Advanced Professional WordPress Developer Certification — Questions and Answers

Question 1: How do WordPress professionals evaluate research quality?

By the reputation of the author only
Research quality cannot be evaluated
By assessing methodology, sample size, peer review status, and relevance to practice (Correct answer)
By publication date only

Correct answer: By assessing methodology, sample size, peer review status, and relevance to practice

This is fundamental to WordPress practice. By assessing methodology, sample size, peer review status, and relevance to practice represents the professional standard for research in the WordPress certification framework.

Question 2: When using Google Search Console data integrated with WordPress, which metric best indicates that a page's content is mismatched with searcher intent?

High number of indexed pages
High impressions but low click-through rate (CTR) (Correct answer)
High average position for branded queries
Low crawl error count

Correct answer: High impressions but low click-through rate (CTR)

High impressions with low CTR signals that the page appears in search results but fails to attract clicks, often indicating a title or meta description mismatch with searcher intent.

Question 3: What is the most secure approach when configuring database privileges for the WordPress database user?

Grant ALL PRIVILEGES on all databases to ensure WordPress always functions correctly
Grant only SELECT, INSERT, UPDATE, DELETE, and CREATE privileges needed for normal operation (Correct answer)
Grant SUPER privileges to allow all possible database operations
Use the root database user for simplicity and unrestricted access

Correct answer: Grant only SELECT, INSERT, UPDATE, DELETE, and CREATE privileges needed for normal operation

Following the principle of least privilege, the WordPress database user should have only the minimum permissions required, limiting potential damage if credentials are ever compromised.

Question 4: Which WordPress function is used to redirect a user to another URL and exit script execution?

wp_redirect() alone
header('Location: ...')
wp_safe_redirect()
wp_redirect() followed by exit() (Correct answer)

Correct answer: wp_redirect() followed by exit()

wp_redirect() sends the Location header but requires an explicit exit() or die() call to stop further script execution.

Question 5: When a WordPress site's bounce rate increases significantly after a theme change, what is the evidence-based next step?

Assume the new audience is less engaged and proceed
Disable all plugins to isolate the issue
Immediately revert the theme without further investigation
Correlate the bounce rate spike with the theme change date and test specific elements that changed (Correct answer)

Correct answer: Correlate the bounce rate spike with the theme change date and test specific elements that changed

Correlating the metric change with the deployment timeline and testing specific changed elements uses a systematic, evidence-driven diagnostic approach.

Question 6: In WordPress plugin development, what does the __() function do?

Outputs debugging information
Registers a JavaScript callback
Creates a double underscore variable
Returns a translated string for internationalization (Correct answer)

Correct answer: Returns a translated string for internationalization

__() is the core WordPress translation function that returns the translated version of a string for the plugin's text domain.

Question 7: What WordPress function checks whether a plugin is currently active?

wp_plugin_active()
check_plugin()
is_plugin_active() (Correct answer)
plugin_is_active()

Correct answer: is_plugin_active()

is_plugin_active() checks if a specific plugin is active by verifying its presence in the active plugins option.

Question 8: Which WordPress function is used to register an activation hook for a plugin?

register_activation_hook() (Correct answer)
wp_register_activation()
add_action('activate')
plugin_activate()

Correct answer: register_activation_hook()

register_activation_hook() runs a specified callback function when the plugin is activated from the WordPress admin.

Question 9: What does enabling two-factor authentication (2FA) in WordPress require users to provide at login?

Both their password and a secondary verification code from a separate device or app (Correct answer)
A password and their email address confirmed each time they log in
Two security questions answered correctly before gaining access
Two separate passwords configured during account creation

Correct answer: Both their password and a secondary verification code from a separate device or app

2FA requires users to provide their password plus a time-based or device-generated code, meaning a stolen password alone is insufficient to gain unauthorized access.

Question 10: A WordPress site has been defaced. After restoring from backup, what is the FIRST risk management step?

Change the site's color scheme
Disable all comments permanently
Purchase a new domain name
Identify and remediate the root cause vulnerability before going live again (Correct answer)

Correct answer: Identify and remediate the root cause vulnerability before going live again

Restoring without fixing the vulnerability means the attacker can compromise the site again immediately.

Question 11: What does the 'noindex' meta tag do when added to a WordPress page?

Tells search engines not to include that page in search results (Correct answer)
Blocks visitors from viewing the page
Disables comments on the page
Removes the page from the sitemap only

Correct answer: Tells search engines not to include that page in search results

The noindex directive instructs search engine crawlers to exclude the page from their index, preventing it from appearing in search results.

