Zoho Web Development Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Zoho hiring for Web Development roles
Zoho is an Indian software company offering a suite of business applications including Zoho CRM, Zoho Books, Zoho Mail and Zoho Creator. It is privately held and builds most of its technology in-house. It hires for software developers, QA engineers and technical support roles, with a selection process known for programming-heavy rounds.
For Web Development roles, this Zoho practice set focuses most on PHP Programming (7), MySQL Database (4), Web Security (4), CSS Layout and Responsive Design (4). It has 2 easy, 15 medium, 13 hard questions, so you can start easy and work up to the harder ones.
Company type
Product
Headquarters
Chennai, India
Main India offices
Chennai, Tenkasi
Zoho Web Development interview process
Written test (aptitude + C programming output)
Basic programming round
Advanced programming round
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for ZohoStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What are data-* attributes and when do you use them?
Custom data attributes such as data-product-id or data-price let you store extra information on an element without misusing class or id. JavaScript reads them through element.dataset, for example button.dataset.productId, and CSS can target them with attribute selectors. They are ideal for passing small values from server-rendered HTML to scripts, but sensitive data should never be stored there because anyone can read the page source.
INNER JOIN returns only rows with matching values in both tables, such as students who have enrolled. LEFT JOIN returns all rows from the left table and matching rows from the right, filling NULL where there is no match, which is useful to find students with no enrollment. RIGHT JOIN is the mirror of LEFT JOIN. MySQL has no FULL OUTER JOIN, but you can simulate it with a UNION of LEFT and RIGHT joins.
Both support prepared statements and are secure when used correctly. PDO supports around a dozen databases with the same API, has named placeholders like :email, and throws exceptions cleanly, so switching from MySQL to PostgreSQL is easier. mysqli works only with MySQL but exposes some MySQL-specific features. Most modern codebases and frameworks like Laravel use PDO under the hood, so it is the usual recommendation.
04
An accessibility audit gives your site a low score. What would you fix first?
I would start with issues that block users completely: missing alt text on meaningful images, form inputs without labels, poor colour contrast, and controls that cannot be reached by keyboard. Then I would fix heading order, add a skip link, use semantic landmarks and make focus outlines visible. I would test with Lighthouse or axe, then manually with Tab key navigation and a screen reader like NVDA.
Cross-site request forgery tricks a logged-in user's browser into sending an unwanted request, such as changing their email, because cookies are attached automatically. Prevention includes a unique CSRF token in every state-changing form that the server verifies, SameSite=Lax or Strict cookies, and checking the Origin header. GET requests should never change data. Frameworks like Laravel add CSRF tokens to forms by default.
06
Find the top 3 highest-paid employees in each department.
Use a window function in MySQL 8:
WITH ranked AS (
SELECT name, department_id, salary,
DENSE_RANK() OVER (PARTITION BY department_id ORDER BY salary DESC) AS rnk
FROM employees
)
SELECT name, department_id, salary
FROM ranked
WHERE rnk <= 3;
PARTITION BY restarts ranking per department. DENSE_RANK keeps ties together, while ROW_NUMBER would return exactly three rows even if salaries tie.
07
The database server is overloaded by read traffic. What architecture changes would you suggest?
I would first add caching for frequent reads with Redis or application-level caching. Then I would set up one or more read replicas and route SELECT queries to them while writes go to the primary, keeping replication lag in mind for read-after-write cases. Optimising slow queries and indexes often gives the cheapest wins. Managed services like Amazon RDS make adding replicas straightforward.
08
Describe a bug you found in production and how you handled it.
Situation: after a release, users reported the checkout button did nothing on some phones. Task: I had to find and fix it quickly. Action: I reproduced it on an older Safari, found that a new array method was unsupported, rolled back the change, then added a polyfill and Babel targets for those browsers. Result: the fix shipped the same day, and we added real-device checks to our release checklist.
09
A client's WordPress site has been hacked and shows spam links. What steps do you take?
I would take a full backup for evidence, put the site in maintenance mode and change all passwords, including hosting, database, FTP and admin users. Then I would compare core files with fresh copies, scan themes, plugins and uploads for injected PHP, remove unknown admin users and check the database for spam content. After cleaning I would update everything, remove unused plugins, add a firewall and request a Google review.
I chose PHP because it powers a large share of websites, including WordPress, and many Indian agencies and product companies still hire PHP and Laravel developers. It is quick to deploy on almost any hosting. I started with plain PHP to understand requests, sessions and databases, then learned Laravel. In my project, a course enquiry portal, Laravel's validation and Eloquent let me deliver features in half the time.
11
Compare BEM and utility-first approaches to CSS architecture.
