You can immediately pull it offline by renaming the directory from example.com to example.old
You can also put it into maintenance mode by creating a blank .maintenance file in your Wordpress directory.
Attacks are a regular problem. I use Cloudflare and Wordfence to protect my site. Wordfence does a super job of protecting and hunting down backdoors and vulnerabilities.