A fresh install ships a 5-character password minimum, 12-hour sessions, and lockout off — the values that used to be compiled in, kept so an upgrade changes nothing behind your back. Two are worth deciding on your first day: enable lockout and raise the password minimum. The 5-character default exists for compatibility, not as a recommendation.
The lockout design repays reading before you enable it. A lock always expires — lockFor caps at 24 hours, because a permanent lock would let an unauthenticated attacker disable every administrator by guessing wrong on purpose. The check runs before the password is verified, so a correct password during a lock does not sign you in. Failures count against the username as typed, including names that do not exist — otherwise the 429 would answer "is this a real account?". And break-glass recovery stays outside the lock, so the last way in survives the attack.
Tightening the password rule never re-checks existing passwords — it applies at each identity's next change. There is no expiry and no reuse history: a field nothing enforced would be worse than its absence.
Now I can set a sign-in policy that locks attackers out, not administrators.