You shouldn't use SHA: it's not designed for hashing passwords. Checkout bcrypt / scrypt and read: http://crackstation.net/hashing-security.htm
I've heard it referred to as a pepper (to go along with salt) and is in the application code.
bcrypt(password, salt, pepper) => hash. So even if they grab the db with the salt, the effective password to crack turns into 'password3jkl453jklgfuja9oph4mn" instead of just 'password'. Impossible.
And if they do get your site's code, you're back to a strong hashing algo and a salt.