How to Install DVWA on Windows 11 With XAMPP

Installing DVWA on Windows 11 with XAMPP is a practical way to create a local web security training environment without setting up Apache, PHP, and a database server separately.

DVWA, or Damn Vulnerable Web Application, is intentionally insecure. It is designed for students, developers, teachers, and security professionals who want to learn how common web vulnerabilities work in a controlled environment.

The official DVWA project specifically recommends XAMPP as an easy option for Windows users who do not already have a web server configured. The project also recommends downloading the latest source from its official digininja/DVWA GitHub repository.

In this guide, you will learn how to:

• Install XAMPP on Windows 11
• Download the official DVWA files
• Add DVWA to XAMPP
• Configure config.inc.php
• Create a dedicated DVWA database
• Configure PHP
• Run the DVWA setup page
• Log in to DVWA
• Open DVWA on localhost
• Fix common installation errors

Important: DVWA is deliberately vulnerable. Use it only on your own computer or another system you have permission to test. Do not expose your DVWA installation to the public Internet.

DVWA Windows 11 Installation: Quick Overview

Here is the complete process in simple form:

1. Install XAMPP.
2. Start Apache and the database service.
3. Download DVWA from the official GitHub repository.
4. Extract DVWA into C:\xampp\htdocs\.
5. Rename the folder to DVWA.
6. Copy config.inc.php.dist to config.inc.php.
7. Create a dvwa database and database user.
8. Check the DVWA database settings.
9. Configure required PHP settings.
10. Restart Apache.
11. Open the DVWA setup page.
12. Click Create / Reset Database.
13. Log in using the default credentials.

A typical finished installation can be accessed at:

http://localhost/DVWA/

What Is DVWA?

DVWA stands for Damn Vulnerable Web Application.

It is an intentionally insecure PHP web application created for learning web application security.

Instead of trying to remove every weakness, DVWA deliberately contains vulnerabilities so learners can understand:

• How vulnerable web applications behave
• Why insecure coding practices are dangerous
• How user input reaches an application
• How database queries can become unsafe
• How sessions and authentication work
• How browser security affects web applications
• How security controls change application behavior
• How secure code differs from vulnerable code

DVWA should be treated as a security laboratory, not as a normal website.

What Is XAMPP?

XAMPP is a local web-server package that makes it easier to run PHP applications on Windows.

It provides the main components required to run DVWA, including:

• Apache web server
• PHP
• Database server
• phpMyAdmin
• Supporting utilities

This saves beginners from installing and configuring every component separately.

The official DVWA documentation describes XAMPP as one of the easiest ways to install DVWA on Windows.

Why Install DVWA With XAMPP?

There are several ways to install DVWA, including Docker and manual server installation.

XAMPP is useful when you want to understand the traditional web-server setup.

Advantages of XAMPP

XAMPP gives you:

• A simple graphical control panel
• Apache and PHP in one package
• Easy database management
• phpMyAdmin
• Direct access to PHP configuration files
• A familiar localhost/DVWA URL
• Easy access to DVWA source files

It is especially useful for beginners who want to understand how PHP applications are hosted.

Requirements for Installing DVWA on Windows 11

Before starting, you should have:

• Windows 11
• Administrator access to your computer
• XAMPP
• DVWA source files
• A modern web browser
• Enough disk space for the local environment

You do not need:

• Kali Linux
• A public server
• Paid hosting
• A DVWA ISO
• A separate virtual machine

A virtual machine can improve isolation, but it is not required for a basic localhost installation.

Step 1: Download XAMPP for Windows 11

Start by downloading XAMPP from the official Apache Friends website.

Choose the current Windows version.

During installation, XAMPP may ask which components you want to install.

For DVWA, the most important components are:

• Apache
• PHP
• Database server
• phpMyAdmin

The default XAMPP installation directory is commonly:

C:\xampp

Using the default location makes beginner tutorials easier to follow.

Step 2: Install XAMPP

Run the XAMPP installer.

Windows may display a security or User Account Control message. Confirm the installer if you downloaded it from the official source.

Follow the installation wizard.

For a straightforward DVWA setup, you can normally keep the default components.

A common installation path is:

C:\xampp

After installation, open:

XAMPP Control Panel

You should see services such as:

• Apache
• MySQL or the database service
• FileZilla
• Mercury
• Tomcat

You only need the web server and database components for a normal DVWA installation.

