10 Essential WordPress Interview Questions *

Toptal sourced essential questions that the best WordPress developers and engineers can answer. Driven from our community, we encourage experts to submit questions and offer feedback.

Hire a Top WordPress Developer Now
Toptal logois an exclusive network of the top freelance software developers, designers, finance experts, product managers, and project managers in the world. Top companies hire Toptal freelancers for their most important projects.

Interview Questions

1.

Is WordPress safe from brute force login attempts? If not, how can you prevent such an attack vector?

View answer

No, WordPress on its own is vulnerable to brute force login attempts.

Some good examples of actions performed to protect a WordPress installation against brute force are:

  • Do not use the “admin” username, and use strong passwords.
  • Password protect “wp-login.php”.
  • Set up some server-side protections (IP-based restrictions, firewall, Apache/Nginx modules, etc.)
  • Install a plugin to add a captcha, or limit login attempts.
2.

The following line is in a function inside a theme’s “function.php” file. What is wrong with this line of code?

wp_enqueue_script('custom-script', '/js/functions.js');
View answer

Assuming that “functions.js” file is in the theme’s “js/” folder, we should use ‘get_template_directory_uri()’. '/js/functions.js' or the visitors’ browser will look for the file in the root directory of the website.

3.

Assuming we have a file named “wp-content/plugins/hello-world.php” with the following content. What is this missing to be called a plugin and run properly?

 Hello World ";
}
View answer

The file is missing the plugin headers. Every plugin should include at least the plugin name in the header with the following syntax:

Apply to Join Toptal's Development Network

and enjoy reliable, steady, remote Freelance WordPress Developer Jobs

Apply as a Freelancer
4.

What is a potential problem in the following snippet of code from a WordPress theme file named “footer.php”?

...
        
All rights reserved
View answer

All footer files must call the function, ideally right before the tag. This will insert references to all scripts and stylesheets that have been added by plugins, themes, and WordPress itself to the footer.

5.

What is this code for? How can the end user use it?

function new_shortcode($atts, $content = null) {
    extract(shortcode_atts(array(
        “type” => “warning”
    ), $atts));
    return '
'.$content.'
'; } add_shortcode(“warning_box”, “new_shortcode”);
View answer

This shortcode allows authors to show an info box in posts or pages where the shortcode itself is added. The HTML code generated is a div with a class name “alert” plus an extra class name by default, “alert-warning”. A parameter can change this second class to change the visual aspect of the alert box.

Those class naming structures are compatible with Bootstrap.

To use this shortcode, the user has to insert the following code within the body of a post or a page:

[warning_box]Warning message[/warning_box]
6.

Consider the following code snippet. Briefly explain what changes it will achieve, who can and cannot view its effects, and at what URL WordPress will make it available.

add_action('admin_menu', 'custom_menu');

function custom_menu(){
    add_menu_page('Custom Menu', 'Custom Menu', 'manage_options', 'custom-menu-slug', 'custom_menu_page_display');
}

function custom_menu_page_display(){
    echo '

Hello World

'; echo '

This is a custom page

'; }
View answer

This will add a new menu item labelled “Custom Menu” to the side menu of the WordPress dashboard. When you click on this menu item, WordPress will call the function ‘custom_menu_page_display’ and show a page titled “Custom Menu”, with the heading “Hello World” and a paragraph that reads “This is a custom page”.

With default settings and roles, admins can view it and all lower roles can’t. In fact this menu item will only be visible to users who have the privilege to “manage options” or change settings from WordPress admin dashboard.

The admin custom page will be made available at this (relative) URL: “?page=custom-menu-slug”.

7.

How would you change all the occurrences of “Hello” into “Good Morning” in post/page contents, when viewed before 11AM?

View answer

In a plugin or in theme functions file, we must create a function that takes text as input, changes it as needed, and returns it. This function must be added as a filter for “the_content”.

It’s important that we put a little effort to address some details:

  • Only change when we have the full isolate substring “hello”. This will prevent words like “Schellong” from becoming “sgood morningng”. To do that we must use “word boundary” anchors in regular expression, putting the word between a pair of “\b”.

  • Keep consistency with the letter case. An easy way to do that is to make the replace case sensitive.

8.

What is the $wpdb variable in WordPress, and how can you use it to improve the following code?

