{"record":{"id":"2f65b2be9dafade9","repo":"wpscanteam/wpscan","slug":"the-target-appears-to-be-hosted-on-wordpress-com","errorCode":null,"errorMessage":"The target appears to be hosted on WordPress.com. Scanning such site is not supported.","messagePattern":"The target appears to be hosted on WordPress\\.com\\. Scanning such site is not supported\\.","errorType":"exception","errorClass":"WPScan::Error::WordPressHosted","httpStatus":null,"severity":"error","filePath":"app/controllers/core.rb","lineNumber":224,"sourceCode":"\n      def update_db\n        @updating_db = true\n        output('db_update_started')\n        output('db_update_finished', updated: local_db.update, verbose: ParsedCli.verbose)\n        @updating_db = false\n\n        exit(0) unless ParsedCli.url\n      end\n\n      # @return [ Boolean ] Whether the DB update is currently in progress\n      def updating_db?\n        @updating_db\n      end\n\n      # Raises errors if the target is hosted on wordpress.com or is not running WordPress.\n      # Also checks if the homepage_url is still the install URL.\n      def check_wordpress_state\n        raise Error::WordPressHosted if target.wordpress_hosted?\n\n        if %r{/wp-admin/install.php$}i.match?(Addressable::URI.parse(target.homepage_url).path)\n\n          output('not_fully_configured', url: target.homepage_url)\n\n          exit(WPScan::ExitCode::VULNERABLE)\n        end\n\n        raise Error::NotWordPress unless target.wordpress?(ParsedCli.detection_mode) || ParsedCli.force\n      end\n\n      # Loads the related server module into the target and includes it on WpItem\n      # (needed to check if directory listing is enabled etc.).\n      #\n      # @return [ Symbol ] The server module loaded\n      def load_server_module\n        server = target.server || :Apache # auto-detect\n","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/wpscanteam/wpscan/blob/62c9cef471de90095f6b42245a11d0f8172d19c9/app/controllers/core.rb#L206-L242","documentation":"Raised by Core#check_wordpress_state (app/controllers/core.rb:224) via Target#wordpress_hosted?: the host matches *.wordpress.com, or — when no content_dir is detected — the homepage references wp.com-hosted URIs. Both indicate a WordPress.com-managed site, which WPScan deliberately refuses to scan because it is not a self-hosted WordPress install.","triggerScenarios":"`wpscan --url https://something.wordpress.com` (host matches /\\.wordpress\\.com$/i), or a custom-domain site actually served by WordPress.com whose homepage HTML references wp.com assets before any wp-content dir is found.","commonSituations":"Scanning a blog believed to be self-hosted but actually on a WordPress.com plan; custom domains mapped to WordPress.com Business/Enterprise; attempting to audit Automattic-managed infrastructure (unsupported by design).","solutions":["Confirm the target is really self-hosted WordPress; if the actual install lives elsewhere, point --url at it","Accept that WordPress.com sites cannot be scanned — no flag bypasses this check","For WordPress.com-hosted sites, rely on Automattic's platform security rather than WPScan"],"exampleFix":"# before\nwpscan --url https://myblog.wordpress.com\n# => The target appears to be hosted on WordPress.com. Scanning such site is not supported.\n\n# after\nwpscan --url https://myblog-selfhosted.example.com","handlingStrategy":"validation","validationCode":"# Reject WordPress.com hosts before building the scan\nhost = Addressable::URI.parse(url).host\nabort 'WordPress.com targets are not supported' if /\\.wordpress\\.com$/i.match?(host)","typeGuard":null,"tryCatchPattern":"begin\n  scan.run\nrescue WPScan::Error::WordPressHosted\n  mark_unsupported(url) # deterministic — skip, do not retry\nend","preventionTips":["Curate target lists to exclude *.wordpress.com subdomains","Remember custom domains can also be WordPress.com-hosted (wp.com asset references)","Do not retry this error in automation — it is deterministic","Verify a target is self-hosted before adding it to a scanning queue"],"tags":["wordpress-com","unsupported-target","platform"],"backgroundTag":"unsupported-target-platform","analyzedSha":"62c9cef471de90095f6b42245a11d0f8172d19c9","analyzedAt":"2026-08-21T17:10:47.902Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}