It depends on the severity of the attack. If your website is distributing malware, displaying phishing content, or putting visitors at risk, temporarily disabling public access may be the safest option. In less severe situations, it may be possible to clean the website while keeping disruption to a minimum.
