Back
Keentune
Web Development curriculum 21 chapters
·
133 concepts
·
free
Everything the adaptive question bank can teach and test in Web Development, from foundations through advanced practice. Work through it in order, or start practising and let the questions find your level.
Start practising Web Development
New here? Read the Web Development guide
A free 16-minute primer — the mental model, the mistakes beginners make, and what to practise first.
A. URLs, origins and what "same site" means
•
scheme, host, port, path, query and fragment, in that order
•
the #hash is never sent to the server
•
an origin is scheme + host + port, so a different port is a different origin
•
a "site" is the registrable domain, so sibling subdomains share a site but not an origin
•
reserved characters must be escaped, and encodeURIComponent escapes more than encodeURI
B. HTTP from the client: methods and the message model
•
a start line, headers, a blank line, then an optional body
•
GET and HEAD must not change state, which is why they are prefetchable
•
PUT and DELETE repeat harmlessly; POST does not, hence duplicate submissions
•
the server remembers nothing between requests; cookies and tokens re-supply the context
•
HTTP/1.1 head-of-line blocking, HTTP/2 multiplexing, HTTP/3 over QUIC
C. Status codes and redirects
•
1xx informational, 2xx success, 3xx redirect, 4xx client fault, 5xx server fault
•
permanence, cacheability, and whether the original method survives
•
post/redirect/get, so a refresh cannot resubmit the form
•
a conditional request answered with headers and no body
•
missing or bad credentials versus a valid identity that is not allowed
•
missing, deliberately gone, and the error page that wrongly returns 200
D. Headers, caching and content negotiation
•
the declared type beats the file extension, and X-Content-Type-Options: nosniff stops guessing
•
the client proposes, the server picks, and Vary records which header decided
•
a cache that ignores Vary serves one client's variant to another
•
Cache-Control: max-age counts seconds from the response, and supersedes Expires
•
never write it down versus store it but revalidate every time
•
an opaque validator plus If-None-Match is what produces a 304
E. Cookies and their attributes
•
one cookie per Set-Cookie header, echoed back on every matching request
•
omitting Domain locks the cookie to the exact host; setting it widens to subdomains
•
with neither it is a session cookie, and Max-Age wins where both appear
•
hides the cookie from document.cookie so injected script cannot read it
•
sent only over HTTPS, and it says nothing about who set it
•
Lax , Strict and None , and that None is rejected without Secure
•
cookie scope is host plus path, which is coarser than an origin
F. Same-origin policy, CORS and cross-origin access
•
the browser blocks *reading* a cross-origin response, not usually sending the request
•
images, scripts, stylesheets and form posts cross origins by design, which is why CSRF exists
•
the method and header set that avoid a preflight entirely
•
an OPTIONS probe carrying Access-Control-Request-Method and -Headers
•
Access-Control-Allow-Origin: * cannot be combined with credentials
•
the client must request them and the server must allow them
•
curl and servers ignore it entirely; it protects the user's browser, not the API
G. The document: metadata, head and SEO-relevant markup
•
a missing doctype drops the page into quirks mode and changes box sizing
•
the meta charset has to appear within the first 1024 bytes
•
without it a mobile browser lays out near 980px and scales the result down
•
exactly one per document; it is the tab, the bookmark and the search result line
•
nominates one URL among near-duplicates as the indexable one
•
robots.txt blocks crawling, noindex blocks indexing, and blocking the crawl hides the noindex
•
JSON-LD for search results, Open Graph for share previews, both read from markup
H. HTML semantics and content structure
•
the element you choose is the default accessibility role and keyboard behavior
•
heading level expresses outline depth, never font size
•
article stands alone, section groups, nav navigates, aside is tangential
•
em and strong carry meaning; i and b are presentational
•
th , scope and caption make a data table readable; layout tables destroy reading order
•
details , dialog and progress ship behavior you would otherwise script badly
I. Forms and constraint validation
•
file uploads require multipart/form-data , not the default urlencoded body
•
a control with no name is never submitted, whatever its value
•
for /id or wrapping; the label also becomes part of the click target
•
email , tel , number and date change the keyboard, the parsing and the validity rules
•
the browser's built-in check, and that :invalid matches before the user has typed
•
novalidate and devtools defeat it, so the server must revalidate
•
a shared name forms a radio group, and unchecked boxes submit nothing at all
•
a disabled control is skipped on submit; a readonly one is still sent
J. The DOM tree and manipulating it
•
the tree is built from the markup and then diverges from it
•
text nodes and comments are nodes, so childNodes is not children
•
a static NodeList versus a live HTMLCollection
•
a live collection mutates underneath a loop that is changing the tree
•
one parses markup and can inject; the other inserts literal text
•
appending an already-attached node relocates it rather than copying it
•
value and defaultValue stop tracking each other after the first user edit
