What causes "The option #{opt.to_long} is required" in wpscanteam/wpscan?

Supply the named option on the command line exactly as shown, e.g. wpscan --url https://example.com

wpscanteam/wpscan · error · OptParseValidator::NoRequiredOption

The option #{opt.to_long} is required

Error message

The option #{opt.to_long} is required

What it means

Raised by OptParseValidator::OptParser#post_processing (lib/opt_parse_validator.rb:148) after argv and config files are parsed: an option registered with required: true never produced a value in @results (no CLI flag, no config-file entry, no default). The message names the long form of the missing option. WPScan vendors this validator and runs it on every invocation through WPScan::ParsedCli, so the scan aborts before any HTTP request is made.

Source

Thrown at lib/opt_parse_validator.rb:148

        begin
          @results[opt.to_sym] = opt.normalize(opt.validate(files_data[opt.to_sym].to_s))
        rescue StandardError => e
          # Adds the long option name to the message
          # And raises it as an OptParseValidator::Error if not already one
          # e.g --proxy Invalid Scheme format.
          raise e.is_a?(Error) ? e.class : Error, "#{opt.to_long} #{e}"
        end
      end
    end

    # Ensure that all required options are supplied
    # Should be overriden to modify the behavior
    #
    # @return [ Void ]
    def post_processing
      @opts.each do |opt|
        raise NoRequiredOption, "The option #{opt.to_long} is required" if opt.required? && !@results.key?(opt.to_sym)

        next if opt.required_unless.empty? || @results.key?(opt.to_sym)

        fail_msg = 'One of the following options is required: ' \
                   "#{opt.to_long}, --#{opt.required_unless.join(', --').tr('_', '-')}"

        raise NoRequiredOption, fail_msg unless opt.required_unless.any? do |sym|
          @results.key?(sym)
        end
      end
    end
  end
end

View on GitHub (pinned to 62c9cef471)

Solutions

Supply the named option on the command line exactly as shown, e.g. wpscan --url https://example.com
Or persist it in a config file under its snake_case symbol: echo 'url: https://example.com' > ~/.config/wpscan/scan.yml
Check the exact spelling/long form with wpscan --help or --full-help (dashes on CLI, underscores in config)
If embedding the gem, pass the option inside the argv array given to the option parser instead of setting it afterwards

Example fix

# before
$ wpscan
# => raise NoRequiredOption: The option --url is required

# after
$ wpscan --url https://example.com

Defensive patterns

Strategy: try-catch

Validate before calling

# Before calling parser.results(argv): ensure every option you registered
# with required: true is present (CLI or config files)
required_syms = %i[url] # symbols matching OptBase#to_sym of your required options
missing = required_syms.reject { |sym| argv.include?("--#{sym.to_s.tr('_', '-')}") }
abort "Missing required option(s): #{missing.map { |s| '--' + s.to_s.tr('_', '-') }.join(' ')}" unless missing.empty?

Try / catch

begin
  options = parser.results(ARGV)
rescue OptParseValidator::NoRequiredOption => e
  abort e.message # or print parser.full_help and exit non-zero
end

Prevention

Encode required options once in a shared constant used by both the parser registration and your preflight check
Prefer config files (scan.yml/scan.json) with snake_case keys for values that never change between runs
In CI, assert on the error message early with a dry-run instead of discovering it mid-pipeline

When it happens

Trigger: Calling parser.results(argv) (or wpscan) with argv that omits a required option; registering OptBase options with required: true and supplying the value only in a config file whose key is misspelled or not loaded (keys must be snake_case symbols matching option.to_sym); an alias that maps to the required option without providing it; default value nil so @results stays empty.

Common situations: Scripts/CI invoking wpscan without the mandatory flag; a typo in ~/.config/wpscan/scan.yml (e.g. 'URL:' instead of 'url:'); config file in an unscanned location (loader only reads XDG dirs, ~/.wpscan, and ./.wpscan); a wpscan upgrade introducing a new required option that old scripts don't pass.

Related errors

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/9902fdfa6bf16d62. Report an issue: GitHub.