Not addressing the larger questions but first obvious thing (to me) is to get this into git/version-control asap and put in place a method of deployment so no one touches production.