I keep going back and forth on this. Plugin-based snippet managers are convenient: no deploy, no SSH, client can toggle a snippet off in two clicks.

But it's still PHP eval'd through a settings screen, one more thing that can silently drift between environments, and one more plugin in the security surface.

The alternative is a plain mu-plugin file. Version controlled, reviewable in a PR, no runtime magic.

But now the client can't touch it without a deploy, and on shared/managed hosting that often means you can't touch it either.

Curious what people who have a lot of client sites actually do here. Snippet plugin, mu-plugin, something else entirely?

I keep going back and forth on this. Plugin-based snippet managers are convenient: no deploy, no SSH, client can toggle a snippet off in two clicks.

But it's still PHP eval'd through a settings screen, one more thing that can silently drift between environments, and one more plugin in the security surface.

The alternative is a plain mu-plugin file. Version controlled, reviewable in a PR, no runtime magic.

But now the client can't touch it without a deploy, and on shared/managed hosting that often means you can't touch it either.

Curious what people who have a lot of client sites actually do here. Snippet plugin, mu-plugin, something else entirely?

I share with you my experience with the review process of a Wordpress plugin
A first no isn't necessary the end of the story

Wordpress.org review team is doing a great job and was super kind and helpful with me

Hope it can help some of you 😄