Admin walkthrough — set the login lockout

1. Go to Settings → Modules.
2. Find Security and click Configure.
3. Enter Max Login Attempts (for example 5).
4. Enter Lockout Duration (minutes) (for example 15).
5. Ignore Enable 2FA; it has no effect. Use the Two-Factor Authentication module instead.
6. Click Save. The new numbers apply to the next sign-in attempt.

Leaving a box empty or at 0 uses the default (10 attempts, 1 minute).