Quiz

# ============================================================
# Q1) Where should custom code live: functions.php or a plugin?
# ============================================================
# ANSWER: a small custom plugin almost always.
# functions.php is theme-scoped — switching themes breaks behaviour.
# Plugin: portable, version-controlled, per-feature.

# ============================================================
# Q2) Why is your wp_query slow on a busy site?
# ============================================================
# ANSWER: likely no posts_per_page cap + no meta query index.
# Caps:    set 'posts_per_page' = 20-50, never -1 on public pages
# Indexes: add custom indexes on wp_postmeta if you query meta heavily
#          OR materialise the data into custom tables

# ============================================================
# Q3) When to use 'transient' vs an external cache?
# ============================================================
# ANSWER:
# - Transients without object cache: stored in wp_options autoload table
#   (slow, every page reload reads them)
# - Transients WITH object cache (Redis/Memcached): in-memory, fast
# - For per-user / high-frequency cache: external cache directly
# Always install an object cache plugin on busy sites.

# ============================================================
# Q4) Sanitise on input or escape on output?
# ============================================================
# ANSWER: BOTH.
# - Sanitise on input (sanitize_text_field, absint, esc_url_raw)
# - Escape on output (esc_html, esc_attr, esc_url, wp_kses_post)
# Skip either and one bad code path opens the bug.

# ============================================================
# Q5) Nonces — what do they protect against?
# ============================================================
# ANSWER: CSRF. They are a per-action token bound to a user session.
# - wp_nonce_field('save_x', 'x_nonce') in forms
# - wp_verify_nonce($_POST['x_nonce'], 'save_x') in handlers
# - check_admin_referer / check_ajax_referer convenience wrappers
# Nonces are NOT a substitute for capability checks (current_user_can).

# ============================================================
# Q6) Why does your REST endpoint return 401 even with cookies?
# ============================================================
# ANSWER: the X-WP-Nonce header is missing.
# WP REST cookie auth requires:
# - wp_create_nonce('wp_rest') minted server-side
# - sent as 'X-WP-Nonce' header on the fetch
# Without it, the cookie session is rejected for security.

# ============================================================
# Bonus — when is XML-RPC dangerous?
# ============================================================
# ANSWER: enabled by default on most installs; abused for password brute
# force via wp.getUsersBlogs and amplification attacks. Disable if unused:
# add_filter('xmlrpc_enabled', '__return_false');

# ============================================================
# Scoring
# 6 / 6 -> WordPress production-ready
# 4 / 6 -> revisit wordpress/cheatsheet
# < 4   -> read the WP Codex on Plugin API + Security

// 3 questions per lesson.