Keeping settings out of your code.
THE PRINCIPLE
Code is the same in every environment. Configuration differs: database credentials, API keys, debug settings, the site URL.
Configuration belongs in a file or environment variables on each server, not in the repository.
IN PRACTICE
Laravel and many frameworks use a .env file. WordPress uses wp-config.php.
Exclude these from version control. Commit an example file showing the required keys with placeholder values, so a new environment can be set up.
WHERE TO PUT THEM
Outside the web root where the application allows it. A .env file inside public_html is reachable over HTTP if the server is misconfigured, which exposes your database credentials.
Set permissions to 600.
CHECKING THEY ARE NOT PUBLIC
Visit the path in a browser. If you see content rather than a Forbidden or Not Found, act immediately and treat the credentials as compromised.
WHAT TO DIFFER BETWEEN ENVIRONMENTS
Debug mode: on locally, off in production, always
Database credentials
Mail settings: a catcher locally, real sending in production
API keys: test keys in staging, live keys in production
