection, server-side template injection, insecure deserialization, path traversal, access control, authentication, OAuth authentication, business logic vulnerabilities, WebSockets, DOM-based vulnerabilities, web cache poisoning, HTTP Host header attacks, information disclosure, file upload vulnerabilities, JWT attacks, prototype pollution, GraphQL API vulnerabilities, race conditions, NoSQL injection, API testing, web LLM attacks and web cache deception. An Essential skills topic sits alongside them.

The home page shows lab counts for the featured and latest topics:

• SQL injection, 16 labs
• Cross-site scripting (XSS), 30 labs
• Cross-site request forgery (CSRF), 8 labs
• XXE injection, 9 labs
• Web cache deception, 5 labs
• Web LLM attacks, 7 labs
• API testing, 5 labs
• NoSQL injection, 4 labs

New material keeps arriving, because "Unlike a textbook, the Academy is constantly updated." The newest set covers AI-powered scanner vulnerabilities: the labs teach "how indirect prompt injection can be used to manipulate AI-powered web application scanners into performing unintended actions, exfiltrating sensitive data, and making unauthorized internal requests." PortSwigger's home page lists Web LLM attacks as the latest lab, marked May '26.

For developers, the material doubles as a secure coding course. The vulnerabilities covered sit in the parts of an application a developer writes every day, from authentication and access control to file uploads, JWTs, OAuth, GraphQL APIs and WebSockets, so working through a topic shows both how the bug is exploited and what causes it.

Learning paths, progress and competition

The Academy menu holds a dashboard, learning paths, all labs, all topics, mystery labs, a Hall of Fame and a leaderboard. With an account, learners "track your progress", and the home page says an account gives access to "your labs, licenses and Academy progress." The pitch on the Academy page is "Learn anywhere, anytime, with free interactive labs and progress-tracking."

The labs are meant to be hard. In PortSwigger's words: "Although we designed the labs to be fun, that doesn't necessarily mean they're easy." Competition is part of the design. Every new lab is announced on Twitter, and "The first Web Security Academy users to solve the lab will win Burp Suite swag", with their names added to the Hall of Fame. Learners who would rather not be listed can stay anonymous. The menu also links interviews with Kamil Vavra, Johnny Villarreal and Andres Rauschecker.

The Academy's tone is deliberate: "Web security training built for humans, not robots." The page admits that "some of the online web application training out there can be a bit dull", which is why the company took "a fully interactive approach" to its design.

Certification

Beyond the free labs, the Academy runs a certification. Its section covers how to prepare, how it works, a practice exam, exam hints and guidance, what the exam involves, FAQs, and a page to validate a certification. The Academy pages do not give the exam's price. The practice exam is there to rehearse before the real attempt.

Tools you will need

Some labs need a testing tool. The page says: "Some of our interactive labs will, by their nature, require you to use tools to solve them." It points learners to PortSwigger's own product: "If you don't have access to Burp Suite Professional, then Burp Suite Community Edition allows you to experiment for free." The product menu presents Community Edition as the manual toolset for starting out in web security testing, and lists Burp Suite Professional, Burp Suite DAST ("The enterprise-enabled dynamic web vulnerability scanner") and Burp AT ("Agentic AI that extends human-led pentesting") as the paid range. The Academy itself costs nothing either way.

Who writes it

The Academy "includes content from PortSwigger's in-house research team, experienced academics, and our Chief Swig Dafydd Stuttard", the author of The Web Application Hacker's Handbook. The home page says the team "literally wrote the book on it." PortSwigger's research team presents at conferences, and the home page lists 2026 talks at Black Hat USA by Gareth Heyes and James Kettle and an appearance at DEF CON 34. The research feeds the Academy: "Our world leading research is ready for action in our talks, labs, and tooling the day it drops."

Community

The community runs on Discord, with over 18,000 members, and the home page describes "A thriving community teaching, learning, and extending Burp together." Featured members include an API security expert from the USA, an extension developer from Italy, a bug hunter from Argentina, a security educator from Canada and a pentester and content creator from the USA. PortSwigger also lists community events such as Burp on Tour 2025 and Security Fest 2025.

Who it suits and who it does not

The Web Security Academy suits anyone who wants to learn web application security properly without paying: students and career changers heading toward pentesting, bug bounty hunters sharpening specific techniques, and developers who want to know how their own code gets attacked. The Academy page puts it this way: "If you want to improve your knowledge of hacking, or you'd like to become a bug bounty hunter or pentester, you're in the right place." The depth of the XSS and SQL injection material and the constant new topics make it useful well past the beginner stage.

The caveats are about format and scope. It is text and labs first, with video only as a summary on many topics, so learners who want a lecture series may find it demanding, and PortSwigger says plainly that the labs are not easy. The scope is web applications only: network, cloud or SOC skills need another platform. The Academy pages describe individual learning and show no team administration or reporting for training managers.