I85PREP
⌘ K
WP-C study materials
WP-C study resources

WP-C practice questions

One question at a time. Build your WP-C understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web content development

In a WordPress child theme, what is the primary purpose of the style.css file's Template header line?

  1. It declares the parent theme directory that supplies fallback templates Correct answer.
  2. It registers the child theme's text domain for translation
  3. It lists the stylesheets to enqueue in the child theme
  4. It sets the child theme's version number for cache busting

Explanation

The Template header tells WordPress which parent theme directory to fall back to when a template file is missing in the child theme. Without a matching Template value, WordPress does not treat the folder as a valid child theme. Version and text domain are handled by other headers such as Version and Text Domain.

Question 2Web content development

A developer wants a plugin's custom field value saved with the post but hidden from the default Custom Fields metabox. Which function prefix is appropriate?

  1. wp_cache_set
  2. update_post_meta with a leading underscore key Correct answer.
  3. update_option
  4. set_transient

Explanation

Post meta keys beginning with an underscore are treated as protected and are hidden from the default Custom Fields interface. update_post_meta() stores the value against the post ID. Options, transients, and object cache entries are not tied to a single post's meta table.

Question 3Web content development

Which WordPress function should be used to safely output a translated string inside an HTML attribute?

  1. wp_kses_post()
  2. esc_attr__() Correct answer.
  3. esc_html__()
  4. _e()

Explanation

esc_attr__() retrieves a translated string and escapes it for safe use inside an HTML attribute. _e() echoes without escaping and is unsafe in attributes. esc_html__() escapes for HTML body content, not attribute context.

Question 4Web content development

A block theme defines its page structure using which file?

  1. templates/index.html Correct answer.
  2. single.php
  3. header.php
  4. functions.php

Explanation

Block themes store block-based templates as HTML files inside the templates directory, with index.html as the fallback template. PHP template files like header.php and single.php belong to classic themes. functions.php handles setup logic in both theme types but does not define page structure.

Question 5Web content development

Which hook fires after a post is saved to the database and is commonly used to process submitted metabox data?

  1. init
  2. after_setup_theme
  3. save_post Correct answer.
  4. wp_loaded

Explanation

save_post fires after a post is created or updated, making it the standard place to validate and store metabox values. init and wp_loaded run on every request during bootstrap, before any post save. after_setup_theme runs once when the theme loads.

Question 6Web content development

In the WordPress template hierarchy, which template is used to display a category archive when no more specific category template exists?

  1. index.php
  2. category.php
  3. home.php
  4. archive.php Correct answer.

Explanation

The hierarchy for a category archive falls back to archive.php when category.php and category-{slug}.php are absent. index.php is the final fallback only after archive.php is missing. home.php is used for the blog posts index.

Question 7Web content development

Which function enqueues a stylesheet in a theme while ensuring it loads after its dependency?

  1. wp_register_script
  2. wp_add_inline_style
  3. wp_enqueue_style Correct answer.
  4. get_stylesheet_uri

Explanation

wp_enqueue_style() accepts a dependencies array so the stylesheet loads after the listed handles. wp_register_script and wp_add_inline_style relate to scripts or inline CSS attachment. get_stylesheet_uri() only returns the child theme's stylesheet URL.

Question 8Web content development

What does the nonce created by wp_nonce_field() protect against when added to a form?

  1. SQL injection in database queries
  2. Cross-site request forgery on form submissions Correct answer.
  3. Brute-force login attempts
  4. Unauthorized file uploads by content type

Explanation

A nonce is a time-limited token verified on submission, which prevents cross-site request forgery because an attacker cannot know the valid token. It does not sanitize SQL, restrict upload MIME types, or rate-limit logins. Those concerns need separate measures.

Question 9Web content development

A developer registers a custom post type but its archive page returns a 404. Which action most directly resolves this?

  1. Add the post type to the theme's style.css header
  2. Enable the REST API on the post type
  3. Increase the posts_per_page setting
  4. Flush the rewrite rules after registering the post type Correct answer.

Explanation

Custom post type rewrite rules are cached, so a newly registered type with has_archive enabled returns 404 until the rules are flushed. Flushing once after registration (or on activation) rebuilds the permalink rules. Style headers, pagination, and REST support do not affect archive routing.

Question 10Web content development

Which approach correctly sanitizes and validates an integer metabox value before saving?

  1. Store $_POST['qty'] directly with update_post_meta
  2. Pass the value through wp_kses_post() before saving
  3. Rely on the database column type to reject bad input
  4. Use absint() on the value and verify the nonce first Correct answer.

