Uninstalling

Deactivating leaves everything alone: your settings, your log, your trusted list. Turn it back on and nothing has changed.

Delete the settings, the log and everyone's second step when the plugin is deleted in Settings decides what happens when the plugin is deleted. It is off, so an accidental delete-and-reinstall does not throw away a month of records. Switch it on before deleting if you want the tables and settings gone.

Read the label before you tick it. With it on, the uninstall also removes what each account keeps for the second step: the sealed authenticator secret and the ten recovery codes. That part cannot be undone and it is not per-site — the rows live in one table for the whole network, so on a network they go only when every site has ticked the box. Everyone who had a second step has to set one up again from scratch; their authenticator app and their printed recovery codes both stop working. Leaving the box off keeps them, and reinstalling picks up where it left off. The note that somebody's password was refused at sign-in goes on the same terms, and so do the remembered browsers that skip the code.

Every lockout is lifted on uninstall whatever the box says, so nobody is left standing outside by a plugin that is no longer there. The counts of new accounts per address go with them.