BEM names classes as block__element--modifier, such as card__title--large, which keeps styles scoped and readable in large codebases. Utility-first frameworks like Tailwind CSS compose small single-purpose classes in the markup, which speeds up development and avoids growing stylesheets. BEM gives cleaner HTML, utilities give consistency and smaller final CSS after purging. The right choice depends on team size, design system and tooling.
12
Lighthouse shows a poor Largest Contentful Paint caused by the hero image. What steps do you take?
First I would compress the image and serve it in AVIF or WebP at the correct size using srcset. I would remove loading='lazy' from it, add fetchpriority='high' and a preload link in the head, and make sure it is in the initial HTML rather than injected by JavaScript. I would also serve it from a CDN and check that render-blocking CSS is not delaying the paint.
clamp(min, preferred, max) scales text smoothly between limits:
h1 {
font-size: clamp(1.75rem, 1rem + 3vw, 3.5rem);
}
p {
font-size: clamp(1rem, 0.95rem + 0.25vw, 1.125rem);
}
The heading never goes below 28 pixels on phones or above 56 pixels on large screens. Mixing rem with vw in the middle value keeps text zoomable for accessibility, unlike pure vw values.
14
The page stutters while scrolling because of a scroll event handler. How do you fix it?
Scroll events fire many times per second, so heavy work in the handler blocks the main thread. I would throttle the handler or batch DOM writes inside requestAnimationFrame, mark listeners as { passive: true }, and avoid reading layout properties like offsetTop after writing styles. For tasks like lazy loading, sticky effects or reveal animations, I would replace the handler with IntersectionObserver or CSS position: sticky.
Generate a token per session and compare it safely:
session_start();
if (empty($_SESSION['csrf'])) {
$_SESSION['csrf'] = bin2hex(random_bytes(32));
}
// in the form
echo "<input type='hidden' name='csrf' value='" . $_SESSION['csrf'] . "'>";
// on submit
if (!hash_equals($_SESSION['csrf'], $_POST['csrf'] ?? '')) {
http_response_code(403);
exit('Invalid request');
}
hash_equals compares in constant time, which avoids timing attacks.
16
Users get logged out immediately after login when redirected. What could be wrong?
Likely causes are session_start() missing on the next page, output sent before session_start so headers fail, or the session cookie being dropped. Cookie issues include a Secure flag on an HTTP site, a domain mismatch between www and non-www, or SameSite settings during cross-site redirects. I would check the Set-Cookie header in DevTools, verify session.save_path is writable, and redirect to a single canonical domain.
17
How would you deploy updates without any downtime?
I would use atomic releases: upload the new version into a fresh release folder, install dependencies and build assets there, then switch a current symlink in one step and reload PHP-FPM. Database migrations must be backward compatible, such as adding columns before code uses them, so old and new code both work during the switch. With multiple servers, rolling or blue-green deployment behind a load balancer achieves the same.
18
Rendering a table with 5,000 rows freezes the browser. What are your options?
Creating thousands of nodes at once blocks the main thread. Options are server-side pagination, rendering in chunks with requestAnimationFrame, or virtual scrolling where only the 30 to 50 visible rows exist in the DOM at any time. I would also build rows in a DocumentFragment, avoid layout reads inside loops, and use CSS content-visibility: auto so off-screen rows skip rendering work.
19
You must upgrade an old project from PHP 7.4 to PHP 8.3. How do you plan it?
I would first set up a staging copy and run a static analyser like PHPStan or Rector with PHP 8 rules to list incompatible code, such as removed functions, changed string comparisons and stricter type errors. Then I would update Composer dependencies to versions supporting PHP 8.3, fix deprecations, run the test suite and manual checks, and deploy with a rollback plan. PHP 7.4 has been unsupported since 2022.
20
The site's main CSS file is 400 KB and first paint is slow. How do you optimise it?
I would run the Coverage tab in DevTools to measure unused CSS, then remove dead rules with a tool like PurgeCSS. I would extract critical above-the-fold CSS and inline it, loading the rest asynchronously. Splitting styles per page or route, minifying, enabling Brotli compression and caching with long expiry headers also help. Finally I would replace heavy frameworks where only a few components are used.
21
Tell me about a time you had to work with messy legacy code.
Situation: I joined a project with a 10-year-old PHP codebase full of mixed HTML and SQL. Task: I needed to add online payments without breaking existing features. Action: I wrote tests around the checkout flow first, extracted database code into a small class using PDO, and added the payment module separately. Result: payments launched with no regressions, and the team adopted the same approach for later changes.
22
Pagination becomes very slow on later pages. Why, and how do you fix it?