Explanation

Checking the nonce confirms the request is legitimate, and absint() forces the value to a non-negative integer before storage. Saving raw $_POST data allows injection of unexpected values. wp_kses_post() is for HTML content, not numeric validation.

Question 11Web content development

A theme needs a widget area. Which sequence registers and then displays it correctly?

  1. Call dynamic_sidebar() first, then register_sidebar()
  2. Call register_sidebar() inside the template file only
  3. Call register_sidebar() on widgets_init, then dynamic_sidebar() in the template Correct answer.
  4. Call wp_register_sidebar_widget() in the template, then the_widget()

Explanation

Sidebars must be registered on the widgets_init hook before templates render, then output with dynamic_sidebar() at the desired location. Registering inside a template is too late and runs repeatedly. The other options call display functions before registration exists.

Question 12Web content development

How should a plugin add a custom REST API route that accepts a numeric ID parameter?

  1. Add a rewrite rule that maps the URL to index.php
  2. Register a shortcode that parses the ID from the query string
  3. Use register_rest_route() with an args array defining validate_callback Correct answer.
  4. Hook the route into admin_init as a page callback

Explanation

register_rest_route() accepts an args definition per parameter where validate_callback and sanitize_callback enforce the expected type. Rewrite rules, shortcodes, and admin pages do not create REST endpoints or validate JSON input. The args array is where schema enforcement belongs.

Question 13Web content development

A developer wants to override a parent theme function that is wrapped in function_exists(). What is the correct child theme technique?

  1. Use remove_action() to unhook the function
  2. Copy the parent functions.php into the child and edit it
  3. Remove the function_exists() check from the parent file
  4. Define the same function name in the child functions.php before the parent loads Correct answer.

Explanation

Because the child functions.php loads before the parent's, defining the same function name there makes the parent's function_exists() check skip its own definition. Copying the parent file or editing parent code breaks update safety. remove_action() only works for hooked callbacks.

Question 14Web content development

Which capability check is appropriate before allowing a user to publish a post through a custom front-end form?

  1. current_user_can('read')
  2. wp_verify_nonce() alone
  3. is_user_logged_in()
  4. current_user_can('edit_posts') Correct answer.

Explanation

current_user_can('edit_posts') confirms the user has publishing-related post privileges, and it is typically paired with a nonce check. Being logged in or having only the read capability does not grant post creation rights. A nonce verifies intent but not authorization.

Question 15Web content development

A site needs different single-post markup for a custom post type named book. Which template file should a classic theme provide?

  1. single-book.php Correct answer.
  2. archive-book.php
  3. taxonomy-book.php
  4. book-single.php

Explanation

The template hierarchy uses single-{post_type}.php for single views of a custom post type, so single-book.php is correct. archive-book.php handles the archive listing. Naming conventions place the type after the prefix, not before.

Question 16Web content development

Which function retrieves a theme modification value while applying a default when none is set?

  1. get_option()
  2. get_theme_mod() Correct answer.
  3. get_post_meta()
  4. get_site_option()

Explanation

get_theme_mod() reads values stored through the Customizer and accepts a default argument used when no value exists. get_option() reads the general options table, and get_site_option() reads network settings. get_post_meta() is scoped to a single post.

Question 17Web content development

A developer needs a shortcode that outputs a list of recent posts, escaping each title. Which implementation is correct?

  1. Echo get_the_title() directly inside the callback
  2. Build a string with esc_html(get_the_title()) and return it Correct answer.
  3. Use print_r() on the WP_Query results
  4. Return the raw post_content of each post

Explanation

Shortcode callbacks must return output rather than echo it, and titles should be escaped with esc_html() before being placed in HTML. Echoing breaks shortcode placement and skips escaping. print_r() and raw post_content expose unsafe or debug output.

Question 18Web content development

What is the effect of passing true as the third argument to register_post_type()?

  1. It makes the post type hierarchical like pages
  2. It shows the post type in the REST API Correct answer.
  3. It adds the post type to the site's navigation menu
  4. It enables the post type's archive at a generated slug

Explanation

The third argument is the args array, and setting show_in_rest to true exposes the type through the REST API and enables the block editor for it. Archive behavior is controlled by has_archive, hierarchy by the hierarchical key, and menus are separate.

Question 19Web content development

A theme's stylesheet is enqueued in the footer by mistake, causing layout flash. Which change fixes the loading position?

