Common use cases

Someone keeps trying to log in to your admin

Lower Max Login Attempts (for example 5) and raise Lockout Duration (for example 30 minutes). Turn on two-factor sign-in for staff with the Two-Factor Authentication module, which stops a guessed password from being enough.

A customer says "too many attempts"

They typed the wrong password too many times. They can wait for the lockout to end, or use Forgot password to set a new one. There is no "unlock" button.

You want to stop a spam IP

Add it under Blocked IPs with a reason and, ideally, an expiry. That address can no longer use your store (see IP block list for when this can catch real shoppers).