Question 12: What WordPress hook fires after all plugins are loaded and is safe for plugin interoperability?

wp_loaded
plugins_loaded (Correct answer)
init
after_setup_theme

Correct answer: plugins_loaded

The plugins_loaded hook fires after all active plugins are included, making it safe to check for other plugins or extend their functionality.

Question 13: What role does peer review play in WordPress practice?

It provides quality assurance and professional development through collegial evaluation (Correct answer)
It is only for beginners
It creates unnecessary competition
It replaces formal certification

Correct answer: It provides quality assurance and professional development through collegial evaluation

This is fundamental to WordPress practice. It provides quality assurance and professional development through collegial evaluation represents the professional standard for professional standards in the WordPress certification framework.

Question 14: What does enabling HTTPS/SSL on a WordPress site primarily protect against?

Unauthorized installation of malicious plugins by attackers
Interception of data transmitted between the user's browser and the web server (Correct answer)
Brute force login attempts against the wp-admin panel
SQL injection attacks targeting the WordPress database

Correct answer: Interception of data transmitted between the user's browser and the web server

HTTPS uses SSL/TLS encryption to secure data in transit, protecting login credentials, personal data, and form submissions from being intercepted by man-in-the-middle attacks.

Question 15: WordPress Codex is?

The required password to access the WordPress Dashboard
Encrypted codes used for template design
The name of a plugin used to enhance your template
An encyclopedia of WordPress knowledge (Correct answer)

Correct answer: An encyclopedia of WordPress knowledge

The WordPress Codex is the official online manual and knowledge base for WordPress. It serves as a comprehensive encyclopedia, providing extensive documentation, tutorials, and reference materials for users, developers, and designers. The Codex covers everything from installation and basic usage to advanced theme and plugin development.

Question 16: How can you prevent directory listing in WordPress, where visitors could browse the contents of folders?

Change the WordPress permalink structure to the plain setting
Disable the WordPress REST API in site settings
Add 'Options -Indexes' to the .htaccess file (Correct answer)
Delete all index.php files from WordPress subdirectories

Correct answer: Add 'Options -Indexes' to the .htaccess file

Adding 'Options -Indexes' to .htaccess instructs Apache to return a 403 Forbidden error instead of displaying directory contents when no index file exists.

Question 17: What is the WordPress media library used for?

Storing and managing uploaded images, videos, and files (Correct answer)
Hosting external CDN assets
Storing theme templates
Managing plugin files

Correct answer: Storing and managing uploaded images, videos, and files

The WordPress media library is a centralized place to upload, organize, and reuse images, documents, audio, and video files.

Question 18: How should an WordPress professional handle a situation outside their scope of competency?

Attempt it anyway
Recognize limitations and refer to or consult with appropriate specialists (Correct answer)
Ignore the situation
Decline all unfamiliar work

Correct answer: Recognize limitations and refer to or consult with appropriate specialists

This is fundamental to WordPress practice. Recognize limitations and refer to or consult with appropriate specialists represents the professional standard for professional standards in the WordPress certification framework.

Question 19: Which file in a WordPress installation contains the database credentials and requires the most careful protection?

wp-config.php (Correct answer)
functions.php
wp-login.php
.htaccess

Correct answer: wp-config.php

wp-config.php contains the database name, username, password, and secret keys, making it the most sensitive file in any WordPress installation.

Question 20: Which security measure prevents WordPress from revealing its version number to potential attackers?

Removing the version meta tag from the header using a function in functions.php (Correct answer)
Setting the DISALLOW_FILE_MODS constant to true in wp-config.php
Changing the WordPress permalink structure to numeric post IDs
Disabling the WordPress REST API entirely through a plugin

Correct answer: Removing the version meta tag from the header using a function in functions.php

By default, WordPress outputs its version in the HTML head meta tag; removing it via functions.php prevents attackers from easily identifying outdated, vulnerable installations.

Question 21: What WordPress setting controls the URL structure of your posts and pages?

Reading settings
Discussion settings
General settings
Permalink settings under Settings > Permalinks (Correct answer)

Correct answer: Permalink settings under Settings > Permalinks

WordPress Permalink settings allow you to choose URL structures like Post Name, Day and Name, or custom structures using tags.

Question 22: What risk does 'user enumeration' present to a WordPress site?

