Freshworks Web Development Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Freshworks hiring for Web Development roles
Freshworks is a software-as-a-service company founded in Chennai that builds customer service, IT service management and sales software such as Freshdesk, Freshservice and Freshsales. Its India offices host most of its product and engineering teams. It hires for software engineers, QA engineers, data engineers and analysts.
For Web Development roles, this Freshworks practice set focuses most on DOM and Browser Events (6), Web Security (5), Hosting and Deployment (4), MySQL Database (4). It has 21 medium, 9 hard questions, so you can start easy and work up to the harder ones.
Company type
Product
Headquarters
San Mateo, California, USA
Main India offices
Chennai, Bengaluru, Hyderabad
Freshworks Web Development interview process
Online coding assessment
Technical round 1 (DSA)
Technical round 2 (design or domain)
Hiring manager round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for FreshworksStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
An API is being called twice when the page loads. How do you debug it?
I would open the Network tab and check the Initiator column to see which code triggered each request. Common causes are the script being included twice, an event listener attached twice, a function called on both DOMContentLoaded and load, or a framework's development mode running effects twice. I would add a breakpoint or console.trace inside the fetch function, fix the root cause, and add a guard flag only if truly needed.
02
Time to first byte is over 2 seconds even for simple pages. What do you check?
High TTFB points to the server, not the browser. I would check if OPcache is enabled, profile slow database queries, look for blocking external API calls during page generation, and check whether the server is low on CPU or memory. Fixes include full-page caching for anonymous users, object caching with Redis, upgrading PHP, choosing a server region close to Indian users, and putting a CDN in front.
03
Create a responsive card grid that needs no media queries.
auto-fit with minmax lets the grid decide how many columns fit:
.cards {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
gap: 1.5rem;
}
Each card is at least 250 pixels wide and the extra space is shared equally. On a phone it shows one column, on a tablet two and on a desktop three or four, all from three lines of CSS.
04
A search query on a 2 million row products table takes 6 seconds. How do you speed it up?
I would run EXPLAIN to see if it does a full table scan. If the WHERE uses LIKE '%phone%', a normal index cannot help, so I would add a FULLTEXT index with MATCH AGAINST or use a search engine like Elasticsearch or Meilisearch. For filters such as category and price, a composite index in the right order helps. I would also select only needed columns and cache popular searches.
05
How do you back up and restore a MySQL database from the command line?
mysqldump creates a logical SQL backup:
mysqldump -u root -p --single-transaction --routines school > school_2026_11_12.sql
mysql -u root -p school < school_2026_11_12.sql
--single-transaction takes a consistent InnoDB snapshot without locking tables. For large databases, physical backup tools or managed cloud snapshots are faster. Backups should be automated, stored off-server, and restored on a test server regularly to prove they work.
06
Validate and sanitise different types of input in PHP.
I would give every page a unique title and meta description, use exactly one clear h1 with a logical h2 and h3 structure, and add descriptive alt text. I would add canonical tags to avoid duplicate content, structured data such as JSON-LD for courses or FAQs, and internal links with meaningful anchor text. I would also improve Core Web Vitals, since page speed affects ranking.
08
A comment section displays user input using innerHTML. What is the risk and fix?
It allows stored cross-site scripting: a user can post <img src=x onerror=...> and the script runs for every visitor, stealing sessions or defacing the page. I would switch to textContent or createElement for rendering, escape output on the server, and if rich text is needed, sanitise with a library like DOMPurify. A strict Content Security Policy adds another layer by blocking inline scripts.
Generate a token per session and compare it safely:
session_start();
if (empty($_SESSION['csrf'])) {
$_SESSION['csrf'] = bin2hex(random_bytes(32));
}
// in the form
echo "<input type='hidden' name='csrf' value='" . $_SESSION['csrf'] . "'>";
// on submit
if (!hash_equals($_SESSION['csrf'], $_POST['csrf'] ?? '')) {
http_response_code(403);
exit('Invalid request');
}
hash_equals compares in constant time, which avoids timing attacks.
10
Compare BEM and utility-first approaches to CSS architecture.
BEM names classes as block__element--modifier, such as card__title--large, which keeps styles scoped and readable in large codebases. Utility-first frameworks like Tailwind CSS compose small single-purpose classes in the markup, which speeds up development and avoids growing stylesheets. BEM gives cleaner HTML, utilities give consistency and smaller final CSS after purging. The right choice depends on team size, design system and tooling.
11
Before launching a new web application, how would you run a basic security review?
