[wp-hackers] Why WP_SITEURL and not $_SERVER['HTTP_HOST']?

[Otto]

The RELOCATE define does much the same thing, no?

http://codex.wordpress.org/Changing_The_Site_URL#Relocate_method

Anyway, the reason for not leaving it on all the time: $_SERVER
variables are not particularly reliable. Nobody likes their site
breaking for no obvious reason, and relying on them tends to leave you
open to unusual hacking approaches (since the data in them can
sometimes be controlled by the client).

-Otto