The worst tech team you've ever seen and yet they are generating 20 million a year? I think you should give them the respect they deserve and understand the limitations they have been under.

My thoughts:

* Get the code in source control straight away

* Get the infrastructure stable and up to date if it's not

* Get CI pipelines set up. As part of this, make sure the code is running through a static analyser. This will give you a backlog of things to work on.

* Organize an external penetration test to be carried out

* Investigate updating and/or consolidating the software libraries used (Jquery etc)

* Choose a page/feature to update on its own. Bring it up to date.

At this point, you should be in a much better state and you will have learned a lot.