I would walk through the OWASP Top 10: access control on every route, injection, authentication, session settings, misconfiguration and outdated components. I would run automated scanners like OWASP ZAP, check dependencies with composer audit and npm audit, verify HTTPS and security headers, and confirm error pages do not leak stack traces. Finally, I would test key flows manually as a normal user trying to access admin pages.
12
Rendering a table with 5,000 rows freezes the browser. What are your options?
Creating thousands of nodes at once blocks the main thread. Options are server-side pagination, rendering in chunks with requestAnimationFrame, or virtual scrolling where only the 30 to 50 visible rows exist in the DOM at any time. I would also build rows in a DocumentFragment, avoid layout reads inside loops, and use CSS content-visibility: auto so off-screen rows skip rendering work.
13
Lighthouse shows a poor Largest Contentful Paint caused by the hero image. What steps do you take?
First I would compress the image and serve it in AVIF or WebP at the correct size using srcset. I would remove loading='lazy' from it, add fetchpriority='high' and a preload link in the head, and make sure it is in the initial HTML rather than injected by JavaScript. I would also serve it from a CDN and check that render-blocking CSS is not delaying the paint.
14
Create a GitHub Actions workflow that deploys on every push to main.
Debounce delays a function until calls stop for a given time:
function debounce(fn, delay) {
let timer;
return function (...args) {
clearTimeout(timer);
timer = setTimeout(() => fn.apply(this, args), delay);
};
}
const onSearch = debounce((e) => fetchResults(e.target.value), 300);
input.addEventListener('input', onSearch);
It is used for search boxes, window resize and autosave, so the API is called once after the user pauses typing.
localStorage stores about 5 MB per origin and persists until cleared. sessionStorage has similar size but is cleared when the tab closes and is separate per tab. Cookies are small, around 4 KB, are sent to the server with every request, and can be HttpOnly, Secure and SameSite. Use cookies for session identifiers, and storage for UI preferences. Never store tokens or passwords in localStorage, since any XSS can read it.
17
A PHP page takes 8 seconds to load. How do you find the bottleneck?
I would measure before guessing, using a profiler like Xdebug or Blackfire, or simple microtime logs around sections. Usually the cause is database queries, such as an N+1 pattern running a query inside a loop, missing indexes, or slow external API calls. Fixes include joining or eager loading, adding indexes, caching results in Redis, making API calls async with a queue, and enabling OPcache.
A simple scripted deployment:
ssh deploy@server.example.com << 'EOF'
cd /var/www/app
git pull origin main
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
sudo systemctl reload php8.3-fpm
EOF
Use an SSH key, not a password, and a non-root deploy user. Reloading PHP-FPM clears OPcache so new code is served. For safer releases, deploy into a new folder and switch a symlink.
19
Emails sent from your website contact form land in spam. How do you fix it?
I would stop sending through PHP mail() from the web server and use an authenticated SMTP or transactional email service. Then I would publish SPF to authorise the sender, DKIM to sign messages, and a DMARC policy in DNS. The From address should belong to the verified domain, while the visitor's email goes in Reply-To. Mail testing tools show the spam score and missing records.
20
Fetch a list of products and render them safely into the page.
Check fields on submit and show inline messages:
form.addEventListener('submit', (e) => {
const errors = [];
if (form.name.value.trim().length < 3) errors.push('Name too short');
if (!/^[6-9]\d{9}$/.test(form.mobile.value)) errors.push('Invalid mobile');
if (form.password.value !== form.confirm.value) errors.push('Passwords do not match');
if (errors.length) {
e.preventDefault();
errorBox.textContent = errors.join('. ');
}
});
Client validation improves experience, but the server must validate again.
22
Describe a time you improved the performance of a web page.
Situation: our product listing page took over 6 seconds to become interactive. Task: I was asked to bring it under 3 seconds. Action: I profiled it in DevTools, found a large unused library and unoptimised images, replaced the library with native code, converted images to WebP with lazy loading, and deferred third-party scripts. Result: interaction time dropped to about 2.4 seconds and bounce rate fell noticeably.
23
Write a query to find duplicate email addresses in a users table.
Group by the column and keep groups with more than one row:
SELECT email, COUNT(*) AS total
FROM users
GROUP BY email
HAVING COUNT(*) > 1;
To delete duplicates but keep the lowest id:
DELETE u1 FROM users u1
JOIN users u2
ON u1.email = u2.email AND u1.id > u2.id;
Afterwards add a UNIQUE index on email so duplicates cannot come back.