LIMIT 20 OFFSET 100000 forces MySQL to read and discard 100,000 rows before returning 20, so deep pages get slower. Keyset or cursor pagination fixes this: remember the last seen id and query WHERE id < :last_id ORDER BY id DESC LIMIT 20, which uses the index directly. It suits infinite scroll and APIs. For numbered pages, limiting maximum depth or caching counts also helps.
23
What is the difference between px, em and rem units?
px is a fixed unit. em is relative to the font size of the current element, so nested em values compound and can grow unexpectedly. rem is relative to the root html font size, usually 16 pixels, so 1.5rem is always 24 pixels unless the user changes browser settings. Using rem for font sizes and spacing respects user preferences and keeps scaling consistent across the site.
24
Limit failed login attempts to stop brute-force attacks.
Track failures per account and IP, then block temporarily:
$stmt = $pdo->prepare('SELECT COUNT(*) FROM login_attempts
WHERE ip = ? AND attempted_at > NOW() - INTERVAL 15 MINUTE');
$stmt->execute([$_SERVER['REMOTE_ADDR']]);
if ($stmt->fetchColumn() >= 5) {
http_response_code(429);
exit('Too many attempts. Try again in 15 minutes.');
}
// on failure
$pdo->prepare('INSERT INTO login_attempts (ip, attempted_at) VALUES (?, NOW())')
->execute([$_SERVER['REMOTE_ADDR']]);
Add CAPTCHA after a few failures and offer two-factor authentication.
Edit the crontab with crontab -e and add:
30 2 * * * mysqldump --single-transaction -u backup school | gzip > /backups/school_$(date +\%F).sql.gz
0 3 * * * find /backups -name '*.sql.gz' -mtime +14 -delete
The first line runs at 2:30 AM daily; the second removes backups older than 14 days. Keep credentials in ~/.my.cnf with restricted permissions instead of the command, escape % in crontab, and copy backups to off-server storage.
this depends on how a function is called, not where it is written. In a method call like user.greet(), this is user. In a plain function call it is undefined in strict mode. With new it is the new object, and call, apply or bind set it explicitly. Arrow functions do not have their own this; they take it from the surrounding scope, which is why they are handy inside callbacks.
27
Implement infinite scroll using IntersectionObserver.
Observe a sentinel element at the bottom of the list:
const sentinel = document.querySelector('#sentinel');
let page = 1, loading = false;
const observer = new IntersectionObserver(async ([entry]) => {
if (!entry.isIntersecting || loading) return;
loading = true;
const res = await fetch('/api/posts?page=' + (++page));
const posts = await res.json();
if (!posts.length) observer.disconnect();
posts.forEach(renderPost);
loading = false;
}, { rootMargin: '200px' });
observer.observe(sentinel);
It is far cheaper than listening to every scroll event.
Check errors, size and real MIME type, then store with a random name:
if ($_FILES['photo']['error'] === UPLOAD_ERR_OK && $_FILES['photo']['size'] < 2_000_000) {
$mime = (new finfo(FILEINFO_MIME_TYPE))->file($_FILES['photo']['tmp_name']);
$allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'image/webp' => 'webp'];
if (isset($allowed[$mime])) {
$name = bin2hex(random_bytes(16)) . '.' . $allowed[$mime];
move_uploaded_file($_FILES['photo']['tmp_name'], __DIR__ . '/uploads/' . $name);
}
}
Never trust the original filename or extension.
I would load test with tools like k6 or JMeter to find the breaking point, then cache result pages aggressively using a CDN and Redis. The database should have proper indexes, and read-heavy queries could go to replicas. On cloud, I would configure auto-scaling and pre-warm extra instances before the announcement. A lightweight static fallback page and a queue for heavy tasks keep the site responsive under peak load.
Tips to crack the Zoho Web Development interview
Practise C programming output and pointer questions, which commonly appear in Zoho's written test.
Prepare for advanced programming rounds where you build a small application, such as a booking system, without external libraries.
Learn about Zoho's privacy-focused, in-house product approach and its rural offices in places like Tenkasi.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Zoho interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Zoho Web Development interview?
Candidates usually go through 5 stages: Written test (aptitude + C programming output); Basic programming round; Advanced programming round; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Zoho Web Development interview?
This practice set leans on PHP Programming (7), MySQL Database (4), Web Security (4), CSS Layout and Responsive Design (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Zoho interviewers ask you to walk through real work.
Are these the exact questions asked at Zoho?
No. These are curated practice questions that match the skills and difficulty usually tested in product interviews like Zoho's. They are not a leaked or verified list of past questions.
Where does Zoho hire Web Development professionals in India?
Zoho has large teams in Chennai, Tenkasi. Openings and locations change often, so check the Zoho careers page and filter by city and experience.