WordPress Advanced Interview

Training mode

Time remaining:

0 / 60 answered

1. Which statements about WordPress nonces are correct?

Select all correct answers.

Which statements about WordPress nonces are correct? They are a complete authorization mechanism on their own. They should be combined with a capability check when authorizing a sensitive action. They help confirm the intent behind a request. A WordPress nonce can technically be used only once.

Hint
A nonce verifies intent, not the user’s role or capabilities.
2. What does disabling components one at a time help determine?

What does disabling components one at a time help determine? Whether a plugin or theme interaction causes the issue DNS ownership The user password PHP syntax automatically

Hint
Choose the answer that reflects current WordPress engineering practice.
3. What format must a block name use?

What format must a block name use? plugin.php/block BlockName only namespace/block-name namespace:block:name

Hint
Choose the answer that reflects current WordPress engineering practice.
4. What does the accepted_args parameter of add_filter() control?

What does the accepted_args parameter of add_filter() control? How many values WordPress passes to that callback The callback priority How many callbacks may use the hook How many times the callback runs

Hint
It describes callback input, not execution order.
5. A service reads $_POST deep inside business logic. What is better?

A service reads $_POST deep inside business logic. What is better? Store it before checking Validate at the request boundary and pass explicit typed data inward Escape it as HTML Make $_POST global again

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
6. Why should custom REST routes use a versioned namespace such as my-plugin/v1?

Why should custom REST routes use a versioned namespace such as my-plugin/v1? It authenticates every request It avoids collisions and allows future incompatible versions It replaces permission_callback It creates a database table

Hint
Routes are public identifiers.
7. A plugin calls flush_rewrite_rules() on every init. What is wrong?

A plugin calls flush_rewrite_rules() on every init. What is wrong? It cannot update rules It disables CPTs It is expensive and should run only on controlled lifecycle changes It exposes passwords

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
8. What is the purpose of deprecated block versions in registerBlockType settings?

What is the purpose of deprecated block versions in registerBlockType settings? Remove REST routes Migrate and recognize older saved block markup Disable the block permanently Translate PHP strings

Hint
Existing posts may contain old markup.
9. What should a developer remember about WP-Cron timing?

What should a developer remember about WP-Cron timing? It runs only from wp-admin It is guaranteed to run at the exact second It requires one PHP process per event It is traffic-triggered and may run later than scheduled

Hint
It is not the operating system cron daemon.
10. On which hook should custom REST API routes be registered?

On which hook should custom REST API routes be registered? template_redirect rest_api_init init wp_loaded

Hint
The hook is dedicated to REST route registration.
11. What relationship does wp_set_object_terms() manage?

What relationship does wp_set_object_terms() manage? Adding post metadata Registering a theme Assigning a user role Associating an object such as a post with taxonomy terms

Hint
Identify the data-model or security responsibility before choosing the API.
12. What does a static block save function produce?

What does a static block save function produce? A PHP session A REST route Markup serialized into post content A database table

Hint
Choose the answer that reflects current WordPress engineering practice.
13. Which API should plugin code use to hash a WordPress-compatible password?

Which API should plugin code use to hash a WordPress-compatible password? wp_hash_password() base64_encode() md5() sanitize_text_field()

Hint
Do not invent password storage.
14. Why register post meta with register_post_meta() or register_meta()?

Why register post meta with register_post_meta() or register_meta()? To create a database table for each key To define schema, sanitization, authorization and REST visibility To replace update_post_meta() in every case To disable revisions

Hint
Think schema and access rules.
15. Which PHP function registers a block from its metadata directory?

Which PHP function registers a block from its metadata directory? add_block_editor() register_block_type() wp_register_component() register_post_type()

Hint
Choose the answer that reflects current WordPress engineering practice.
16. What is permission_callback responsible for?

What is permission_callback responsible for? Authorizing whether the request may reach the main callback Registering JavaScript Sanitizing every response Creating the route namespace

Hint
Consider lifecycle, authorization, failure and long-term maintenance.
17. How should a theme add a contextual CSS class to the body element?

How should a theme add a contextual CSS class to the body element? Filter body_class Modify the database option directly Print a second body attribute Edit WordPress core

Hint
There is a dedicated filter for the generated class list.
18. Which checks belong in a save_post metabox handler?

Select all generally appropriate safeguards.

Which checks belong in a save_post metabox handler? Verify the metabox nonce. Trust every value in $_POST because the request came from wp-admin. Handle or skip autosaves deliberately. Check the user capability for the post.