Step 3: Start Apache and the Database Service

In the XAMPP Control Panel, click Start next to:

• Apache
• MySQL/database service

Both should show that they are running.

Apache is responsible for serving DVWA through your browser.

The database service stores DVWA users, configuration data, and lab information.

If Apache or the database service will not start, do not continue yet. See the troubleshooting section later in this guide.

Step 4: Test XAMPP

Open your browser.

Visit:

http://localhost/

If XAMPP is installed correctly, you should see the XAMPP dashboard or another local welcome page.

You can also test phpMyAdmin by opening:

http://localhost/phpmyadmin/

If both pages work, your local web-server environment is ready.

Step 5: Download DVWA From the Official GitHub Repository

Do not download random copies of DVWA from unknown websites.

The official DVWA documentation states that the supported version is the latest source from the official GitHub repository.

The official repository is:

digininja/DVWA

You can obtain DVWA in two ways:

Option 1: Download the ZIP

This is usually easiest for Windows beginners.

Option 2: Clone With Git

If Git is installed, you can use:

git clone https://github.com/digininja/DVWA.git

For this Windows + XAMPP guide, the ZIP method is simpler.

Step 6: Extract the DVWA ZIP File

After downloading DVWA, locate the ZIP archive in your Downloads folder.

Extract it.

The extracted directory may have a name similar to:

DVWA-master

The word master simply refers to the GitHub repository branch.

It does not mean you downloaded a different edition of DVWA.

For simplicity, rename:

DVWA-master

to:

DVWA

Step 7: Move DVWA Into the XAMPP htdocs Folder

XAMPP serves web files from its htdocs directory.

The default location is normally:

C:\xampp\htdocs

Move your extracted DVWA directory there.

Your final folder structure should look similar to:

C:\xampp\htdocs\DVWA

Inside that directory, you should see files and folders such as:

config
dvwa
hackable
includes
vulnerabilities
index.php
login.php
setup.php

If these files are present, you probably copied the correct folder.

Step 8: Understand the DVWA Localhost URL

Because your DVWA files are inside:

C:\xampp\htdocs\DVWA

your browser URL should normally be:

http://localhost/DVWA/

You can also access the setup page directly:

http://localhost/DVWA/setup.php

If you renamed the folder to lowercase:

dvwa

then your URL would instead be:

http://localhost/dvwa/

On Windows this distinction is usually less problematic than on Linux, but keeping the URL consistent with your folder name is still a good habit.

Step 9: Create the DVWA Configuration File

DVWA does not expect you to edit the example configuration file directly.

Inside:

C:\xampp\htdocs\DVWA\config

you should find:

config.inc.php.dist

You need an active file named:

config.inc.php

The official DVWA documentation specifically says that config.inc.php.dist is an example file and that an active config.inc.php must be created from it. It also warns Windows users that hidden file extensions can make this process confusing.

How to Create config.inc.php

Copy:

config.inc.php.dist

Paste the copy into the same folder.

Rename the copy to:

config.inc.php

The folder should now contain both:

config.inc.php
config.inc.php.dist

Do not accidentally create:

config.inc.php.txt

Step 10: Show File Extensions in Windows 11

Windows may hide known file extensions by default.

This can cause users to think they renamed the file correctly when they actually created something like:

config.inc.php.txt

To show file extensions in Windows 11:

1. Open File Explorer.
2. Click View.
3. Open Show.
4. Enable File name extensions.

Now verify that your active configuration file is exactly:

config.inc.php

This is one of the most common Windows DVWA setup mistakes.

Step 11: Open the DVWA Configuration File

Open:

C:\xampp\htdocs\DVWA\config\config.inc.php

Use a text editor such as:

• Notepad
• Notepad++
• Visual Studio Code

Do not use a word processor such as Microsoft Word.

Step 12: Check the DVWA Database Settings

The current DVWA configuration template uses settings similar to:

$_DVWA[ 'db_server' ] = '127.0.0.1';
$_DVWA[ 'db_database' ] = 'dvwa';
$_DVWA[ 'db_user' ] = 'dvwa';
$_DVWA[ 'db_password' ] = 'p@ssw0rd';
$_DVWA[ 'db_port' ] = '3306';

These are the project’s current default database values.

