{"record":{"id":"448a7cba4a78d98c","repo":"wpscanteam/wpscan","slug":"the-remote-website-is-up-but-does-not-seem-to-be","errorCode":null,"errorMessage":"The remote website is up, but does not seem to be running WordPress.","messagePattern":"The remote website is up, but does not seem to be running WordPress\\.","errorType":"exception","errorClass":"WPScan::Error::NotWordPress","httpStatus":null,"severity":"error","filePath":"app/controllers/core.rb","lineNumber":233,"sourceCode":"\n      # @return [ Boolean ] Whether the DB update is currently in progress\n      def updating_db?\n        @updating_db\n      end\n\n      # Raises errors if the target is hosted on wordpress.com or is not running WordPress.\n      # Also checks if the homepage_url is still the install URL.\n      def check_wordpress_state\n        raise Error::WordPressHosted if target.wordpress_hosted?\n\n        if %r{/wp-admin/install.php$}i.match?(Addressable::URI.parse(target.homepage_url).path)\n\n          output('not_fully_configured', url: target.homepage_url)\n\n          exit(WPScan::ExitCode::VULNERABLE)\n        end\n\n        raise Error::NotWordPress unless target.wordpress?(ParsedCli.detection_mode) || ParsedCli.force\n      end\n\n      # Loads the related server module into the target and includes it on WpItem\n      # (needed to check if directory listing is enabled etc.).\n      #\n      # @return [ Symbol ] The server module loaded\n      def load_server_module\n        server = target.server || :Apache # auto-detect\n\n        case ParsedCli.server\n        when :apache\n          server = :Apache\n        when :iis\n          server = :IIS\n        when :nginx\n          server = :Nginx\n        end\n","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/wpscanteam/wpscan/blob/62c9cef471de90095f6b42245a11d0f8172d19c9/app/controllers/core.rb#L215-L251","documentation":"Raised by Core#check_wordpress_state (app/controllers/core.rb:233) when the target responds normally but shows no WordPress fingerprints under the configured detection mode (passive = homepage markers; aggressive = additional requests). Core#before_scan rescues it once, injects anti-bot cookies via target.maybe_add_cookies and re-checks; it still re-raises if the site does not look like WordPress. --force bypasses the check entirely.","triggerScenarios":"`wpscan --url http://target` against a non-WordPress site (static site, other CMS), or a WordPress site whose markers are hidden — renamed wp-content, no generator meta, no wp-login references, WAF stripping fingerprints — with passive detection mode and no --force, so target.wordpress?(ParsedCli.detection_mode) is false both before and after the cookie retry.","commonSituations":"Wrong --url (marketing site in front of the WP install at /blog); obfuscation plugins (Hide My WP) removing markers; heavily customized themes with no default WP asset paths; targets genuinely not running WordPress.","solutions":["Open the site in a browser and confirm it is WordPress; if the blog lives under a path such as /blog, point --url at that path","Re-run with --detection-mode aggressive so more fingerprints are checked","If you are certain it is WordPress and accept the risk, add --force","If wp-content was renamed, supply --wp-content-dir to help detection"],"exampleFix":"# before\nwpscan --url http://example.com\n# => The remote website is up, but does not seem to be running WordPress.\n\n# after\nwpscan --url http://example.com/blog --detection-mode aggressive\n# or, when certain it is WP: wpscan --url http://example.com --force","handlingStrategy":"validation","validationCode":"# Quick WordPress fingerprint before committing to a scan\nbody = Typhoeus.get(url, followlocation: true).body\nwp = body.match?(/wp-content|wp-includes|name=\"generator\" content=\"WordPress/i)\nputs 'not obviously WordPress — consider aggressive mode or --force' unless wp","typeGuard":null,"tryCatchPattern":"begin\n  scan.run\nrescue WPScan::Error::NotWordPress\n  retry with '--detection-mode aggressive' # decide on --force only after manual confirmation\nend","preventionTips":["Point --url at the actual WP install path, not a proxy or landing site","Use --detection-mode aggressive for customized or hardened sites","Reserve --force for targets manually confirmed to be WordPress","Remember WPScan already retries once with anti-bot cookies before failing"],"tags":["wordpress-detection","fingerprinting","detection-mode","wrong-url"],"backgroundTag":"platform-detection-mismatch","analyzedSha":"62c9cef471de90095f6b42245a11d0f8172d19c9","analyzedAt":"2026-08-21T17:10:47.902Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}