It reveals server PHP version information
It causes performance degradation from database queries
It exposes private post content to anonymous users
It allows attackers to discover valid usernames to target with brute-force attacks (Correct answer)

Correct answer: It allows attackers to discover valid usernames to target with brute-force attacks

WordPress exposes usernames via the author archives by default; knowing valid usernames gives attackers half the credentials needed to log in.

Question 23: Which approach best protects the WordPress wp-admin directory from unauthorized access attempts?

Installing a free security theme with built-in admin panel protection features
Enabling WordPress maintenance mode during non-business hours
Restricting access by IP address and adding HTTP basic authentication at the server level (Correct answer)
Only changing the default admin username from 'admin' to something unique

Correct answer: Restricting access by IP address and adding HTTP basic authentication at the server level

IP restrictions limit wp-admin access to known addresses, and HTTP basic authentication adds a second password challenge before WordPress loads, blocking automated scanning tools.

Question 24: Which WordPress function returns the URL of the current site's home page?

site_url()
home_url() (Correct answer)
get_site_url()
get_permalink()

Correct answer: home_url()

home_url() returns the URL set as the 'Site Address (URL)' in WordPress Settings, which may differ from site_url().

Question 25: Which WordPress feature allows you to limit the number of login attempts to reduce brute-force attack risk?

Built-in WordPress core setting
Changing the wp-admin folder name only
Editing wp-config.php directly
Third-party plugin such as Limit Login Attempts Reloaded (Correct answer)

Correct answer: Third-party plugin such as Limit Login Attempts Reloaded

WordPress core does not natively limit login attempts, so a dedicated plugin is required to mitigate brute-force risk.

Question 26: What is the correct way to enqueue a stylesheet in WordPress?

add_action('stylesheet')
wp_add_style()
register_style()
wp_enqueue_style() (Correct answer)

Correct answer: wp_enqueue_style()

wp_enqueue_style() is the proper WordPress function to register and load CSS stylesheets in the correct order.

Question 27: What does the WordPress Excerpt feature provide?

The first paragraph of a post only
A post's metadata summary
A short summary of a post used in archives and search results (Correct answer)
A featured image caption

Correct answer: A short summary of a post used in archives and search results

The excerpt is a manually written or auto-generated short summary of a post, commonly displayed in archive listings and RSS feeds.

Question 28: What does a WordPress malware scanner primarily check for during a security scan?

Broken internal links and missing images throughout the site
Spelling and grammar errors within published post and page content
Modified core files, injected malicious code, and signatures matching known malware (Correct answer)
SEO issues such as missing meta descriptions and duplicate page titles

Correct answer: Modified core files, injected malicious code, and signatures matching known malware

Malware scanners compare WordPress files against known clean versions, detect unauthorized code injections, and identify file patterns matching known malware signatures.

Question 29: How does continuous improvement apply to WordPress quality management?

It is a one-time initiative
It applies only to products
It involves ongoing incremental enhancements to processes based on data and feedback (Correct answer)
It means constant major changes

Correct answer: It involves ongoing incremental enhancements to processes based on data and feedback

This is fundamental to WordPress practice. It involves ongoing incremental enhancements to processes based on data and feedback represents the professional standard for quality in the WordPress certification framework.

Question 30: What is the risk of using nulled (pirated) WordPress themes or plugins?

Slower theme loading speeds
Loss of theme customization options
High probability of embedded malware and backdoors (Correct answer)
Incompatibility with block editor only

Correct answer: High probability of embedded malware and backdoors

Nulled software is commonly modified to include malicious code such as backdoors, redirects, or spam injectors.

Question 31: Which WordPress constant, added to wp-config.php, prevents administrators from editing theme and plugin files through the admin panel?

define('DISALLOW_FILE_EDIT', true); (Correct answer)
define('DISABLE_EDITOR', true);
define('WP_EDITOR_OFF', true);
define('BLOCK_FILE_MODS', false);

Correct answer: define('DISALLOW_FILE_EDIT', true);

Setting DISALLOW_FILE_EDIT to true removes the built-in theme and plugin file editors from the WordPress admin, preventing attackers from injecting code if they gain admin access.

Question 32: After enabling a security plugin's file integrity monitoring, hundreds of 'modified file' alerts appear immediately after a WordPress core auto-update. How should you respond?

Acknowledge the alerts as expected post-update changes and re-baseline the file hashes (Correct answer)
Disable auto-updates permanently
Restore from a backup taken before the update
Roll back WordPress to the previous version

Correct answer: Acknowledge the alerts as expected post-update changes and re-baseline the file hashes

Core auto-updates legitimately modify WordPress files; re-baselining after an update clears false positives from the integrity monitor.