For this guide, we will create a database user that matches those values.

This is easier than changing multiple configuration settings.

Step 13: Open phpMyAdmin

Make sure Apache and the database service are running in XAMPP.

Then visit:

http://localhost/phpmyadmin/

phpMyAdmin provides a graphical interface for managing the local database.

Step 14: Create the DVWA Database and User

DVWA recommends using a dedicated database account rather than relying on the database root user. Its documentation provides a dvwa database, dvwa user, and p@ssw0rd password as the default setup.

In phpMyAdmin, open the SQL tab.

Run:

CREATE DATABASE dvwa;

CREATE USER 'dvwa'@'localhost'
IDENTIFIED BY 'p@ssw0rd';

GRANT ALL PRIVILEGES
ON dvwa.*
TO 'dvwa'@'localhost';

FLUSH PRIVILEGES;

This creates:

Database: dvwa
User: dvwa
Password: p@ssw0rd

These values match the current default DVWA configuration.

Step 15: Verify config.inc.php

Return to:

C:\xampp\htdocs\DVWA\config\config.inc.php

Make sure the database section matches:

$_DVWA[ 'db_server' ] = '127.0.0.1';
$_DVWA[ 'db_database' ] = 'dvwa';
$_DVWA[ 'db_user' ] = 'dvwa';
$_DVWA[ 'db_password' ] = 'p@ssw0rd';
$_DVWA[ 'db_port' ] = '3306';

Save the file.

If you choose a different database username or password, update config.inc.php to match.

The database settings and DVWA configuration must agree exactly.

Why Use 127.0.0.1 Instead of localhost?

The DVWA configuration template currently uses:

127.0.0.1

for the database server.

The configuration comments explain that using 127.0.0.1 instead of localhost can avoid database connection problems involving sockets.

For a standard XAMPP installation, leaving the default value is usually the simplest choice.

Step 16: Configure PHP for DVWA

Some DVWA labs require particular PHP settings.

With XAMPP, the PHP configuration file is commonly located at:

C:\xampp\php\php.ini

You can also reach it through the XAMPP Control Panel by using the Apache configuration menu and selecting php.ini.

Enable allow_url_fopen

Find:

allow_url_fopen

Make sure it is set to:

allow_url_fopen = On

Enable allow_url_include

Find:

allow_url_include

Set it to:

allow_url_include = On

These settings are required if you want the Remote File Inclusion portions of the File Inclusion lab to work as intended. The official DVWA documentation identifies both settings for this purpose.

Enable PHP Error Display

For a local training environment, displaying errors can make troubleshooting much easier.

Find:

display_errors

Set:

display_errors = On

Then find:

display_startup_errors

Set:

display_startup_errors = On

DVWA’s documentation recommends these settings so PHP errors are visible instead of appearing as unexplained blank pages.

Step 17: Restart Apache

PHP configuration changes do not necessarily take effect until Apache restarts.

In the XAMPP Control Panel:

1. Stop Apache.
2. Wait a moment.
3. Start Apache again.

You should do this whenever you make significant changes to php.ini.

Step 18: Open the DVWA Setup Page

Now open:

http://localhost/DVWA/setup.php

You should see the DVWA Setup page.

This page checks important settings and shows whether your environment is ready.

Review the status information.

Some optional features may still show warnings depending on your configuration.

Step 19: Create or Reset the DVWA Database

On the setup page, find:

Create / Reset Database

Click it.

The official DVWA documentation says this button creates or resets the application’s database and loads the required initial data.

If everything is configured correctly, DVWA should create its tables and prepare the application.

You may then be redirected to the login page.

Step 20: Log In to DVWA

The current official DVWA documentation lists the default login credentials as:

Username: admin
Password: password

Enter those credentials.

After logging in, you should see the DVWA dashboard and vulnerability menu.

Your installation is now working.

What Is the DVWA Login URL on XAMPP?

If DVWA is installed in:

C:\xampp\htdocs\DVWA

your login URL will normally be:

http://localhost/DVWA/login.php

Your main DVWA URL is:

http://localhost/DVWA/

The setup URL is:

http://localhost/DVWA/setup.php

And phpMyAdmin is normally:

http://localhost/phpmyadmin/

DVWA Security Levels After Installation

DVWA supports four security levels:

• Low
• Medium
• High
• Impossible

The current distributed configuration uses:

impossible

as the default security level for new sessions.

