Implementasi Keamanan Website Alfarouq Tour Travel Berdasarkan Temuan Kerentanan Owasp Zap

Abstract

Websites used for tourism services process personal and transaction information, making security evaluation important to reduce the risk of misuse and data exposure. This study implements security improvements on the Alfarouq Tour Travel website based on vulnerability findings identified using OWASP Zed Attack Proxy (ZAP). The research uses an applied experimental approach consisting of an initial security scan, classification and analysis of findings, planning and implementation of remediation, re-scanning, and comparison of conditions before and after remediation. The initial scan using OWASP ZAP 2.16.1 on 25 April 2025 found no High-risk alerts, but identified three Medium-risk alert types with 57 instances: Absence of Anti-CSRF Tokens (1), Content Security Policy Header Not Set (30), and Missing Anti-clickjacking Header (26). Remediation was implemented through CSRF token protection and request-flow adjustment, Content Security Policy configuration, and X-Frame-Options together with the frame-ancestors directive. The re-scan on 30 December 2025 showed that all three Medium-risk alert types were no longer detected, reducing Medium instances from 57 to 0. Six Low-risk and six Informational alert types remained. The findings indicate that remediation based on ZAP results met the study’s success indicator for the three targeted Medium-risk findings within the tested scope, while further assessment is still required for residual findings and system areas not reached by the scan.