Question 33: What is a Data Processing Agreement (DPA) required for under GDPR when a WordPress site uses a third-party email service?

To transfer ownership of the data to the email provider
To grant the email provider access to the site's admin panel
To comply with anti-spam laws only
To legally define how the processor handles personal data on behalf of the controller (Correct answer)

Correct answer: To legally define how the processor handles personal data on behalf of the controller

A DPA is a contract that defines how a data processor (email service) handles personal data on behalf of the data controller (the site owner).

Question 34: What is the primary value of case study analysis in WordPress training?

Memorizing specific outcomes
Replacing hands-on experience
Learning only from failures
Developing critical thinking by applying theory to realistic professional scenarios (Correct answer)

Correct answer: Developing critical thinking by applying theory to realistic professional scenarios

This is fundamental to WordPress practice. Developing critical thinking by applying theory to realistic professional scenarios represents the professional standard for practical in the WordPress certification framework.

Question 35: What does the WP_Query class allow plugins to do in WordPress?

Run custom database queries to retrieve posts with specific parameters (Correct answer)
Query the WordPress options table only
Manage plugin settings
Execute raw SQL without sanitization

Correct answer: Run custom database queries to retrieve posts with specific parameters

WP_Query provides a safe, flexible object-oriented way to query WordPress posts, pages, and custom post types with many parameters.

Question 36: A remote editorial team needs to collaborate on WordPress content without overwriting each other's work. Which approach minimizes conflicts?

Lock the site to one editor at a time using a maintenance plugin
Have all editors share a single WordPress login
Email Word documents back and forth and paste into WordPress
Use co-authoring plugins (e.g., PublishPress) and assign posts to specific editors with status workflows (Correct answer)

Correct answer: Use co-authoring plugins (e.g., PublishPress) and assign posts to specific editors with status workflows

Editorial workflow plugins like PublishPress assign ownership, define statuses, and prevent editing conflicts among team members.

Question 37: What does a WordPress site's threat model help you determine?

The optimal WordPress version to use
The number of plugins needed
Which specific threats are most likely and impactful for your site (Correct answer)
The visual design of the login page

Correct answer: Which specific threats are most likely and impactful for your site

A threat model identifies likely attackers, attack vectors, and potential impacts specific to your site's context.

Question 38: In WordPress content strategy, what does 'content decay' refer to, and how is it identified using data?

Decreased page speed on older posts, identified via Core Web Vitals reports
Gradual decline in organic traffic to older posts, identified by tracking ranking and traffic trends over time (Correct answer)
WordPress database bloat from post revisions, identified via database size metrics
Broken images on old posts, identified via media library audits

Correct answer: Gradual decline in organic traffic to older posts, identified by tracking ranking and traffic trends over time

Content decay is the gradual loss of organic traffic and rankings for older content, identified by monitoring long-term traffic and ranking trends in analytics and Search Console.

Question 39: What is the primary security purpose of a WordPress nonce?

To encrypt post content before storing it in the database
To verify that a form submission or action request is legitimate and not a cross-site forgery (Correct answer)
To create unique download URLs for media files
To generate unique usernames for newly registered WordPress accounts

Correct answer: To verify that a form submission or action request is legitimate and not a cross-site forgery

Nonces (numbers used once) are security tokens that verify requests originate from the expected source, protecting against CSRF (cross-site request forgery) attacks.

Question 40: Which WordPress hook fires after all plugins have been loaded but before theme setup?

plugins_loaded (Correct answer)
after_setup_theme
wp_loaded
init

Correct answer: plugins_loaded

plugins_loaded fires after all active plugins are loaded, giving access to all plugin functions before init.

Question 41: What is the purpose of transients in WordPress?

To store permanent user preferences in the database
To track session tokens for logged-in users
To queue background email notifications
To temporarily cache data in the database with an optional expiration time (Correct answer)

Correct answer: To temporarily cache data in the database with an optional expiration time

Transients API stores temporary cached data in the database (or object cache) with a TTL, reducing expensive repeated API calls or queries.

Question 42: What is the default WordPress database table prefix, and why is changing it considered a security best practice?

It is 'db_', and changing it prevents all SQL injection attacks
It is 'wptable_', and changing it is required for multisite installations
It is 'wordpress_', and changing it speeds up database queries
It is 'wp_', and changing it makes SQL injection attacks targeting default table names less effective (Correct answer)

Correct answer: It is 'wp_', and changing it makes SQL injection attacks targeting default table names less effective

The default prefix 'wp_' is well-known to attackers; changing it makes automated SQL injection attempts targeting default table names less likely to succeed.

