Must be OUTSIDE public_html. All user data is encrypted with this key – download a backup after install. If it is lost, the data cannot be recovered.