But as Ian H has said, this isn't a complete security product. It won't lock down your server. It simply protects web pages using Session based authentication.
Whilst WA could provide a roadmap article about securing a web site, they are not obliged to. There a plenty of resources out there that discuss this sort of thing.