I don’t want to make a sales pitch but at the moment an attack is taking place, it’s going to be very hard to stop it. Your web server might not have the capacity (depending if it’s a small attack from a neighbor kid using a booter or a large attack like we saw on Dyn or using Mirai botnet). You should plan in advance, see if you or your ISP have a mitigation provider with always-on or automatic detection, or a 24/7 NOC.As the boy scouts say, the best way to deal with a DDoS attack is to prepare for one before it happens.