What it does not do

Said plainly, because a security plugin that is vague about its limits is worse than none:

• it does not make a weak password strong on its own. It can refuse a new one, and judge an existing one when its owner next signs in (see Refusing a weak password above), but it cannot read a password nobody is typing;
• on its own it does not stop somebody who already has the password, from a reused password or a phished one — that is what A second step at sign-in above is for, and it is the reason to switch it on;
• it does not protect anything other than the sign-in. It is not a firewall, not a malware scanner, and it does not read your files;
• moving the sign-in page is not a lock, as above.

Two long passwords and two-factor sign-in on the accounts that matter are worth more than any of this. What this does is stop the thousands of automated attempts that arrive anyway, and tell you when they are happening.