A must-use plugin loads before everything and cannot be disabled

Code that must run regardless of what an administrator does in the plugins screen — a security header, a filter that fixes a broken upstream URL, an environment guard — belongs in mu-plugins rather than in a regular plugin.

// wp-content/mu-plugins/shop-guards.php
// no activation, no deactivation, loads before regular plugins

add_filter( 'wp_mail', function ( $args ) {
    if ( wp_get_environment_type() !== 'production' ) {
        $args['to'] = '[email protected]';
    }
    return $args;
} );

WordPress only autoloads files at the top level of the directory, so anything with a folder structure needs a loader file beside it. The trade is real: nobody can turn it off, including when it is the thing that is broken, so it suits infrastructure concerns and not features.