When I was in college, one of my business instructors told us students that one of the biggest barriers to making money was procrastination.
Install the fix malware problem Firewall Plugin. This plugin investigates requests with heuristics that are straightforward to identify and stop obvious attacks.
Everything you have worked for will go with it should the server of your site return. You will make no sales, get no traffic or signups to your website, until you have the site back up again and in short, you're out of business.
One step you can take is to delete the default administrator account. This is critical because if you do not do it, malicious user read here know a user name that they could try to crack.
Install the WordPress Firewall Plugin. This plugin investigates web requests to identify and stop attacks that are obvious.
Do your homework and some hunting, but if you are pressed this post for time and need to get this done once and for all, try the WordPress safety plugin that I use. It's a relief to know that my website (and business!) are secure.