  1. Add the stylesheet handle to the dependencies array
  2. Pass false for the $in_footer argument in wp_enqueue_style Correct answer.
  3. Set the stylesheet's media attribute to 'all'
  4. Move the enqueue call from wp_enqueue_scripts to admin_enqueue_scripts

Explanation

wp_enqueue_style() loads styles in the head by default; passing true for in_footer moves them to the footer and causes flash. Ensuring the argument is false keeps the stylesheet in the head. Moving to admin hooks or altering dependencies does not change front-end placement.

Question 20Web content development

A plugin stores settings in a single option array. Which function correctly merges new values with existing ones without overwriting unrelated keys?

  1. delete_option() then add_option()
  2. add_option() on every request
  3. update_option() with the merged array Correct answer.
  4. update_site_option() unconditionally

Explanation

Reading the existing array, merging the new keys, then calling update_option() preserves unrelated settings. add_option() does nothing if the option already exists, and deleting first risks data loss. update_site_option() targets network-level storage.

Question 21Web content development

Which practice best prevents stored XSS when rendering user-submitted profile text inside an HTML element?

  1. Apply esc_html() to the value at output time Correct answer.
  2. Wrap the value in a nonce field
  3. Sanitize on input only and trust the stored value
  4. Use stripslashes() before echoing

Explanation

Escaping at output with esc_html() neutralizes any HTML in the stored value, which is the reliable defense against stored XSS. Sanitizing only on input can miss data inserted by other paths. stripslashes() and nonces do not escape HTML.

Question 22Web content development

A developer calls wp_localize_script() to pass data to JavaScript but the object is undefined in the script. Which cause is most likely?

  1. The nonce was not verified
  2. The script handle passed to wp_localize_script() does not match the enqueued handle Correct answer.
  3. The script was enqueued in the footer
  4. The data array contains nested arrays

Explanation

wp_localize_script() attaches data to a specific registered handle, so the handle must match the one used in wp_enqueue_script(). A mismatched handle leaves the object undefined. Nested arrays are supported, footer loading is fine, and nonces are unrelated to data attachment.

Question 23Web content development

In a multisite network, a plugin must store a setting shared across all sites. Which function is appropriate?

  1. update_site_option() Correct answer.
  2. update_option()
  3. set_transient()
  4. update_post_meta()

Explanation

update_site_option() writes to the network-wide sitemeta table, making the value available to every site in the network. update_option() is per-site, and transients expire. Post meta is scoped to individual posts.

Question 24Web content development

A custom taxonomy term page returns 404 after the taxonomy is registered. Which step is required in addition to registering it with rewrite support?

  1. Add the taxonomy to the theme's style.css header
  2. Register the taxonomy on the init hook only
  3. Flush rewrite rules after registration so term rules are generated Correct answer.
  4. Enable show_in_rest on the taxonomy

Explanation

Taxonomy rewrite rules are cached like those for post types, so they must be flushed after registration for term URLs to resolve. Registering on init is necessary but insufficient on its own. REST exposure and theme headers do not affect front-end term routing.

Question 25Web content development

A developer wants to override a parent theme's template part while keeping the parent's other templates intact. What is the correct approach?

  1. Delete the parent template so the child fallback is used
  2. Copy the entire parent theme into the child theme directory
  3. Copy only the specific template file into the child theme at the same relative path Correct answer.
  4. Rename the parent template file in the parent theme

Explanation

The child theme overrides only the template files it contains, so copying one file at the same relative path replaces just that template. Copying the whole parent duplicates maintenance and risks stale code. Editing or deleting parent files is overwritten on update.

Question 26Web content development

A developer registers a custom meta key for posts using register_post_meta() and wants the value editable in the block editor. Which argument must be set to true so the meta is exposed through the REST API?

  1. public
  2. show_ui
  3. show_in_rest Correct answer.
  4. single

Explanation

The show_in_rest argument controls whether the registered meta is available in the REST API, which the block editor relies on for reading and writing meta. Without it, the meta exists in PHP but the editor cannot access it.

Question 27Web content development

Which function should a plugin call to retrieve a saved option value while providing a fallback when the option does not exist?

  1. get_option() Correct answer.
  2. update_option()
  3. delete_option()
  4. add_option()

Explanation

get_option() returns the stored option value and accepts a second parameter used as the default when the option is absent. The other functions write or remove option data rather than read it.

Question 28Web content development

A developer wants to add a custom column to the posts list table in the admin. Which filter should be hooked to add the column header?

  1. manage_posts_custom_column
  2. wp_insert_post_data
  3. manage_posts_columns Correct answer.
  4. the_content

Explanation

The manage_{$post_type}_columns filter receives the array of column headers and lets you add or reorder them. The companion action manage_{$post_type}_posts_custom_column is used to render row values.

Question 29Web content development

Which function should be used to safely output a translated string inside an HTML attribute in a theme template?

