I'm assuming the monero-wallet-rpc is on the same host as the website.
In init.php, define a username and password for the rpc wallet:
// RPC login credentials for monero-wallet-rpc. Use --rpc-login user:pass when starting the rpc wallet.
// Example: monero-wallet-rpc --rpc-login user:pass --wallet-file wallet.bin --rpc-bind-ip 127.0.0.1 --rpc-bind-port 18082
define('RPC_CRED','user:pass');`
Your username and password can be anything. In these examples they're user:pass but change them in your code.
I like to use tmux on my server. In one pane I'll run
./monerod --rpc-bind-ip 127.0.0.1 --rpc-bind-port 18081
...and in another tmux pane I'll run:
monero-wallet-rpc --rpc-login user:pass --wallet-file wallet.bin --rpc-bind-ip 127.0.0.1 --rpc-bind-port 18082
Another tmux pane runs cron.php with php ./cron.php
At this point your web pages should be interacting with the database, monerod, and monero-wallet-rpc.
As for security, that's the never-ending job. At a minimum, rename init.php, cron.php, and config.php. I've seen where people have tried to access those pages on my server, but I renamed those files with completely random names.
Also, in init.php where it has the line:
define('APP',true);
...change APP to something else...whatever you want. You'll need to do this on every page that references APP, which I believe is almost every page.
Make sure to block the wallet port (18082 unless you've changed it) on your firewall, log php error messages instead of displaying them, and keep your server patched.