Hint
Consider request intent, autosaves, and authorization.
19. What should a setting sanitization callback return?

What should a setting sanitization callback return? The database password HTML output The validated and normalized value to store A capability name only

Hint
Consider lifecycle, authorization, failure and long-term maintenance.
20. When should a plugin normally flush rewrite rules for a new CPT?

When should a plugin normally flush rewrite rules for a new CPT? Inside every template On every request Once during activation after registering the structure Whenever a post is viewed

Hint
Identify the data-model or security responsibility before choosing the API.
21. How should dynamic values be included in a custom SQL query with $wpdb?

The query contains values supplied at runtime.

How should dynamic values be included in a custom SQL query with $wpdb? Concatenate the raw values after addslashes(). Use esc_html() before concatenating the SQL. Use $wpdb->prepare() with typed placeholders. Base64-encode every value before querying.

Hint
Do not concatenate untrusted values into the SQL string.
22. A custom order workflow is implemented only in a child theme. What is the issue?

A custom order workflow is implemented only in a child theme. What is the issue? Child themes cannot use PHP Orders must be pages The business capability disappears when the theme changes Themes cannot access users

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
23. Which function sanitizes a lowercase machine-readable key?

Which function sanitizes a lowercase machine-readable key? esc_js() sanitize_textarea_field() wpautop() sanitize_key()

Hint
Identify the data-model or security responsibility before choosing the API.
24. Why must code treat get_transient() returning false carefully?

Why must code treat get_transient() returning false carefully? False means missing or expired, so a stored false value is ambiguous False means the database failed False is converted to an empty post False means the user logged out

Hint
Avoid caching a literal false when you must distinguish it.
25. What object is normally passed to a REST endpoint callback?

What object is normally passed to a REST endpoint callback? WP_REST_Request WP_User_Query WP_Theme WP_Query only

Hint
Consider lifecycle, authorization, failure and long-term maintenance.
26. What does a WordPress nonce primarily verify?

What does a WordPress nonce primarily verify? Request intent and origin within a time window That SQL is prepared That input is valid That a user has every capability

Hint
Identify the data-model or security responsibility before choosing the API.
27. On which hook are Custom Post Types normally registered?

On which hook are Custom Post Types normally registered? shutdown save_post only init wp_footer

Hint
Identify the data-model or security responsibility before choosing the API.
28. Where should a theme normally register support for features such as post thumbnails?

Where should a theme normally register support for features such as post thumbnails? Directly in header.php Inside an after_setup_theme callback Inside a wp_footer callback During plugin activation

Hint
The hook name describes theme initialization.
29. Which function returns the active theme directory, including the child theme when one is active?

Which function returns the active theme directory, including the child theme when one is active? get_template_directory() locate_template_url() get_stylesheet_directory() get_theme_root_uri()

Hint
Stylesheet and template can mean child and parent.
30. Which function both translates and safely escapes plain text for HTML output?

Which function both translates and safely escapes plain text for HTML output? wp_kses_post() esc_html__() sanitize_text_field() __()

Hint
Combine internationalization with context-appropriate output escaping.
31. What makes a safe data migration?

What makes a safe data migration? Versioned, idempotent, bounded and recoverable behavior Running destructive SQL on every request Ignoring partial failure Depending on one browser session

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
32. What does the block.json render property identify?

What does the block.json render property identify? A PHP file for dynamic frontend rendering A REST namespace A database schema The editor stylesheet only

Hint
Choose the answer that reflects current WordPress engineering practice.
33. How does a scheduled WP-Cron event execute application code?

How does a scheduled WP-Cron event execute application code? A browser opens the admin page WordPress fires the scheduled hook and registered callbacks run The theme template is copied The database executes PHP directly

Hint
Consider lifecycle, authorization, failure and long-term maintenance.
34. What is a safe production-debugging principle?

What is a safe production-debugging principle? Collect minimal targeted evidence without displaying secrets or errors publicly Delete caches and data together Edit core live Enable every verbose flag indefinitely

Hint
Choose the answer that reflects current WordPress engineering practice.
35. What does has_filter() return when a specific callback is registered?

What does has_filter() return when a specific callback is registered? The callback result The number of accepted arguments The hook name Its priority

Hint
The return value must distinguish priorities.
36. Which argument selects one or more post types?