After logging in, you can use the DVWA Security section to change the level.

For beginners, a useful learning order is:

Low
↓
Medium
↓
High
↓
Impossible

Start with Low to understand the vulnerability.

Then compare how the application changes as stronger security controls are introduced.

What Does Each DVWA Security Level Mean?

Low

Low contains minimal defensive controls.

It is designed to make the vulnerability easier to understand.

Medium

Medium introduces some protections.

These controls may block very simple approaches but may not completely solve the underlying problem.

High

High adds stronger defensive behavior.

Learners need to understand the application more carefully.

Impossible

Impossible represents the strongly protected or secure implementation.

This is especially useful for developers because it lets you compare vulnerable code against better defensive coding practices.

Common DVWA Windows 11 and XAMPP Problems

Installation problems are common when setting up DVWA for the first time.

The following sections cover the most frequent issues.

Problem 1: localhost/DVWA Shows 404 Not Found

First confirm that your DVWA files are actually inside:

C:\xampp\htdocs\DVWA

Make sure you did not accidentally create:

C:\xampp\htdocs\DVWA\DVWA-master

with the real files one folder deeper.

You want:

C:\xampp\htdocs\DVWA\index.php

not:

C:\xampp\htdocs\DVWA\DVWA-master\index.php

Then try:

http://localhost/DVWA/

Problem 2: localhost Shows XAMPP Instead of DVWA

This is normal.

Opening:

http://localhost/

takes you to the root of the XAMPP web server.

Because your application is in the DVWA directory, open:

http://localhost/DVWA/

instead.

Problem 3: config.inc.php Is Missing

Check:

C:\xampp\htdocs\DVWA\config

You may only see:

config.inc.php.dist

Copy it and rename the copy to:

config.inc.php

Make sure Windows file extensions are visible so you do not accidentally create:

config.inc.php.txt

The official documentation specifically warns Windows users about hidden extensions during this step.

Problem 4: Database Error #1045 Access Denied

You may see an error similar to:

Access denied for user 'dvwa'@'localhost'

This normally means the username or password in:

config.inc.php

does not match the database account.

The DVWA troubleshooting documentation identifies error 1045 as a credential mismatch.

Check:

$_DVWA[ 'db_user' ] = 'dvwa';
$_DVWA[ 'db_password' ] = 'p@ssw0rd';

Then verify that the same database user exists.

Problem 5: Database Error #1044

Error 1044 normally means that the account is valid but does not have permission to use the specified database.

DVWA’s documentation describes this as a database-access permission problem.

Run or verify:

GRANT ALL PRIVILEGES
ON dvwa.*
TO 'dvwa'@'localhost';

FLUSH PRIVILEGES;

Then try the setup page again.

Problem 6: Database Error #2002

Error 2002 often indicates that the database service is not running.

Check the XAMPP Control Panel.

Make sure the database service shows as running.

The official DVWA troubleshooting documentation distinguishes this from an authentication error: error 2002 means the application cannot reach the database service.

Problem 7: DVWA Says Connection Refused

A connection-refused error usually means:

• The database service is stopped
• The database server address is wrong
• The database port is wrong
• XAMPP’s database service failed to start

Check:

$_DVWA[ 'db_server' ] = '127.0.0.1';

and:

$_DVWA[ 'db_port' ] = '3306';

Then confirm that the database service is running in the XAMPP Control Panel.

DVWA’s documentation specifically says Windows users should check the database status in the XAMPP console when troubleshooting connection problems.

Problem 8: DVWA Shows a Blank White Page

A blank white screen usually means PHP encountered an error but the message is hidden.

Make sure your php.ini contains:

display_errors = On
display_startup_errors = On

Restart Apache.

Reload DVWA.

The hidden error should now be easier to identify.

Problem 9: Apache Will Not Start

Apache may fail because another application is already using its web ports.

Common causes include:

• Another web server
• IIS
• Another Apache installation
• Another development environment
• A program already using port 80 or 443

Check the XAMPP Control Panel logs.

If another application is using the port, either stop that service or change your XAMPP Apache configuration.

