I am improving the security on my php website. I am not using any frameworks or cms. The credentials are currently stored in plain text in the relevant php files. While researching, I came across this question Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?
The first answer by Schwern makes the argument that .ENV variables are fine and
".ENV is a convenience and, ideally, is not used in production"
I do not have the reputation to comment so can anyone explain what should "ideally" be used in production?