WordPress Quality Control & Assurance 4 — Questions and Answers
Question 1: Which database table prefix check is part of a WordPress security QA audit?
- Confirming the prefix is still 'wp_' for compatibility
- Verifying the prefix has been changed from the default 'wp_' (Correct answer)
- Ensuring all tables use the 'wps_' prefix
- Checking that no prefix is set in wp-config.php
Correct answer: Verifying the prefix has been changed from the default 'wp_'
Changing the default 'wp_' table prefix reduces the risk of SQL injection attacks that target predictable table names.
Question 2: When validating custom post type registration quality, which argument prevents the post type from appearing in search results?
- 'public' => false
- 'exclude_from_search' => true (Correct answer)
- 'show_in_nav_menus' => false
- 'has_archive' => false
Correct answer: 'exclude_from_search' => true
Setting 'exclude_from_search' to true removes a public post type's posts from WordPress front-end search results.
Question 3: A QA engineer notices that a plugin enqueues scripts on every page, including admin pages where they are not needed. What is the correct fix?
- Use wp_dequeue_script() in functions.php
- Wrap wp_enqueue_script() with an is_admin() check (or its inverse) (Correct answer)
- Set the $in_footer parameter to true
- Move script registration to the init hook
Correct answer: Wrap wp_enqueue_script() with an is_admin() check (or its inverse)
Checking is_admin() (or ! is_admin()) before enqueuing ensures scripts only load on the intended front-end or admin context.
Question 4: Which WordPress function should QA verify is used instead of a direct database query for retrieving posts?
- $wpdb->get_results()
- WP_Query (Correct answer)
- mysql_query()
- get_option()
Correct answer: WP_Query
WP_Query is the proper WordPress API for retrieving posts, providing caching, hooks, and security compared to raw queries.
Question 5: During a plugin QA review, you find unserialize() called on user input. Why is this a critical security issue?
- It causes PHP to consume excessive memory
- It can trigger PHP object injection attacks (Correct answer)
- It violates WordPress coding standards on indentation
- It breaks multisite compatibility
Correct answer: It can trigger PHP object injection attacks
Unserializing untrusted user input can lead to PHP object injection, allowing attackers to execute arbitrary code.
Question 6: What is the purpose of the SAVEQUERIES constant in WordPress debugging?
- It saves all queries to a log file automatically
- It stores all database queries in $wpdb->queries for inspection (Correct answer)
- It prevents duplicate queries from executing
- It enables slow query logging in MySQL
Correct answer: It stores all database queries in $wpdb->queries for inspection
When SAVEQUERIES is true, every database query is saved to the $wpdb->queries array for analysis during QA.
Question 7: Which approach should QA use to test that a WordPress transient is being set and retrieved correctly?
- Check the wp_options table for the transient key directly in the database
- Use get_transient() and assert the return matches the expected value in a unit test (Correct answer)
- Monitor HTTP requests in browser DevTools
- Check pm2 logs for cache hit messages
Correct answer: Use get_transient() and assert the return matches the expected value in a unit test
A unit test using get_transient() and asserting the returned value is the reliable, automated way to verify transient behavior.
WordPress Quality Control & Assurance 4
Which database table prefix check is part of a WordPress security QA audit?