  1. esc_html__()
  2. esc_attr__() Correct answer.
  3. _e()
  4. __()

Explanation

esc_attr__() retrieves a translated string and escapes it for use inside an HTML attribute. esc_html__() escapes for HTML body context, while __() and _e() perform no contextual escaping.

Question 30Web content development

A plugin needs to store per-post data without creating a custom database table. Which API is designed for this purpose?

  1. The metadata API Correct answer.
  2. The transient API
  3. The HTTP API
  4. The options API

Explanation

The metadata API stores key/value pairs attached to objects such as posts, users, terms, and comments. Options store site-level settings, transients store cached values with expiry, and the HTTP API handles remote requests.

Question 31Web content development

Which hook should a developer use to run code after a post has been saved and its meta written, during the same request?

  1. save_post Correct answer.
  2. wp_loaded
  3. after_setup_theme
  4. init

Explanation

save_post fires after a post is saved and is the standard hook for persisting related data. init, wp_loaded, and after_setup_theme fire during bootstrap and are unrelated to saving a post.

Question 32Web content development

Which function should be called to verify that a user has a specific capability before executing a privileged action in a plugin?

  1. wp_get_current_user()
  2. get_current_user_id()
  3. current_user_can() Correct answer.
  4. is_user_logged_in()

Explanation

current_user_can() checks whether the current user holds a given capability and returns a boolean. The other functions return user state or user objects but do not evaluate capabilities.

Question 33Web content development

A developer wants a shortcode to be processed inside widget text. Which step enables this in a classic theme?

  1. Enabling the shortcode in wp-config.php
  2. Calling strip_shortcodes() on the widget content
  3. Adding do_shortcode as a filter on widget_text output Correct answer.
  4. Registering the shortcode with add_shortcode() only

Explanation

Shortcodes are not parsed in widgets by default because widget content is not passed through do_shortcode. Filtering widget_text with do_shortcode enables parsing, and add_shortcode() alone is insufficient.

Question 34Web content development

A theme registers a navigation menu location but the menu does not appear on the front end. Which function should be used in the template to output the assigned menu?

  1. get_registered_nav_menus()
  2. register_nav_menus()
  3. wp_nav_menu() Correct answer.
  4. has_nav_menu()

Explanation

wp_nav_menu() renders the menu assigned to a location, accepting a theme_location argument. register_nav_menus() only declares locations, and has_nav_menu() just tests assignment.

Question 35Web content development

A developer needs to run a database query for posts in a custom post type with a meta value comparison. Which approach follows best practice?

  1. Querying with query_posts() inside the loop
  2. Calling $wpdb->get_results() with a hand-built query and interpolated values
  3. Using WP_Query with a meta_query array Correct answer.
  4. Using get_posts() with an unfiltered SQL string

Explanation

WP_Query with meta_query builds safe, cached queries through WordPress APIs and handles escaping internally. Direct SQL with interpolated values risks injection and bypasses caching and filters.

Question 36Web content development

A plugin must add a settings page under the Settings menu in the admin. Which function registers that page?

  1. add_options_page() Correct answer.
  2. register_setting()
  3. add_submenu_page()
  4. add_menu_page()

Explanation

add_options_page() is the dedicated helper that registers a page under the Settings menu. add_menu_page() creates a top-level menu, and register_setting() only registers a setting for the Settings API.

Question 37Web content development

A developer wants to send an email when a custom post type is published, but only once per post. Which hook is most appropriate?

  1. wp_insert_post
  2. publish_post
  3. transition_post_status Correct answer.
  4. save_post

Explanation

transition_post_status provides old and new status values, allowing detection of a change from a non-published status to publish exactly once. save_post fires on every save, which would send duplicates.

Question 38Web content development

A theme needs to load a stylesheet only on the front page. Which conditional should wrap the wp_enqueue_style() call inside the enqueue hook?

  1. is_singular()
  2. is_archive()
  3. is_home()
  4. is_front_page() Correct answer.

Explanation

is_front_page() returns true when the site front page is displayed, regardless of whether it shows posts or a static page. is_home() refers specifically to the blog posts index.

Question 39Web content development

A developer registers a custom taxonomy for a custom post type but the taxonomy does not appear in the block editor sidebar. Which argument most likely needs attention?

  1. rewrite
  2. public
  3. hierarchical
  4. show_in_rest Correct answer.

Explanation

The block editor uses the REST API, so a taxonomy must have show_in_rest set to true to appear in the editor sidebar. The hierarchical, public, and rewrite arguments affect behavior and URLs but not editor visibility.

