Welcome to the Q&A Forum

I have a client site that seems to have been penalized with a huge drop in rankings site wide for all keywords. I would like to hire an expert that could figure out what the issue may be.
HOWEVER, I've done all the standard audit items, including submitting a huge disavow file. Nothing is reported in GSC and the site is built out in pure HTML, so not a WordPress issue.  I don't need a basic audit, I need someone with expertise in finding a possible penalty.

Looking for expert help (willing to pay) to set up a proper htaccess file. I'm having an issue as the site has a subdomain at secure.domain.com  and has  php extensions there. I tried a couple recommended code sets but it seems to be a mess. The site is working properly but this may be causing rankings issues. It's coded in pure HTML and PHP, no Wordpress stuff.
The delete www causes the secure side to fail. The delete html extensions causes the php extensions to fail.

I also notice that not all my back-links show in the MOZ reporting.  Many do, but not all. I'd like to know all of them so I can put any spamy ones in my disavow file.