Obfuscating encryption_key

Forgot to turn on notifications and only just spotted these replies!

AWS key rotation is something I was considering. I need to put some thought into how I will re-encrypt everything in the database when the key changes if I did go down this path.

Also thanks dave friend for the links, a lot of food for thought in them.

I find encryption/security quite a tricky area to make good decisions on what is the most appropriate strategy for a particular site.

For the site in question, it is IP restricted, has 2FA implemented, MariaDB Data-at-rest encryption as well as the sensitive data encrypted in the database. Probably the weakest link now is if an attacker gained entry via cPanel.