wpscanteam/wpscan · error · WPScan::Error::WpContentDirNotDetected

Unable to identify the wp-content dir, please supply it with

Error message

Unable to identify the wp-content dir, please supply it with --wp-content-dir, use the --scope option or make sure the --url value given is the correct one

What it means

Raised by Controller::CustomDirectories#before_scan (app/controllers/custom_directories.rb:21) when target.content_dir is still nil: neither --wp-content-dir was supplied nor could WPScan infer the wp-content directory from the site. All subsequent plugin/theme logic depends on that path, so the scan stops in this controller before enumeration starts.

Source

Thrown at app/controllers/custom_directories.rb:21

module WPScan
  module Controller
    # Controller to ensure that the wp-content and wp-plugins
    # directories are found
    class CustomDirectories < WPScan::Controller::Base
      def cli_options
        [
          OptString.new(['--wp-content-dir DIR',
                         'The wp-content directory if custom or not detected, such as "wp-content"']),
          OptString.new(['--wp-plugins-dir DIR',
                         'The plugins directory if custom or not detected, such as "wp-content/plugins"'])
        ]
      end

      def before_scan
        target.content_dir = ParsedCli.wp_content_dir if ParsedCli.wp_content_dir
        target.plugins_dir = ParsedCli.wp_plugins_dir if ParsedCli.wp_plugins_dir

        raise Error::WpContentDirNotDetected unless target.content_dir
      end
    end
  end
end

View on GitHub (pinned to 62c9cef471)

Solutions

1. Find the real directory (view page source, inspect asset URLs) and pass it: --wp-content-dir content
2. Make sure --url points at the WordPress install root, not a static page in front of it
3. Widen --scope so more of the domain's URIs are usable for detection
4. If plugins are also served from a custom path, add --wp-plugins-dir as well

Example fix

# before
wpscan --url https://target
# => Unable to identify the wp-content dir ...

# after (renamed dir discovered from the page source)
wpscan --url https://target --wp-content-dir assets/content

# Infer the content dir from the homepage before scanning
body = Typhoeus.get(url).body
m = body.match(%r{(?:https?://[^/]+)?/([\w-]+)/(?:plugins|themes)/})
ARGV.push('--wp-content-dir', m[1]) if m

begin
  scan.run
rescue WPScan::Error::WpContentDirNotDetected
  retry with '--wp-content-dir <dir>' obtained from the page source
end

When it happens

Trigger: `wpscan --url http://target` (no --wp-content-dir) where homepage analysis finds no wp-content references and default detection fails: renamed content directory (e.g. /content, /assets), JS-bundled themes with custom asset paths, a homepage that references nothing WP-specific, or a --url pointing at a static front page instead of the install root.

Common situations: Renaming/obfuscation plugins (Hide My WP, WP Hide) relocating wp-content; headless/SPA frontends; --url pointing at a landing page while WordPress lives under a subpath; cached/minified HTML stripped of original asset URLs.

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/e147b2a367100059. Report an issue: GitHub.