Q: Where does the captcha show up?
Register, login, lost password, contact form, and new thread. Anywhere XenForo normally shows a captcha.
Q: How do I make it harder or easier?
ACP > Options > CAPTCHA. Pick length (3 to 8), character set (mixed, letters, numbers, math), and toggle noise, lines, distortion.
Q: Can I force captcha on every login?
Yes. Tick "Force CAPTCHA on every login" in the same settings panel. By default XenForo only shows it after failed attempts.