I keep going back and forth on this. Plugin-based snippet managers are convenient: no deploy, no SSH, client can toggle a snippet off in two clicks.

But it's still PHP eval'd through a settings screen, one more thing that can silently drift between environments, and one more plugin in the security surface.

The alternative is a plain mu-plugin file. Version controlled, reviewable in a PR, no runtime magic.

But now the client can't touch it without a deploy, and on shared/managed hosting that often means you can't touch it either.

Curious what people who have a lot of client sites actually do here. Snippet plugin, mu-plugin, something else entirely?