K. The event model: phases, delegation and custom events
•
capture down to the target, then bubble back up
•
where the event originated versus where the listener is attached
•
halting travel is not the same as cancelling the default action
•
one ancestor listener plus closest() handles elements that do not exist yet
•
focus , blur and element scroll do not bubble; focusin and focusout do
•
an inline arrow function can never be removed, but once and AbortSignal handle it
•
CustomEvent carries detail , and bubbles and composed are opt-in
L. Loading, rendering and the page lifecycle
•
a plain <script> stops HTML parsing at the point it appears
•
defer preserves order and waits for parsing; async runs the instant it downloads
•
the tree is parsed versus every subresource has finished
•
style, layout, paint, composite, once per frame
•
reading a geometry property after writing one forces a synchronous layout
•
schedule visual work before the next paint instead of on a timer
•
a restored page never re-runs load, and an unload listener disqualifies it
M. Links, navigation and history
•
a link navigates and a button acts, and their keyboard contracts differ
•
rel="noopener" cuts the new tab's handle on the opener window
•
how much of the current URL the next site is told, and the modern default
•
adding a history entry versus rewriting the current one
•
calling pushState does not fire popstate ; the back button does
•
scroll restoration, focus, titles and back/forward are free only in a document navigation
N. Fetch and talking to a server from script
•
a 404 or 500 resolves, so you must test response.ok
•
the body is a stream, so clone() before you need it twice
•
cookies are omitted cross-origin unless credentials: 'include'
•
cors , no-cors and same-origin , and the unreadable opaque response no-cors hands back
•
cancelling an in-flight request, and handling the resulting AbortError
•
choosing how the HTTP cache is consulted and whether redirects are followed
•
it blocks the main thread and stores only strings
•
per-tab and cleared on close versus shared across tabs and persistent
•
other tabs of the origin are notified; the writing tab is not
•
asynchronous object stores with keys, indexes and transactions
•
a transaction ends when the event loop goes idle, so an awaited fetch inside it fails
•
cookies, Web Storage, IndexedDB and the Cache API differ on request cost, size, sync-ness and eviction
P. Service workers and PWA basics
•
a programmable proxy between page and network, not a background page
•
secure contexts only, and the script's path caps the scope it can control
•
precache on install, clean up on activate, intercept on fetch
•
the page that registers a worker is not controlled by it until a reload
•
cache-first, network-first and stale-while-revalidate, and what each gets wrong
•
the manifest fields and HTTPS an install prompt requires
Q. Web Components and the shadow DOM
•
the name must contain a hyphen and is registered globally, once
•
connected, disconnected, adopted, and attribute-changed for observed attributes only
•
outer CSS and querySelector cannot reach inside a shadow root
•
slotted nodes are still styled and queried from the outside
•
custom properties pierce the boundary; ::part and ::slotted are the exposed handles
•
an event must be composed to escape, and its target is rewritten to the host
R. Images, media and responsive markup
•
the intrinsic aspect ratio from the attributes is what prevents the shift
•
describe the content, or use alt="" for a genuinely decorative image
•
resolution switching, and that w descriptors are useless without sizes
•
different crops or formats chosen by the browser, with img as the fallback
•
loading="lazy" helps offscreen images and hurts the hero image
•
the browser blocks audible autoplay without user activation
S. Observers, workers and other platform APIs
•
visibility callbacks with a root and thresholds, instead of a scroll handler
•
element-level size changes, and the loop-limit error a resize-on-resize causes
•
batched DOM change records delivered asynchronously
•
a real second thread with no DOM, reached only through messages
•
full duplex, one-way server push, and repeated requests
•
after the upgrade there is no CORS, so the server must check Origin itself
•
pixels with no retained tree, so nothing in it is hit-testable or accessible
T. HTTPS, CSP and the browser's security surface
•
service workers, geolocation and clipboard simply do not exist over plain HTTP
•
an HTTP subresource inside an HTTPS page is upgraded or blocked
•
the browser enforces it as defense in depth, not as a fix for the bug
•
unsafe-inline defeats the policy; nonces and hashes do not
•
innerHTML , document.write , eval and javascript: URLs are where markup becomes code
•
least privilege for an embed, and that allow-scripts plus allow-same-origin undoes it
U. Devtools and reasoning about a live page
•
the panel reflects the current tree, which view-source never does
•
the computed value tells you which rule actually won
•
queueing, time to first byte and download blame different layers of the stack
•
disable cache and hard-reload, or you are measuring a warm one
•
a logged object is expanded later, so the console shows its mutated state
•
the only way to inspect a redirect chain or a form POST
Keentune is not affiliated with or endorsed by the organizations whose documentation informs these maps.
Start practising Web Development
All about Web Development practice
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.
© 2026 SportaApp LLC