wpscanteam/wpscan · warning · WPScan::Error::NoLoginInterfaceDetected

Could not find a login interface to perform the password att

Error message

Could not find a login interface to perform the password attack against

What it means

Raised by PasswordAttack#attacker_from_cli_options (app/controllers/password_attack.rb:83) when --password-attack wp-login is forced but Target#login_url is nil, i.e. no login interface was found at /wp-login.php or at a --login-uri override. Note that PasswordAttack#run rescues exactly this class (app/controllers/password_attack.rb:59) and prints it as a notice, so in a normal CLI run the attack degrades gracefully; it only propagates when the finder is built directly.

Source

Thrown at app/controllers/password_attack.rb:83

      end

      # @return [ WPScan::Finders::Finder ] The finder used to perform the attack
      def attacker
        @attacker ||= attacker_from_cli_options || attacker_from_automatic_detection
      end

      # @return [ Model::XMLRPC ]
      def xmlrpc
        @xmlrpc ||= target.xmlrpc
      end

      # @return [ WPScan::Finders::Finder ]
      def attacker_from_cli_options
        return unless ParsedCli.password_attack

        case ParsedCli.password_attack
        when :wp_login
          raise Error::NoLoginInterfaceDetected unless target.login_url

          Finders::Passwords::WpLogin.new(target)
        when :xmlrpc
          raise Error::XMLRPCNotDetected unless xmlrpc

          Finders::Passwords::XMLRPC.new(xmlrpc)
        when :xmlrpc_multicall
          raise Error::XMLRPCNotDetected unless xmlrpc

          Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
        end
      end

      # @return [ Boolean ]
      def xmlrpc_get_users_blogs_enabled?
        if xmlrpc&.enabled? &&
           xmlrpc.available_methods.include?('wp.getUsersBlogs') &&
           !xmlrpc.method_call('wp.getUsersBlogs', [SecureRandom.hex[0, 6], SecureRandom.hex[0, 4]])

View on GitHub (pinned to 62c9cef471)

Solutions

Locate the real login page and pass it: --login-uri /custom-login-path
Drop --password-attack so WPScan auto-detects and falls back to XML-RPC when wp-login is unavailable
Verify the login page in a browser — it may be blocked for your IP specifically

Example fix

# before
wpscan --url http://target -P rockyou.txt --password-attack wp-login
# => Could not find a login interface to perform the password attack against

# after
wpscan --url http://target -P rockyou.txt --login-uri /member-login

Defensive patterns

Strategy: fallback

Validate before calling

# Probe the login URL before forcing a wp-login attack
login = WPScan::Target.new(url).login_url
abort 'no login page — do not force --password-attack wp-login' unless login

Try / catch

begin
  attacker = controller.attacker_from_cli_options
rescue WPScan::Error::NoLoginInterfaceDetected
  attacker = nil # fall back to automatic detection (XML-RPC) or supply --login-uri
end

Prevention

Confirm the login path exists before pinning --password-attack wp-login
Pass --login-uri whenever the login page is not /wp-login.php
Prefer automatic attack selection unless you have a reason to force one
Check that a WAF is not masking wp-login.php with 403/404

When it happens

Trigger: `wpscan --url http://target -P passwords.txt --password-attack wp-login` where wp-login.php is 404/oddly redirected and no --login-uri was supplied; or a --login-uri value pointing at a path that does not exist, leaving target.login_url nil at the moment the attacker is instantiated.

Common situations: Login page renamed or moved by a security plugin; wp-login.php blocked by a WAF rule; site uses a custom login path; typo in --login-uri.

Related errors

The XML-RPC Interface was not detected.

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/9921e9eaf674fa4f. Report an issue: GitHub.