I'm assuming the
monero-wallet-rpc is on the same host as the website.
init.php, define a username and password for the rpc wallet:
// RPC login credentials for monero-wallet-rpc. Use --rpc-login user:pass when starting the rpc wallet.
// Example: monero-wallet-rpc --rpc-login user:pass --wallet-file wallet.bin --rpc-bind-ip 127.0.0.1 --rpc-bind-port 18082
Your username and password can be anything. In these examples they're
user:pass but change them in your code.
I like to use tmux on my server. In one pane I'll run
./monerod --rpc-bind-ip 127.0.0.1 --rpc-bind-port 18081
...and in another tmux pane I'll run:
monero-wallet-rpc --rpc-login user:pass --wallet-file wallet.bin --rpc-bind-ip 127.0.0.1 --rpc-bind-port 18082
Another tmux pane runs
At this point your web pages should be interacting with the database,
As for security, that's the never-ending job. At a minimum, rename
config.php. I've seen where people have tried to access those pages on my server, but I renamed those files with completely random names.
init.php where it has the line:
APP to something else...whatever you want. You'll need to do this on every page that references
APP, which I believe is almost every page.
Make sure to block the wallet port (18082 unless you've changed it) on your firewall, log php error messages instead of displaying them, and keep your server patched.