100+ Top WordPress Interview Questions & Answers: Technical Review

Q1. What is WordPress and when was it founded?

WordPress is an open-source Content Management System (CMS) written in PHP and paired with a MySQL/MariaDB database. It was founded on May 27, 2003, by Matt Mullenweg and Mike Little as a fork of b2/cafelog.

Q2. What is the fundamental difference between WordPress.com and WordPress.org?

WordPress.org is the self-hosted open-source software that you download and deploy on your own web server with complete code, database, and monetization freedom. WordPress.com is a commercial hosted platform operated by Automattic with subscription paywalls for custom plugins and code access.

Q3. What is the purpose of the wp-config.php file?

The wp-config.php file is the master configuration file of WordPress. It stores MySQL database credentials (DB_NAME, DB_USER, DB_PASSWORD, DB_HOST), cryptographic authentication salts, the database table prefix ($table_prefix), and debug constants like WP_DEBUG.

Q4. What are the three primary subdirectories in a standard WordPress root installation?

1) /wp-admin/ (administrative back-end screens); 2) /wp-includes/ (core PHP classes, API libraries, and scripts); 3) /wp-content/ (user and developer directory containing themes, plugins, and media uploads).

Q5. Why is it dangerous to edit files inside /wp-includes/ or /wp-admin/?

Modifying core files ("hacking core") breaks backwards compatibility and guarantees that your custom code will be completely wiped out during the next automatic security update. All customizations must be achieved via Hooks (Actions & Filters) in plugins or child themes.

Q6. What is the difference between a Post and a Page in WordPress?

Posts are dynamic, time-sensitive blog articles organized chronologically with dates, categories, tags, author archives, and RSS feed syndication. Pages are static, timeless content (About Us, Contact, Privacy Policy) that support hierarchical parent/child nesting and custom page templates, but lack categories and tags by default.

Q7. How does WordPress store Posts and Pages in the database?

Both are stored in the exact same table: wp_posts. They are differentiated by the value in the post_type column (post_type = 'post' vs post_type = 'page').

Q8. What are the 12 core tables created during a standard WordPress installation?

wp_posts, wp_postmeta, wp_users, wp_usermeta, wp_options, wp_comments, wp_commentmeta, wp_terms, wp_term_taxonomy, wp_term_relationships, wp_termmeta, and wp_links.

Q9. What are the minimum required files to make a functional WordPress theme?

Only two files: style.css (containing the theme header comment) and index.php (the master template fallback).

Q10. What is a Child Theme and why is it mandatory for theme customization?

A Child Theme inherits all functionality and styling from its Parent Theme. Custom code written in a child theme's style.css or functions.php is preserved permanently when the parent theme receives official updates.

Q26. What is The Loop in WordPress?

The Loop is the core PHP mechanism WordPress uses to iterate through post records returned by a database query, setting up global post data so template tags (the_title(), the_content()) render the current post's content.

Q27. What is the WordPress Template Hierarchy?

The Template Hierarchy is the deterministic visual decision tree WordPress follows to choose which PHP file in your theme renders a specific request, falling back from the most specific template (e.g. category-news.php) down to the universal fallback: index.php.

Q28. What template file executes when viewing the root domain: front-page.php or home.php?

front-page.php always holds the absolute highest priority for the root domain, regardless of whether the site displays latest posts or a static page.

Q29. What is the difference between get_template_directory_uri() and get_stylesheet_directory_uri()?

get_template_directory_uri() always resolves to the Parent Theme directory path. get_stylesheet_directory_uri() resolves to the active Child Theme directory path.

Q30. Why are wp_head() and wp_footer() mandatory in all WordPress themes?

wp_head() triggers the wp_head action hook right before </head>, allowing plugins to enqueue CSS, meta tags, and analytics. wp_footer() triggers wp_footer before </body>, allowing scripts to execute. Without them, plugins break and the admin bar vanishes.

Q31. How do you safely enqueue styles and scripts in WordPress?

Never hardcode <link> or <script> tags into header.php! Always register and enqueue them using wp_enqueue_style() and wp_enqueue_script() hooked into the wp_enqueue_scripts action hook.

Q32. What is the difference between query_posts() and new WP_Query()?

query_posts() is a deprecated, destructive function that overwrites the main global loop, causes pagination bugs, and runs duplicate SQL queries. new WP_Query() is the official, non-destructive class used to instantiate secondary custom loops safely.

Q33. What does wp_reset_postdata() do and when must you call it?