24
Pagination becomes very slow on later pages. Why, and how do you fix it?
LIMIT 20 OFFSET 100000 forces MySQL to read and discard 100,000 rows before returning 20, so deep pages get slower. Keyset or cursor pagination fixes this: remember the last seen id and query WHERE id < :last_id ORDER BY id DESC LIMIT 20, which uses the index directly. It suits infinite scroll and APIs. For numbered pages, limiting maximum depth or caching counts also helps.
25
Limit failed login attempts to stop brute-force attacks.
Track failures per account and IP, then block temporarily:
$stmt = $pdo->prepare('SELECT COUNT(*) FROM login_attempts
WHERE ip = ? AND attempted_at > NOW() - INTERVAL 15 MINUTE');
$stmt->execute([$_SERVER['REMOTE_ADDR']]);
if ($stmt->fetchColumn() >= 5) {
http_response_code(429);
exit('Too many attempts. Try again in 15 minutes.');
}
// on failure
$pdo->prepare('INSERT INTO login_attempts (ip, attempted_at) VALUES (?, NOW())')
->execute([$_SERVER['REMOTE_ADDR']]);
Add CAPTCHA after a few failures and offer two-factor authentication.
26
A dashboard page becomes slower the longer it stays open. What could cause it?
This points to a memory leak. Typical causes are setInterval timers never cleared, event listeners added repeatedly on re-render, detached DOM nodes still referenced in arrays, and growing caches. I would take heap snapshots in the DevTools Memory tab a few minutes apart and compare retained objects. Fixes include clearInterval on cleanup, removeEventListener or AbortController for listeners, and limiting cached data size.
27
Use the picture element to serve WebP or AVIF with a JPEG fallback.
The browser picks the first source format it supports and falls back to img:
<picture>
<source srcset='hero.avif' type='image/avif'>
<source srcset='hero.webp' type='image/webp'>
<img src='hero.jpg' alt='Students in a coding lab' width='1200' height='600'>
</picture>
The img element still carries alt, width and height, so accessibility and layout stability are preserved. Modern formats are often 30 to 50 percent smaller than JPEG.
28
A client's WordPress site has been hacked and shows spam links. What steps do you take?
I would take a full backup for evidence, put the site in maintenance mode and change all passwords, including hosting, database, FTP and admin users. Then I would compare core files with fresh copies, scan themes, plugins and uploads for injected PHP, remove unknown admin users and check the database for spam content. After cleaning I would update everything, remove unused plugins, add a firewall and request a Google review.
29
Tell me about a time you disagreed with a designer about a layout.
Situation: a designer wanted a five-column pricing table on mobile. Task: I had to deliver the design while keeping it usable on small screens. Action: I built a quick prototype on a real phone, showed that text became unreadable, and proposed a swipeable card version that kept the same visual style. Result: the designer agreed, we updated the Figma file together, and mobile conversions on that page improved after launch.
Add loading='lazy' so the browser fetches them only when they come near the viewport:
<img src='gallery-1.jpg' alt='Campus' width='600' height='400' loading='lazy'>
<iframe src='https://www.youtube.com/embed/xyz' loading='lazy' title='Demo video'></iframe>
Do not lazy load the main hero or above-the-fold image, because that delays Largest Contentful Paint. For the hero use fetchpriority='high' instead, and always set width and height to avoid layout shift.
Tips to crack the Freshworks Web Development interview
Use Freshdesk or Freshservice free trials to understand ticketing, SLAs and automation workflows.
Practise DSA and Ruby, Java or Python fundamentals, depending on the team's tech stack.
Read about Freshworks' journey from Chennai to a US-listed SaaS company and its focus on mid-market customers.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Freshworks interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Freshworks Web Development interview?
Candidates usually go through 5 stages: Online coding assessment; Technical round 1 (DSA); Technical round 2 (design or domain); Hiring manager round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Freshworks Web Development interview?
This practice set leans on DOM and Browser Events (6), Web Security (5), Hosting and Deployment (4), MySQL Database (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Freshworks interviewers ask you to walk through real work.
Are these the exact questions asked at Freshworks?
No. These are curated practice questions that match the skills and difficulty usually tested in product interviews like Freshworks's. They are not a leaked or verified list of past questions.
Where does Freshworks hire Web Development professionals in India?
Freshworks has large teams in Chennai, Bengaluru, Hyderabad. Openings and locations change often, so check the Freshworks careers page and filter by city and experience.