wpscanteam/wpscan · error · WPScan::Error::ApiLimitReached

Your API limit has been reached

Error message

Your API limit has been reached

What it means

Raised by VulnApi#before_scan (app/controllers/vuln_api.rb:67) when the API status payload reports requests_remaining == 0 — the token's daily quota is exhausted. The free tier allows 25 requests per day and each detected WordPress version, plugin and theme consumes one request, so enumeration-heavy scans drain it quickly.

Source

Thrown at app/controllers/vuln_api.rb:67

          )
        ]
      end

      def before_scan
        # Already done by Core#before_scan (before the DB update, to fail as early as possible),
        # kept as a safety net in case this controller is used in a chain without Core.
        self.class.validate_api_tokens!

        return setup_enterprise_db if enterprise_db_token

        return unless api_token

        DB::VulnApi.token = api_token

        api_status = DB::VulnApi.status

        raise Error::InvalidApiToken if api_status['status'] == 'forbidden'
        raise Error::ApiLimitReached if api_status['requests_remaining'] == 0
        raise Error::ApiConnectionError, api_status['http_error'] if api_status['http_error']
      end

      def after_scan
        output('status', status: DB::VulnApi.status, api_requests: WPScan.api_requests)
      end

      private

      # @return [ String, nil ] The enterprise DB token (CLI or ENV)
      def enterprise_db_token
        self.class.enterprise_db_token
      end

      # @return [ String, nil ] The API token (CLI or ENV var)
      def api_token
        self.class.api_token
      end

View on GitHub (pinned to 62c9cef471)

Solutions

1. Wait for the daily quota reset and re-run the scan
2. Upgrade the API plan at wpscan.com for a higher daily limit
3. Run without a token (drop --api-token / unset WPSCAN_API_TOKEN) if vulnerability data is not required

Example fix

# before
wpscan --url http://t --api-token TOKEN   # quota already spent today
# => Your API limit has been reached

# after (scan without vulnerability data)
unset WPSCAN_API_TOKEN && wpscan --url http://t

# Check remaining quota before launching
WPScan::DB::VulnApi.token = token
remaining = WPScan::DB::VulnApi.status['requests_remaining']
abort 'quota exhausted — wait for the daily reset' if remaining.to_i.zero?

begin
  scan.run
rescue WPScan::Error::ApiLimitReached
  sleep_until_daily_reset; retry # or rerun without the token
end

When it happens

Trigger: `wpscan --url http://t --api-token TOKEN` where a previous scan the same day already consumed the quota, or the status check itself reports zero remaining before the scan body starts; api_status['requests_remaining'] == 0 at line 67.

Common situations: Multiple scans per day on the free tier; scheduled jobs sharing one token across projects; large enumerations (>25 plugins/themes/version lookups) exhausting the quota within a single run.

Related errors

• --api-token and --enterprise-db-token are mutually exclusive
• The API token provided is invalid

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/3246f6862367820a. Report an issue: GitHub.