Which argument selects one or more post types? post_type content_kind type_query post_status_only

Hint
Identify the WordPress API responsibility before considering implementation details.
37. On the frontend, how should a plugin usually provide admin-ajax.php and nonce values to its script?

On the frontend, how should a plugin usually provide admin-ajax.php and nonce values to its script? Store them in localStorage at install time Hard-code the full domain in JavaScript Pass server-generated data when enqueueing the script Read wp-config.php from the browser

Hint
The server knows the correct URL and current nonce.
38. Why should plugin post types, taxonomies, options and functions use a unique prefix or namespace?

Why should plugin post types, taxonomies, options and functions use a unique prefix or namespace? To avoid naming collisions To enable pretty permalinks automatically To make queries run in parallel To bypass capability checks

Hint
Several plugins share the same runtime.
39. What is a custom taxonomy?

What is a custom taxonomy? A custom theme template A PHP exception type A database user A developer-registered system for classifying objects with terms

Hint
Identify the data-model or security responsibility before choosing the API.
40. What is an N+1 query problem?

What is an N+1 query problem? A query returns null One query has one condition A loop triggers an extra query for each item Cron runs twice

Hint
Choose the answer that reflects current WordPress engineering practice.
41. What must still happen after AJAX nonce verification for a privileged change?

What must still happen after AJAX nonce verification for a privileged change? Make the response public Trust the JavaScript button state Check the current user capability Skip validation

Hint
Consider lifecycle, authorization, failure and long-term maintenance.
42. Inside a shared callback, which function identifies the hook currently being processed?

Inside a shared callback, which function identifies the hook currently being processed? doing_filter() only current_filter() did_action() get_current_hook()

Hint
Useful when one callback handles several hooks.
43. What should happen before a template receives data?

What should happen before a template receives data? The template activates plugins The controller or service prepares a clear view model The template performs every database mutation The template reads raw request data

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
44. What is dbDelta() designed to help with?

What is dbDelta() designed to help with? Scheduling cron events Deleting all plugin options Preparing SELECT placeholders Creating or updating plugin database table schemas

Hint
It is commonly used during versioned migrations.
45. What is a feature flag useful for?

What is a feature flag useful for? Replacing tests Controlling rollout or fallback without branching the whole codebase Storing content Authorizing users permanently

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
46. What happens if a filter callback forgets to return the filtered value?

What happens if a filter callback forgets to return the filtered value? PHP always throws a fatal error WordPress automatically returns the original value Later callbacks may receive null or an unintended value The filter becomes an action

Hint
Actions may ignore return values; filters may not.
47. Which function loads a reusable theme template part while allowing a specialized variant?

Which function loads a reusable theme template part while allowing a specialized variant? load_header_part() require_theme() include_post_template() get_template_part()

Hint
Think of template-parts/content-single.php.
48. What do post-type labels control?

What do post-type labels control? HTTP status codes Database credentials Theme file paths Human-readable names used in administration interfaces

Hint
Identify the data-model or security responsibility before choosing the API.
49. What may save return for a fully dynamic block?

What may save return for a fully dynamic block? A WP_Error only null The database password A theme object

Hint
Choose the answer that reflects current WordPress engineering practice.
50. What is WordPress metadata?

What is WordPress metadata? The main post title only A database backup format Additional key-value data associated with an object A CSS file header

Hint
Identify the data-model or security responsibility before choosing the API.
51. How should generated/scaffolded code be maintained?

How should generated/scaffolded code be maintained? Edit outputs inconsistently Ignore regeneration drift Preserve generator conventions and improve templates when the pattern is reusable Create parallel loaders

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
52. What does settings_fields( $group ) print?

What does settings_fields( $group ) print? Security and routing fields for the registered settings group The plugin stylesheet The option values as JSON Every input control automatically

Hint
Consider lifecycle, authorization, failure and long-term maintenance.
53. A static block changes save markup and old posts show validation errors. What was missing?

A static block changes save markup and old posts show validation errors. What was missing? A deprecation/migration or compatible markup strategy A capability check A database index A cron schedule

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
54. Which function registers a stylesheet for a specific block type?

Which function registers a stylesheet for a specific block type? wp_register_theme_css() add_block_css() enqueue_editor_only() wp_enqueue_block_style()

Hint
It can avoid loading block CSS where it is not needed.
55. Which requirement is a good candidate for a Custom Post Type?

Which requirement is a good candidate for a Custom Post Type? A reusable collection of book records with titles and archives One theme color value A CSS breakpoint A temporary login nonce

Hint
Identify the data-model or security responsibility before choosing the API.
56. How should a plugin react when a required dependency is unavailable?

