4) Technical and professional questions (US-focused)
This is where US Web Developer interviews separate “can code” from “can ship.” Expect questions that mix fundamentals (HTTP, browser behavior, databases) with real-world practices (CI/CD, observability, security, accessibility). If you’ve done WordPress Developer or PHP Developer work, you’ll also get stack-specific probes—especially around security and performance.
Q: Walk me through what happens when a user types a URL and hits Enter.
Why they ask it: They’re testing web fundamentals: DNS, TLS, HTTP, caching, and rendering.
Answer framework: “Layered walkthrough.” Network → server → browser.
Example answer: “The browser resolves DNS, establishes a TCP connection and usually negotiates TLS, then sends an HTTP request with headers and cookies. The server or CDN responds—ideally with cache headers—and the browser parses HTML, discovers CSS/JS, and builds the render tree. JS can block or delay rendering depending on how it’s loaded, and the browser then paints and hydrates interactive parts. I’ll also mention where caching, compression, and CDNs reduce latency.”
Common mistake: Skipping TLS/caching and turning it into a vague ‘the server returns a page.’
Q: How do you design an API endpoint for a web app—what do you consider beyond the happy path?
Why they ask it: They want to see if you think about contracts, errors, versioning, and security.
Answer framework: “Contract checklist.” Inputs/outputs, auth, errors, idempotency, pagination, observability.
Example answer: “I start with the contract: request shape, response shape, and status codes that clients can rely on. Then I define auth and authorization rules, validate inputs, and design error responses that are consistent and safe. If it’s a write endpoint, I think about idempotency and retries; if it’s a list, pagination and filtering. Finally, I add logging/metrics and document it so frontend and backend don’t drift.”
Common mistake: Treating API design as just picking REST verbs.
Q: How do you prevent XSS and CSRF in a typical web application?
Why they ask it: Security is non-negotiable, and web apps are a common attack surface.
Answer framework: “Threat → control mapping.” Name the risk, then the specific mitigations.
Example answer: “For XSS, I rely on output encoding by default, avoid dangerously injecting HTML, and use a Content Security Policy where possible. For CSRF, I use same-site cookies plus CSRF tokens for state-changing requests, and I avoid using cookies for APIs when a token-based approach is more appropriate. I also validate and sanitize inputs server-side and keep dependencies patched.”
Common mistake: Saying “we use HTTPS” as if that solves application-layer attacks.
Q: What’s your approach to accessibility on the web? (WCAG/ADA)
Why they ask it: In the US, accessibility can be a legal and reputational risk; they want practical competence.
Answer framework: “Build-in, don’t bolt-on.” Semantics → keyboard → contrast → testing.
Example answer: “I start with semantic HTML and correct ARIA only when needed, then ensure keyboard navigation and focus states work. I check color contrast and motion preferences, and I test with screen readers for key flows. On teams, I like adding automated checks—like axe in CI—and defining accessibility acceptance criteria. It’s cheaper to do it upfront than to retrofit after complaints.”
Common mistake: Treating accessibility as ‘add alt text’ and calling it done.
Q: How do you measure and improve frontend performance? What metrics do you care about?
Why they ask it: They want someone who can keep the site fast as features pile up.
Answer framework: “Measure → diagnose → fix → verify.” Mention lab + field data.
Example answer: “I look at Core Web Vitals—LCP, INP, CLS—plus bundle size and TTFB depending on the app. I use Lighthouse and DevTools for lab debugging, and real-user monitoring for field data. Fixes usually come from reducing JS, code-splitting, optimizing images/fonts, and improving caching/CDN behavior. Then I verify the change with before/after numbers and guardrails in CI.”
Common mistake: Listing optimizations without saying how you proved they worked.
Q: How do you structure state management in a complex UI?
Why they ask it: They’re testing whether you can keep a UI maintainable as it grows.
Answer framework: “Local first, global last.” Separate server state from UI state.
Example answer: “I keep state as close to where it’s used as possible, and I’m careful about what becomes global. I separate server state—fetched, cached, invalidated—from local UI state like modals and form inputs. I also define clear boundaries: components, hooks/services, and predictable data flow. The goal is fewer hidden dependencies and easier debugging.”
Common mistake: Reaching for a heavy global store for everything.
Q: What does a good CI/CD pipeline look like for a web app?
Why they ask it: They want to know if you can ship safely and repeatedly.
Answer framework: “Stages + gates.” Build, test, security, deploy, monitor.
Example answer: “A good pipeline builds artifacts deterministically, runs unit/integration tests, and includes linting and type checks. I like adding dependency scanning and basic security checks, plus preview environments for PRs. Deployments should be automated with rollback options and ideally use feature flags for risky changes. After deploy, monitoring and alerts close the loop so we catch regressions fast.”
Common mistake: Treating CI/CD as ‘we run tests sometimes.’
Q: If you’re interviewing as a WordPress Developer: how do you keep WordPress secure and fast?
Why they ask it: WordPress is common in US businesses, and it’s frequently mismanaged.
Answer framework: “Surface area reduction.” Updates, least privilege, plugin discipline, caching.
Example answer: “I keep core, themes, and plugins updated and minimize plugins to reduce attack surface. I enforce least-privilege roles, strong auth, and secure hosting defaults. For performance, I use page/object caching, optimize images, and watch third-party scripts. I also like staging environments and automated backups so updates aren’t scary.”
Common mistake: Installing lots of plugins as a substitute for engineering.
Q: If you’re interviewing as a PHP Developer: how do you handle dependency management and modern PHP practices?
Why they ask it: They want to avoid legacy PHP chaos and see if you can modernize safely.
Answer framework: “Modern baseline.” Composer, autoloading, testing, standards.
Example answer: “I use Composer for dependencies and autoloading, follow PSR standards, and keep PHP versions current within constraints. I add tests around critical logic before refactoring and use static analysis where it helps. When modernizing, I prioritize high-risk areas—auth, payments, data handling—and do incremental upgrades rather than big-bang rewrites.”
Common mistake: Saying ‘PHP is old’ instead of demonstrating how you make it robust.
Q: What would you do if your monitoring shows a sudden spike in latency, but your last deploy was hours ago?
Why they ask it: They want operational thinking beyond “it’s the deploy.”
Answer framework: Hypothesis-driven debugging. Check traffic, dependencies, infra, and data.
Example answer: “I’d confirm it’s real by checking multiple signals—APM traces, server metrics, and RUM if available. Then I’d look for traffic changes, a slow downstream dependency, database contention, or a third-party outage. I’d correlate with background jobs, cache hit rate, and error logs. If impact is high, I’d mitigate—rate limit, scale, or temporarily disable expensive features—while we isolate the root cause.”
Common mistake: Assuming every incident is caused by the last code change.