Question 43: How should WordPress professionals prioritize identified risks?

Based on likelihood of occurrence combined with severity of potential impact (Correct answer)
By cost to mitigate only
Randomly
Alphabetically

Correct answer: Based on likelihood of occurrence combined with severity of potential impact

This is fundamental to WordPress practice. Based on likelihood of occurrence combined with severity of potential impact represents the professional standard for risk management in the WordPress certification framework.

Question 44: What file permission setting is recommended for wp-config.php to prevent unauthorized access?

755 (read and execute for all, write only for owner)
400 or 440 (read-only for owner or owner and group) (Correct answer)
644 (read for everyone, write only for owner)
777 (read, write, and execute for all users)

Correct answer: 400 or 440 (read-only for owner or owner and group)

Setting wp-config.php to 400 or 440 restricts access so only the file owner (or owner and group) can read it, preventing other users from accessing database credentials.

Question 45: Which combination of measures is most effective for protecting the WordPress login page against brute force attacks?

Disabling comments on all posts and pages
Changing the site tagline to something obscure
Limiting login attempts and adding CAPTCHA verification (Correct answer)
Removing the default admin username only

Correct answer: Limiting login attempts and adding CAPTCHA verification

Limiting login attempts blocks repeated failed logins while CAPTCHA prevents automated bots, together making brute force attacks significantly harder to execute.

Question 46: Which WordPress setting must be configured correctly to enable media file uploads in the admin dashboard?

The database must have a media table created manually
The wp-content folder must be set to read-only
The WordPress address must match the site address exactly
The uploads directory inside wp-content must be writable by the web server (Correct answer)

Correct answer: The uploads directory inside wp-content must be writable by the web server

WordPress needs write permission on wp-content/uploads to store uploaded images and files; incorrect permissions produce upload errors.

Question 47: Which function is used to register a custom post type in WordPress?

add_post_type()
register_post_type() (Correct answer)
wp_register_post()
create_post_type()

Correct answer: register_post_type()

register_post_type() creates a new content type with custom labels, capabilities, and features like REST API support.

Question 48: What is the purpose of the WordPress Settings API in plugin development?

To register custom taxonomies
To access the WordPress REST API
To create secure, standardized plugin settings pages integrated with WordPress admin (Correct answer)
To store theme customizer settings

Correct answer: To create secure, standardized plugin settings pages integrated with WordPress admin

The Settings API provides functions like register_setting() and add_settings_field() to build plugin options pages safely and consistently.

Question 49: When creating a Gutenberg block, which file format defines the block's metadata including name, title, and supported features?

block.json (Correct answer)
block-metadata.php
register.json
index.js

Correct answer: block.json

block.json is the standard manifest file for Gutenberg blocks, containing all metadata and used for server-side registration.

Question 50: Where should wp-config.php ideally be relocated to improve WordPress security?

One directory level above the WordPress web root (public_html) (Correct answer)
Into the wp-content directory alongside themes and plugins
It cannot be moved and must remain in the WordPress root directory
Into the wp-admin directory alongside other core admin files

Correct answer: One directory level above the WordPress web root (public_html)

WordPress automatically searches one directory above the web root for wp-config.php, so moving it there keeps the file outside the publicly accessible document root.

Question 51: Which function allows a WordPress theme to add support for featured images?

add_image_support()
add_theme_support('post-thumbnails') (Correct answer)
register_thumbnail()
enable_featured_image()

Correct answer: add_theme_support('post-thumbnails')

add_theme_support('post-thumbnails') enables the featured image metabox and functions in the theme.

Question 52: Which WordPress function allows a plugin to add a top-level admin menu page?

add_menu_page() (Correct answer)
add_dashboard_page()
register_menu()
add_options_page()

Correct answer: add_menu_page()

add_menu_page() creates a new top-level item in the WordPress admin sidebar navigation.

Question 53: Where should plugin option data typically be stored in WordPress?

A custom flat file
The wp_posts table
The wp_options table using the Options API (Correct answer)
Session variables

Correct answer: The wp_options table using the Options API

WordPress plugins should use the Options API (get_option/update_option) which stores data in the wp_options table.

Question 54: Which WordPress action hook is the recommended place to run code that requires the WordPress environment but should run as early as possible?

wp
init (Correct answer)
plugins_loaded
template_redirect

Correct answer: init

The 'init' hook fires after WordPress is fully loaded and is the standard place for registering post types, taxonomies, and most initialization code.