It restores the global $post object back to the main query's current post. You MUST call it immediately after completing a secondary WP_Query loop; otherwise, subsequent template tags and sidebar widgets will output incorrect post data.

Q34. What is Full Site Editing (FSE)?

FSE is the modern WordPress 6.x paradigm that allows complete visual editing of headers, footers, page templates, and global styling using Block Themes, HTML block templates (in /templates/), and a central theme.json configuration file without writing PHP.

Q35. What is the role of the theme.json file?

theme.json is the single source of truth for a block theme's design system. It defines color palettes, typography scales, spacing, and generates CSS Custom Properties (variables) automatically across both frontend and editor canvases.

Q51. What is the exact difference between an Action Hook and a Filter Hook?

An Action Hook (do_action / add_action) triggers a custom task or event at a specific lifecycle point; it does NOT return a value. A Filter Hook (apply_filters / add_filter) intercepts existing data, modifies it, and MUST ALWAYS return the modified value.

Q52. What happens if a filter callback function forgets to return the filtered variable?

The variable is converted to NULL (empty blankness). If hooked to the_content, all blog post body text across the website disappears!

Q53. How do you register a Custom Post Type (CPT) and what hook do you use?

You use register_post_type($slug, $args) hooked into the init action hook. Crucially, set 'show_in_rest' => true to enable modern Gutenberg block editor support.

Q54. Why do newly registered CPTs often return a 404 error on the frontend?

Because WordPress caches its rewrite rules in the database. When a new CPT is added, the rewrite rules must be flushed by visiting Settings > Permalinks and clicking "Save Changes", or programmatically via flush_rewrite_rules().

Q55. What is the difference between a Hierarchical and Non-Hierarchical taxonomy?

Hierarchical taxonomies (like Categories) support parent/child nested relationships. Non-hierarchical taxonomies (like Tags) are flat, independent keyword labels.

Q56. What is the $wpdb object and how do you protect against SQL Injection?

$wpdb is the global database abstraction class instance. To prevent SQL Injection, developers must NEVER concatenate variables directly into SQL queries; always wrap queries in $wpdb->prepare() using type placeholders (%s, %d, %f).

Q57. What is a WordPress Nonce?

A Nonce (Number used Once) is a cryptographic verification token used to protect forms and AJAX requests against Cross-Site Request Forgery (CSRF) attacks, verified via wp_verify_nonce() or check_admin_referer().

Q58. How do you register a custom endpoint in the WordPress REST API?

Use register_rest_route('namespace/v1', '/route', $args) hooked into the rest_api_init action hook. Always define a 'permission_callback' to prevent security notices.

Q59. What is Headless WordPress?

Headless WordPress is a decoupled architecture where WordPress functions solely as a backend content repository exposing data via REST API or WPGraphQL, while a modern frontend framework (like Next.js or React) renders the user interface on edge CDNs.

Q60. What is WP-CLI?

WP-CLI is the official command-line interface for WordPress. It enables developers to perform administrative operations (plugin updates, database exports, serialized search-replace) via terminal shell scripts without opening a browser.

Q76. Why does raw SQL search-and-replace break WordPress databases?

Because WordPress stores complex widget settings and plugin options as PHP Serialized Strings with exact byte-length counters (e.g. s:14:"localhost:8888"). Changing the string length without updating the counter breaks PHP unserialization. Always use wp search-replace, which handles serialization safely.

Q77. What are Google Core Web Vitals and why do they matter for WordPress?

Core Web Vitals are real-world performance metrics incorporating LCP (Largest Contentful Paint ≤ 2.5s), INP (Interaction to Next Paint ≤ 200ms), and CLS (Cumulative Layout Shift ≤ 0.1). Google enforces them as confirmed search ranking signals.

Q78. What is the difference between Page Caching and Object Caching?

Page Caching (WP Rocket, LiteSpeed) saves pre-rendered static HTML files to bypass PHP execution entirely. Object Caching (Redis, Memcached) stores individual database query results in server RAM to speed up dynamic PHP execution.

Q79. Why should you disable XML-RPC (xmlrpc.php)?

XML-RPC is an obsolete remote API frequently exploited by botnets to execute amplified brute-force attacks and DDoS reflection attacks. Modern applications use the secure REST API.

Q80. What is the single most effective security measure against brute-force attacks?

Enforcing Two-Factor Authentication (2FA) with time-based one-time passwords (TOTP), which blocks automated attacks even if passwords are breached.

Explore Related WordPress Tutorials & Next Steps

Expand your CMS mastery by studying these tightly integrated WordPress development topics: