From the command line

wp login-security status                  # what is on, and what is happening
wp login-security unlock 203.0.113.10     # let one address back in
wp login-security unlock                  # let everybody back in
wp login-security trust 203.0.113.10      # never lock this address out
wp login-security door                    # print the sign-in address
wp login-security log --limit=50          # read the attempts
wp login-security two-factor list --missing   # staff with no second step
wp login-security two-factor import --from=wordfence --dry-run   # who would come across
wp login-security two-factor forget rosa  # rosa's remembered browsers ask for the code again
wp login-security weak                    # who signed in with a password the rules refuse

status and door are the two worth knowing before you need them: they work when the admin screens are the thing you cannot reach.

unlock <address> refuses anything that is not an IP address, and says so when the address was not locked out. It lets in every spelling of one IPv4 address: 203.0.113.7, and ::ffff:203.0.113.7 however it is written. Lockouts are kept under the plain address, and ones made before this plugin read the ::ffff: form plainly are kept under that form until they run out. Let in on a log row works the same way, so a row from before still lifts a lockout made since. unlock on its own says how many lockouts it lifted, except on a site with an object cache, where it cannot count them and says everybody can try again.

log --outcome takes refused, failed, locked, blocked, ok, reset (password reset requests, sent and refused; resets means the same) or signup (sign-ups turned away; signups means the same) and refuses any other word. refused is sign-ins only. --limit is exactly how many rows are printed.

weak prints the people on this site whose password the rules refused when they last signed in, with their roles, since when (in UTC) and the rule, as short, yours, common or pattern. --format takes table, csv, json or yaml. With Refuse passwords a machine would find off it says so and lists nobody.

two-factor list prints everybody who can change the site, and anybody else who has set up a second step, with their roles, whether it is set up, whether it is required of them and how many recovery codes they have left. --missing narrows it to the people who can change the site and have none, and on a site where nobody can change the site it says so. --format takes table, csv, json or yaml. two-factor off <user> switches one off, as above. two-factor forget <user> forgets every browser that person asked not to be asked on, on every site of a network, and leaves their second step on: for a laptop that has gone missing. two-factor import --from=wordfence (or two-factor) brings over the apps people set up with that plugin, one row a person saying what happened: brought, has_one_here or unreadable. With --dry-run it says would_bring and changes nothing.