View answer

$wpdb is a global variable that contains the WordPress database object. It can be used to perform custom database actions on the WordPress database. It provides the safest means for interacting with the WordPress database.

The code above doesn’t follow WordPress best practices which strongly discourages the use of any mysql_query call. Wordpress provides easier and safer solutions through $wpdb.

The above code can be modified to be as follows:

$value1,'col2'=>$value2,'col3'=>$value3);
    $format = array('%s','%s','%s');
    $wpdb->insert('table_name', $data, $format);
}
9.

Consider the following code snippet and explain the purpose of wp_enqueue_script. Can you figure out if something is wrong in the snippet?

add_custom_script();
function add_custom_script(){
    wp_enqueue_script( 
        'jquery-custom-script',
        plugin_dir_url( __FILE__ ).'js/jquery-custom-script.js'
    );
}
View answer

wp_enqueue_script is usually used to inject javascript files in HTML.

The script we are trying to queue will not be added, because “add_custom_script()” is called with no hooks. To make this work properly we must use the wp_enqueue_scripts hook. Some other hooks will also work such as init, wp_print_scripts, and wp_head.

Furthermore, since the script seems to be dependent on jQuery, it’s recommended to declare it as such by adding array(‘jquery’) as the 3rd parameter.

Proper use:

add_action(‘wp_enqueue_scripts’, ‘add_custom_script’);
function add_custom_script(){
    wp_enqueue_script( 
        'jquery-custom-script',
        plugin_dir_url( __FILE__ ).'js/jquery-custom-script.js',
        array( 'jquery')
    );
}
10.

Suppose you have a non-WordPress PHP website with a WordPress instance in the “/blog/” folder. How can you show a list of the last 3 posts in your non-WordPress pages?

View answer

One obvious way is to download, parse, and cache the blog’s RSS feeds. However, since the blog and the website are on the same server, you can use all the WordPress power, even outside it.

The first thing to do is to include the “wp-load.php” file. After which you will be able to perform any WP_Query and use any WordPress function such as get_posts, wp_get_recent_posts, query_posts, and so on.


Recent Posts

There is more to interviewing than tricky technical questions, so these are intended merely as a guide. Not every “A” candidate worth hiring will be able to answer them all, nor does answering them all guarantee an “A” candidate. At the end of the day, hiring remains an art, a science — and a lot of work.

Why Toptal

Tired of interviewing candidates? Not sure what to ask to get you a top hire?

Let Toptal find the best people for you.

Hire a Top WordPress Developer Now

Our Exclusive Network of WordPress Developers

Looking to land a job as a WordPress Developer?

Let Toptal find the right job for you.

Apply as a WordPress Developer

Job Opportunities From Our Network

Submit an interview question

Submitted questions and answers are subject to review and editing, and may or may not be selected for posting, at the sole discretion of Toptal, LLC.

* All fields are required

Looking for WordPress Developers?

Looking for WordPress Developers? Check out Toptal’s WordPress developers.

Alexa Green

Freelance WordPress Developer
United StatesToptal Member Since May 10, 2019

Alexa has over 15 years of experience in designing and developing websites. She focuses on WordPress, Shopify, and React to create a variety of projects, from simple landing pages to sophisticated storefronts and progressive web apps. She has been called a “mad scientist,” but don’t worry; she has lovingly left the purple comic sans and lime green backgrounds in the past.

Show More

Brian Coords

Freelance WordPress Developer
United StatesToptal Member Since November 28, 2016

Brian loves solving problems with WordPress. In his previous career, he was a high school and college English teacher, which is where his love for relationships, personal growth, and strong communication skill originated. His professional passions include non-profits and educational organizations.

Show More

Scott Fennell

Freelance WordPress Developer
United StatesToptal Member Since February 20, 2017

Scott has written hundreds of WordPress themes and plugins. He specializes in 3rd-party API integrations, including Mailchimp, Cloudflare, and Shopify. He is experienced in leading technology teams, is a seasoned public speaker, and has presented at WordCamp Portland and the Google campus in Seattle. He is an active technology writer and has been published on A List Apart and CSS-Tricks many times. Scott is also a former infantry officer in the US Army.

Show More

Toptal Connects the Top 3% of Freelance Talent All Over The World.

Join the Toptal community.

Learn more