The only thing you must do IMO is detect and resolve any possibly security issues or SQL injections. Everything else doesn’t need to be touched until it becomes

The only thing you must do IMO is detect and resolve any possibly security issues or SQL injections. Everything else doesn’t need to be touched until it becomes incompatible with business needs.