Problem 10: Database Service Will Not Start

The XAMPP database service may fail because:

• Port 3306 is already occupied
• Another MySQL/MariaDB service is running
• Database files are damaged
• A previous process did not close correctly

Check the XAMPP logs before changing or deleting database files.

Avoid randomly deleting database directories because doing so can destroy existing local databases.

Problem 11: Create / Reset Database Does Nothing

Check all of the following:

Is Apache running?

If not, start it.

Is the database service running?

Check XAMPP.

Does config.inc.php exist?

It must be:

config.inc.php

not only:

config.inc.php.dist

Are the database credentials correct?

They must match your database user.

Does the DVWA database user have permission?

Verify the grants.

Problem 12: I Cannot Log In With admin/password

First make sure the database creation completed successfully.

Then use:

Username: admin
Password: password

If that still fails, return to:

http://localhost/DVWA/setup.php

and use Create / Reset Database again.

This recreates the DVWA data, so do not use it if you need to preserve previous lab data.

Do I Need to Configure reCAPTCHA?

Not for normal DVWA usage.

reCAPTCHA settings are only needed for the Insecure CAPTCHA module.

The official project specifically says you can ignore those settings when you are not using that lab.

So if the DVWA setup page shows missing reCAPTCHA keys, that does not necessarily mean your installation failed.

Do I Need Composer for DVWA?

Most classic DVWA labs do not require Composer.

However, the current DVWA API lab requires additional vendor dependencies installed through Composer.

The official documentation also says the API module requires Apache mod_rewrite.

If you are a beginner, you can install and learn the standard DVWA modules first.

Add the API dependencies later when you need that specific lab.

Does DVWA Need MySQL or MariaDB?

DVWA works with a MySQL-compatible database.

The maintained project currently recommends MariaDB because the documentation says it generally works more smoothly, whereas some newer MySQL authentication configurations can require additional changes.

With XAMPP, use the database service provided by your current XAMPP installation and ensure your DVWA database credentials match it.

Should I Use the Database Root Account?

It is better to create a dedicated account for DVWA.

The current DVWA configuration uses:

User: dvwa
Database: dvwa
Password: p@ssw0rd

and the official documentation provides commands for creating a separate dvwa database account.

Using a dedicated account also makes your setup easier to understand and troubleshoot.

DVWA Windows 11 Folder Structure

A properly installed XAMPP DVWA setup may look like:

C:\
└── xampp
    ├── apache
    ├── mysql
    ├── php
    └── htdocs
        └── DVWA
            ├── config
            │   ├── config.inc.php
            │   └── config.inc.php.dist
            ├── dvwa
            ├── hackable
            ├── includes
            ├── vulnerabilities
            ├── index.php
            ├── login.php
            └── setup.php

If your structure looks similar to this, your files are probably in the correct place.

Useful DVWA URLs on Windows 11

Once everything is installed, save these addresses:

XAMPP Homepage

http://localhost/

phpMyAdmin

http://localhost/phpmyadmin/

DVWA Homepage

http://localhost/DVWA/

DVWA Login

http://localhost/DVWA/login.php

DVWA Setup

http://localhost/DVWA/setup.php

These URLs assume your folder is named DVWA.

XAMPP vs Docker for DVWA on Windows 11

Both are valid approaches.

Feature	XAMPP	Docker
Beginner friendly	Yes	Yes
Manual PHP configuration	Yes	Less
Apache learning	Excellent	Limited
Database learning	Excellent	Moderate
Isolation	Moderate	Better
Easy reset	Moderate	Excellent
Typical URL	localhost/DVWA	localhost:4280
Good for Windows	Yes	Yes

Choose XAMPP If:

• You want to understand Apache.
• You want to work directly with PHP files.
• You want to use phpMyAdmin.
• You prefer a graphical service manager.
• You want the traditional localhost/DVWA setup.

Choose Docker If:

• You want stronger isolation.
• You want a faster reproducible setup.
• You already understand containers.
• You do not need to configure the PHP stack manually.

How to Use DVWA Safely on Windows 11

DVWA contains intentional security weaknesses.

Keep your lab isolated.

Good practices include:

• Use DVWA only on localhost.
• Do not configure router port forwarding to DVWA.
• Do not upload DVWA to public hosting.
• Do not expose XAMPP services to the Internet.
• Use only your own systems for testing.
• Keep important personal or business data away from the lab.
• Stop Apache and the database service when you are finished if you do not need them running.