How should a plugin react when a required dependency is unavailable? Fail gracefully and show an actionable admin notice Trigger a frontend fatal error Silently corrupt its options Edit the dependency files

Hint
Administrators need a recoverable state.
57. Why return WP_REST_Response?

Why return WP_REST_Response? To render a theme template To create a nonce To control response data, status, headers and links To bypass permissions

Hint
Consider lifecycle, authorization, failure and long-term maintenance.
58. What is the difference between sanitizing and escaping data?

Choose the most accurate statement for WordPress development.

What is the difference between sanitizing and escaping data? They are two names for the same operation. Sanitization is needed only in themes. Sanitize input; escape output according to its context. Escape input once and output it without further checks.

Hint
Think about when data enters the system and when it leaves for the browser.
59. What should diagnostic logging include?

What should diagnostic logging include? Every request body and secret Only generic failed HTML styling Actionable context without credentials or unnecessary personal data

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.
60. What is a risk of calling a global service locator everywhere?

What is a risk of calling a global service locator everywhere? Dependencies become hidden and components tightly coupled WordPress removes filters PHP stops autoloading Services cannot be objects

Hint
Choose the solution with the clearest boundary and safest lifecycle behavior.

1. Which statements about WordPress nonces are correct?

2. What does disabling components one at a time help determine?

3. What format must a block name use?

4. What does the accepted_args parameter of add_filter() control?

5. A service reads $_POST deep inside business logic. What is better?

6. Why should custom REST routes use a versioned namespace such as my-plugin/v1?

7. A plugin calls flush_rewrite_rules() on every init. What is wrong?

8. What is the purpose of deprecated block versions in registerBlockType settings?

9. What should a developer remember about WP-Cron timing?

10. On which hook should custom REST API routes be registered?

11. What relationship does wp_set_object_terms() manage?

12. What does a static block save function produce?

13. Which API should plugin code use to hash a WordPress-compatible password?

14. Why register post meta with register_post_meta() or register_meta()?

15. Which PHP function registers a block from its metadata directory?

16. What is permission_callback responsible for?

17. How should a theme add a contextual CSS class to the body element?

18. Which checks belong in a save_post metabox handler?

19. What should a setting sanitization callback return?

20. When should a plugin normally flush rewrite rules for a new CPT?

21. How should dynamic values be included in a custom SQL query with $wpdb?

22. A custom order workflow is implemented only in a child theme. What is the issue?

23. Which function sanitizes a lowercase machine-readable key?

24. Why must code treat get_transient() returning false carefully?

25. What object is normally passed to a REST endpoint callback?

26. What does a WordPress nonce primarily verify?

27. On which hook are Custom Post Types normally registered?

28. Where should a theme normally register support for features such as post thumbnails?

29. Which function returns the active theme directory, including the child theme when one is active?

30. Which function both translates and safely escapes plain text for HTML output?

31. What makes a safe data migration?

32. What does the block.json render property identify?

33. How does a scheduled WP-Cron event execute application code?

34. What is a safe production-debugging principle?

35. What does has_filter() return when a specific callback is registered?

36. Which argument selects one or more post types?

37. On the frontend, how should a plugin usually provide admin-ajax.php and nonce values to its script?

38. Why should plugin post types, taxonomies, options and functions use a unique prefix or namespace?

39. What is a custom taxonomy?

40. What is an N+1 query problem?

41. What must still happen after AJAX nonce verification for a privileged change?

42. Inside a shared callback, which function identifies the hook currently being processed?

43. What should happen before a template receives data?

44. What is dbDelta() designed to help with?

45. What is a feature flag useful for?

46. What happens if a filter callback forgets to return the filtered value?

47. Which function loads a reusable theme template part while allowing a specialized variant?

48. What do post-type labels control?

49. What may save return for a fully dynamic block?

50. What is WordPress metadata?

51. How should generated/scaffolded code be maintained?

52. What does settings_fields( $group ) print?

53. A static block changes save markup and old posts show validation errors. What was missing?

54. Which function registers a stylesheet for a specific block type?

55. Which requirement is a good candidate for a Custom Post Type?

56. How should a plugin react when a required dependency is unavailable?

57. Why return WP_REST_Response?

58. What is the difference between sanitizing and escaping data?

59. What should diagnostic logging include?

60. What is a risk of calling a global service locator everywhere?