wpscanteam/wpscan · error · WPScan::Error::ApiConnectionError

Unable to connect to the WPScan API: #{original_error}. Plea

Error message

Unable to connect to the WPScan API: #{original_error}. Please check https://status.wpscan.com/ for service status.

What it means

Raised by VulnApi#before_scan (app/controllers/vuln_api.rb:68) when the status call to the WPScan API itself failed at transport level — api_status['http_error'] is set (Typhoeus code 0: DNS failure, connection refused, timeout). The message includes the underlying error and points to status.wpscan.com. API/DB requests can bypass --proxy when --proxy-target-only is set (lib/wpscan/db/vuln_api.rb:130).

Source

Thrown at app/controllers/vuln_api.rb:68

        ]
      end

      def before_scan
        # Already done by Core#before_scan (before the DB update, to fail as early as possible),
        # kept as a safety net in case this controller is used in a chain without Core.
        self.class.validate_api_tokens!

        return setup_enterprise_db if enterprise_db_token

        return unless api_token

        DB::VulnApi.token = api_token

        api_status = DB::VulnApi.status

        raise Error::InvalidApiToken if api_status['status'] == 'forbidden'
        raise Error::ApiLimitReached if api_status['requests_remaining'] == 0
        raise Error::ApiConnectionError, api_status['http_error'] if api_status['http_error']
      end

      def after_scan
        output('status', status: DB::VulnApi.status, api_requests: WPScan.api_requests)
      end

      private

      # @return [ String, nil ] The enterprise DB token (CLI or ENV)
      def enterprise_db_token
        self.class.enterprise_db_token
      end

      # @return [ String, nil ] The API token (CLI or ENV var)
      def api_token
        self.class.api_token
      end

View on GitHub (pinned to 62c9cef471)

Solutions

1. Verify general connectivity and DNS from the same machine (curl https://wpscan.com)
2. If using --proxy, ensure it can reach the API — or add --proxy-target-only so API/DB traffic skips the proxy
3. Check https://status.wpscan.com/ for an ongoing incident
4. Retry once the transient network issue clears

Example fix

# before
wpscan --url http://t --api-token TOKEN --proxy http://internal-proxy:3128
# => Unable to connect to the WPScan API ...

# after (API traffic bypasses the internal proxy)
wpscan --url http://t --api-token TOKEN --proxy http://internal-proxy:3128 --proxy-target-only

# Reachability pre-check for the WPScan API
res = Typhoeus.get('https://wpscan.com', connecttimeout: 10)
puts 'API unreachable: check egress/proxy' if res.code.zero?

begin
  scan.run
rescue WPScan::Error::ApiConnectionError => e
  warn e.original_error
  retry if (attempts += 1) < 3 && sleep(30)
end

When it happens

Trigger: `wpscan --url http://t --api-token TOKEN` from a machine that cannot resolve or reach the WPScan API host: blocked egress, corporate firewall, a --proxy that cannot reach wpscan domains (no --proxy-target-only), or a WPScan/Cloudflare outage.

Common situations: CI runners behind restrictive egress proxies; --proxy pointing at an internal-only proxy that refuses external hosts; DNS failures in containers; transient Cloudflare incidents affecting the API.

Related errors

• The url supplied '#{response.request.url}' seems to be down
• Unable to get #{response.effective_url} (status: #{response.

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/5d8098c040534c3f. Report an issue: GitHub.