This depends on what is it that you are developing. If it is a plugin, you have to store such settings in options as the last thing site owner should be asked to do is to modify their config file.
If it is your own site, just make it a constant that is declared in your code if you do not want it to be configurable by the admin. There is no advantage in keeping it in some non obvious place which is harder to find when inspecting the code.
As for security, in theory having it in the code is more secure, as you do not have to worry about someone hacking into the DB, but in practice, since if someone can get into your DB you are already toast (he will add its own admin user…), it makes almost zero difference. (the only difference I can think of is getting a dump of the DB, but this kind of hack is still hard and probably super rare)
Related Posts:
- Is moving wp-config outside the web root really beneficial?
- Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
- Generate WordPress salt
- Garbage in beginning of wp-config.php – was this WP installation compromised?
- How do I authenticate WP users from a chrome extension?
- How does the “authentication unique keys and salts” feature work?
- Securing wp-config leads to sensitive information leak on wp-settings
- Is there any point setting the keys and salts in wp-config.php?
- What’s the point of forbidding access to wp-config.php?
- Config file with no Keys..?
- White screen of death on admin pages after moving wp-config up two levels for security
- Storing FTP details in wp-config.php
- My Site keeps crashing due to the wp-confg file being deleted
- Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
- How to change location of wp-config.php to folder or 2 folders up?
- Adding Security Keys?
- Remove hacked code – out of ideas! [closed]
- Secret keys in SCM
- wp-config.php moved above root results in no plugin updates
- wp-config.php file and code injection
- Malware/Permission bug removal?
- Default installation permissions for wp-config.php
- Move data from wp-config to another file
- What is an Endpoint?
- What is the difference between a cer, pvk, and pfx file?
- How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
- Is it possible to decrypt SHA1
- Error `sec_error_revoked_certificate` when viewed in Firefox only
- Convert .pfx to .cer
- Where to securely store API keys and passwords in WordPress?
- Why escape if the_content isnt?
- Full path disclosure on rss-functions.php
- What to use instead of wp_kses() in user output
- is_email() VS sanitize_email()
- Subscribe to email for security fixes?
- How to escape custom css?
- Understanding SVG vulnerabilities in WordPress related to a specific fix
- Moving wp-config.php: Can this be done after site launch?
- How to secure or disable the RSS feeds?
- Make password invalid once logged out of password-protected page
- How to get WordPress to save upload file beyond web root [closed]
- Is security a problem in WordPress?
- Moving wordpress out of the public directory
- Logout via Subdomain, non-wordpress page on a different server?
- Protecting HTML5 video [closed]
- How can I tell who changed the password?
- WordPress website Security [closed]
- Do I need to use the esc_html() function on hard coded links?
- Can’t reset WordPress password
- Is the “lost password” feature truly a vulnerability?
- Frontend Password change
- Is it possible to reduce the minimum character length for passwords?
- Handling email piping attachments and detecting unsupported file types
- Downloading File from Outside Web Root
- site get login attempts after htaccess ip restriction
- Is it good security advice to install wordpress in subdirectory but link to root?
- Why was my blog post inserted lot’s of ad links by others?
- Moving wp-config.php up 2 levels
- How Could I sanitize the receive data from this code
- WordPress SQL Injections through User Agent
- Should I Worry About SQL Injection When Using wp_insert_post?
- Is there a way for a user to have an alias?
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- What permissions should I give directories if I want to make WordPress more secure?
- How to protect wp-admin through .htaccess?
- Something is unescaping all html entities before output to browser [closed]
- Is wp_kses the right approach in sanitizing this string?
- 404 redirect wp-login and wp-admin after changing login url [closed]
- Renaming install.php for security?
- Limit Login Attempts BEFORE PHP is executed?
- Which Versions of WordPress Ship with the Patched TimThumb?
- Safe to say WordPress security releases don’t have database upgrades
- Use global variables or function that returns said variables for site-wide private-ish WP settings?
- How to add API security keys into JS of wordpress securely
- fail2ban to prevent Brute Force Attacks on WordPress?
- Use Google authentication for pages within a website [closed]
- How to give the same error message when the wrong password or wrong username is used?
- should I escape a literal url added in functions.php
- Google credentials and redirect URI for Google OAuth2 in a WordPress plugin, questions
- How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
- Secure Server after configuration
- Uploading attachment (pdf) and prevent download for anonymous user
- After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
- Specific Page/Post Need to Stay Non SSL
- Block JSON access over the net
- Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
- How do I make secure API calls from my WordPress plugin?
- Scan multiple websites for malware that are in same webhost root?
- The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
- How to check whether a site has been compromised without browsing into it?
- My site thinks it’s secure when it is fact not
- Is it possible to only have the admin interface bind to the local loopback?
- PHP Code Sniffer – WordPress VIP Coding Standards
- Trying to understand nature of hacking
- Correct setup to block file modifications from hackers
- Is my WP site being hacked?
- How do you search for backdoors from the previous IT person?
- Why is SSH password authentication a security risk?
- Is wp-cron.php vulnerable to external attacks and how to protect it?
- How to address security vulnerabilities: LUCKY13, BEAST, and BREACH