The DVWA project explicitly warns against installing the application on public Internet-facing servers.

How to Stop DVWA

DVWA does not run as a separate Windows application.

It runs through Apache and the database service.

When you finish practicing:

1. Open XAMPP Control Panel.
2. Click Stop next to Apache.
3. Click Stop next to the database service.
4. Close XAMPP if desired.

DVWA will no longer be available on localhost after Apache stops.

How to Uninstall DVWA From XAMPP

If you want to remove only DVWA:

1. Stop Apache and the database service.
2. Delete:

C:\xampp\htdocs\DVWA

3. Open phpMyAdmin.
4. Remove the dvwa database if you no longer need it.
5. Remove the dedicated dvwa database user if appropriate.

You do not need to uninstall XAMPP unless you also want to remove your local web-server environment.

DVWA Windows 11 Installation Checklist

Before considering the setup complete, verify:

• XAMPP is installed.
• Apache is running.
• The database service is running.
• DVWA came from the official GitHub repository.
• DVWA is inside C:\xampp\htdocs\DVWA.
• config.inc.php exists.
• The dvwa database exists.
• The dvwa database user exists.
• Database credentials match config.inc.php.
• Required PHP settings are enabled.
• Apache was restarted after PHP changes.
• http://localhost/DVWA/setup.php opens.
• Create / Reset Database completes successfully.
• admin/password logs you in.

If every item is complete, your DVWA Windows 11 environment is ready.

Frequently Asked Questions

Can I install DVWA on Windows 11?

Yes. DVWA can be installed on Windows 11 using XAMPP or Docker Desktop. The official DVWA documentation specifically recommends XAMPP as an easy option for Windows users.

Where should I install DVWA in XAMPP?

For a default XAMPP installation, use:

C:\xampp\htdocs\DVWA

What is the DVWA localhost URL?

If your directory is named DVWA, use:

http://localhost/DVWA/

What is the DVWA setup URL?

Use:

http://localhost/DVWA/setup.php

What are the default DVWA login credentials?

The current official documentation lists:

Username: admin
Password: password

What database name does DVWA use?

The current default configuration uses:

dvwa

as the database name.

What is the default DVWA database username?

The current configuration uses:

dvwa

What is the default DVWA database password?

The current configuration template uses:

p@ssw0rd

for the dedicated DVWA database account.

Why is config.inc.php missing?

DVWA initially provides:

config.inc.php.dist

You need to copy it and rename the copy:

config.inc.php

Why does DVWA show a blank page?

PHP may be hiding an error.

Enable:

display_errors = On
display_startup_errors = On

and restart Apache.

Why does localhost/DVWA show 404?

Make sure DVWA is actually located at:

C:\xampp\htdocs\DVWA

and confirm that index.php is directly inside that directory.

Do I need Kali Linux to run DVWA?

No.

DVWA can run directly on Windows 11 using XAMPP.

Do I need Docker if I use XAMPP?

No.

XAMPP provides the local web-server environment, so Docker is not required.

Is DVWA safe to install on Windows 11?

It can be used safely as an isolated local lab, but the application itself is intentionally vulnerable.

Do not expose it publicly.

What security level should a beginner use?

Start with Low to understand the basic vulnerability, then progress through Medium and High before studying Impossible.

Final Thoughts

Installing DVWA on Windows 11 with XAMPP is straightforward once you understand the main parts of the setup.

The basic process is:

Install XAMPP
↓
Download official DVWA
↓
Move DVWA into htdocs
↓
Create config.inc.php
↓
Create the DVWA database and user
↓
Configure PHP
↓
Restart Apache
↓
Open setup.php
↓
Create / Reset Database
↓
Log in

The most common beginner problems usually come from just a few issues:

• DVWA is in the wrong folder.
• config.inc.php was not created.
• Windows added .txt to the configuration filename.
• Apache or the database service is not running.
• Database credentials do not match.
• The database user does not have permission.
• Apache was not restarted after changing php.ini.

If your installation uses:

C:\xampp\htdocs\DVWA

your main DVWA address should normally be:

http://localhost/DVWA/

and the default application credentials are:

Username: admin
Password: password

Once DVWA is running, keep it as an isolated local training environment and use it to study not only how vulnerabilities occur, but also how secure coding practices prevent them.