Activate it. That is genuinely the whole setup — the defaults are the ones a site can be left on, and the two settings that could cause trouble are off until you switch them on and read what they say.

What is on out of the box:

Setting	Default
Stop somebody after too many wrong passwords	On, five tries in fifteen minutes
Locked out for	Twenty minutes, longer each time after that
Also stop one username tried from many addresses	On, twenty tries
Limit password reset emails	On, three an hour for one account and five from one address
Screen new sign-ups for bots	On, three new accounts an hour from one address (a site that already had the plugin is asked on the Dashboard instead)
Refuse usernames nobody here has	On
Stop usernames being looked up	On
XML-RPC	Block the bulk guessing, leave the rest
Email me when somebody is locked out	On, at most one a day
Keep the log for	Thirty days
Move the sign-in page	Off

Give it a week and then look at the first screen. On most sites the machines find a new site within a few days, and the numbers there will tell you what is actually happening to you rather than what happens in general.

Getting started