Question 40Web content development

Which function should a developer use to escape a URL before outputting it in an href attribute?

  1. esc_url() Correct answer.
  2. sanitize_text_field()
  3. esc_html()
  4. esc_js()

Explanation

esc_url() sanitizes and escapes a URL for safe output in attributes such as href and src. esc_html() targets HTML text, esc_js() targets JavaScript strings, and sanitize_text_field() cleans plain text.

Question 41Web content development

A plugin registers a REST route and needs to restrict it to authenticated users with the edit_posts capability. Which route argument enforces this?

  1. args
  2. callback
  3. permission_callback Correct answer.
  4. methods

Explanation

permission_callback is invoked before the route callback and must return true or a WP_Error to allow access. The callback argument only defines the handler, while args define parameter validation.

Question 42Web content development

A developer wants a child theme to replace a single template file while inheriting all other templates. Where should the replacement file be placed?

  1. In wp-content/mu-plugins
  2. In the child theme directory using the same relative path Correct answer.
  3. In the child theme's functions.php only
  4. In the parent theme directory overwriting the original

Explanation

WordPress template loading checks the child theme first for the same relative path, so placing the file there overrides only that template. Editing the parent theme risks losing changes on updates.

Question 43Web content development

A developer wants to add a body class on single posts to support custom styling. Which filter provides this?

  1. body_class Correct answer.
  2. post_class
  3. template_include
  4. wp_head

Explanation

The body_class filter receives an array of body classes and can append conditions such as a post type or slug. post_class applies to individual post wrappers, not the body element.

Question 44Web content development

A developer wants to cache the result of an expensive remote API call for one hour. Which function is appropriate?

  1. wp_cache_set()
  2. set_transient() Correct answer.
  3. update_option()
  4. add_post_meta()

Explanation

set_transient() stores a value with an expiration time, making it suitable for caching remote responses temporarily. update_option() persists indefinitely, and wp_cache_set() is per-request unless a persistent object cache exists.

Question 45Web content development

A developer needs to modify the main query on a custom page template to show a specific post type without breaking pagination. Which approach is correct?

  1. Using get_posts() and assigning it to $wp_query
  2. Hooking pre_get_posts and checking is_main_query() before altering query vars Correct answer.
  3. Calling query_posts() at the top of the template
  4. Calling wp_reset_query() before the loop

Explanation

pre_get_posts with an is_main_query() check alters the main query before it runs, preserving pagination and conditional logic. query_posts() and manual reassignment break the main query state.

Question 46Web content development

A plugin saves settings through the Settings API. Which function must be called to register the setting so that $_POST values are saved and sanitized?

  1. register_setting() Correct answer.
  2. settings_errors()
  3. add_settings_section()
  4. add_settings_field()

Explanation

register_setting() whitelists the option group and option name and accepts a sanitize callback invoked during saving. Sections and fields only control form rendering.

Question 47Web content development

A developer must prevent direct access to a plugin PHP file while still allowing WordPress to load it. Which guard is standard?

  1. Calling session_start() at the top of the file
  2. Adding a closing PHP tag at the end of the file
  3. Wrapping all code in a try/catch block
  4. Checking defined('ABSPATH') and exiting if not defined Correct answer.

Explanation

WordPress defines ABSPATH during bootstrap, so checking defined('ABSPATH') blocks direct HTTP requests to plugin files. Omitting the closing PHP tag is also recommended, but the ABSPATH guard is the access-control mechanism.

Question 48Web content development

A developer must render a list of user-supplied titles where some contain HTML entities and quotes. Which function best prepares each title for safe HTML text output?

  1. sanitize_email()
  2. esc_attr()
  3. wp_kses_post()
  4. esc_html() Correct answer.

Explanation

esc_html() converts special characters to entities for safe insertion into HTML text nodes, which is the correct context for list item content. esc_attr() targets attributes, and wp_kses_post() allows a subset of HTML rather than escaping all markup.

Question 49Web content development

A developer registers a block style variation for a core block. Which function is used?

  1. wp_register_style()
  2. register_block_style() Correct answer.
  3. add_theme_support()
  4. register_block_type()

Explanation

register_block_style() declares a named style variation for a block type, which appears in the editor styles panel. register_block_type() registers an entirely new block type.

Question 50Web content development

A developer needs to internationalize a plural string such as a comment count in a theme. Which function is designed for this?

  1. _x()
  2. esc_html__()
  3. __()
  4. _n() Correct answer.

Explanation

_n() selects between singular and plural translated forms based on a count. __() handles simple strings, _x() adds context, and esc_html__() escapes a single translated string.