How to allow hidden custom fields to be added from wp-admin/post.php?

I know that using an underscore in front of a custom field name hides it from display on the front-end, e.g. _custom_field_name. In my experience, WordPress also prevents one from adding such a custom field on the front end.

Before I go spelunking around core, I wanted to ask: Is there an “easy” way to allow _custom_fields to be added from wp-admin/post.php?

The reason is this: we rely on hidden custom fields, but when troubleshooting production issues in prod it would be useful to be able to inject certain hidden post meta. I’m not a fan of touching the production database by hand.

I found the following filter, here unlocking all protected meta data:

add_filter( 'is_protected_meta', '__return_false' ); 

Or it can be fine tuned:

add_filter( 'is_protected_meta', function( $protected, $meta_key, $meta_type )
{
    $allowed = array( '_edit_lock', '_test', '_wp_page_template' );
    if( in_array( $meta_key, $allowed ) )
        return false;

    return $protected;
}, 10, 3 );

It allows to display the meta data as well as insert new ones (globally or fine-tuned).