Question 55: Which of the following actions must a WordPress site take under CAN-SPAM for every commercial email it sends?

Use HTML format only
Send only during business hours
Include the physical postal address of the sender (Correct answer)
Limit the email to 500 words

Correct answer: Include the physical postal address of the sender

CAN-SPAM requires every commercial email to include the sender's valid physical postal address to ensure accountability and enable contact.

Question 56: What is the role of professional journals in WordPress practice?

They are optional reading
They only benefit academics
They disseminate current research, best practices, and professional developments (Correct answer)
They are outdated by publication time

Correct answer: They disseminate current research, best practices, and professional developments

This is fundamental to WordPress practice. They disseminate current research, best practices, and professional developments represents the professional standard for research in the WordPress certification framework.

Question 57: What argument in WP_Query lets you query posts from multiple custom taxonomies simultaneously?

tax_query (Correct answer)
meta_query
taxonomy
term_query

Correct answer: tax_query

tax_query accepts an array of taxonomy parameters and supports 'relation' to combine multiple taxonomy queries.

Question 58: What is a WordPress nonce used for in plugin development?

Verifying form submissions and protecting against CSRF attacks (Correct answer)
Encrypting user passwords
Registering post types
Caching database queries

Correct answer: Verifying form submissions and protecting against CSRF attacks

Nonces are one-time security tokens used to verify that form submissions and URL requests come from legitimate, authenticated sources.

Question 59: A WordPress site handles medical appointment data. Which additional compliance risk framework becomes relevant?

GDPR only
HIPAA (Health Insurance Portability and Accountability Act) (Correct answer)
SOC 2
ISO 9001

Correct answer: HIPAA (Health Insurance Portability and Accountability Act)

Medical and health-related data in the US is governed by HIPAA, which imposes strict security and privacy requirements.

Question 60: Which WordPress function should developers use to sanitize plain text input from users before saving it to the database?

sanitize_text_field() (Correct answer)
wp_insert_post()
get_option()
wp_filter_content_tags()

Correct answer: sanitize_text_field()

sanitize_text_field() removes HTML tags, extra whitespace, and invalid UTF-8 characters from user-supplied text, preventing XSS and injection attacks.

Question 61: What WordPress function creates a custom database table for a plugin?

register_table()
wpdb->create_table()
dbDelta() (Correct answer)
wp_create_table()

Correct answer: dbDelta()

dbDelta() compares the desired table structure with the existing schema and applies only the necessary changes.

Question 62: What security risk is introduced by using nulled (pirated) WordPress themes or plugins?

They prevent WordPress from connecting to the official update server
They significantly reduce WordPress performance by 50% or more
They commonly contain backdoors and malicious code that can compromise the entire site (Correct answer)
They conflict with the WordPress REST API, causing API errors

Correct answer: They commonly contain backdoors and malicious code that can compromise the entire site

Nulled themes and plugins are frequently modified to include malware, backdoors, or spam injection code, giving attackers persistent access to the compromised site.

Question 63: What is a WordPress shortcode and how is it registered?

A tag like [my_shortcode] registered with add_shortcode() (Correct answer)
A PHP snippet added to functions.php directly
A custom menu item
A Gutenberg block pattern

Correct answer: A tag like [my_shortcode] registered with add_shortcode()

Shortcodes are bracketed tags processed by WordPress, registered using add_shortcode() with a tag name and callback function.

Question 64: When implementing GDPR compliance on a WordPress membership site, what must happen before collecting a user's email address?

Send a welcome email first
Verify the email address format
Obtain explicit informed consent (Correct answer)
Store the email in plain text

Correct answer: Obtain explicit informed consent

GDPR requires explicit informed consent before collecting personal data such as email addresses.

Question 65: What is the correct way to handle AJAX requests securely in WordPress plugins?

Use wp_ajax_ and wp_ajax_nopriv_ hooks with nonce verification (Correct answer)
Create a custom PHP endpoint file
Use jQuery $.get without authentication
Use $_POST directly in functions.php

Correct answer: Use wp_ajax_ and wp_ajax_nopriv_ hooks with nonce verification

WordPress provides wp_ajax_ (for logged-in users) and wp_ajax_nopriv_ hooks plus nonces to handle AJAX securely.

Advanced Professional WordPress Developer Certification

The Advanced Professional WordPress Developer Certification by WordPress VIP validates advanced competency in enterprise WordPress development, covering core architecture, custom development, security, performance, scalability, change management, and disaster recovery.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds