If you maintain a Web site in which users can sign up and protect their account with a password, then you should edict a policy of minimal password length -- and, please, nothing else. Stricter rules, more often than not, backfire. For proper security, you need to enlist user cooperation, which will exist only on a voluntary basis. The more you enforce, the less users will be willing to help. Making users Angry is already a quite dumb move when users are customers (you don't want to repel customers, do you ?), but for security it is deadly.
A salient point is that the password is not meant to protect you, but the user himself. Be sure to make it known to the user. Education is the key, not coercion.
Besides policies, you can provide some useful tools, e.g. an automatic password generator -- nothing too drastic, say 8 characters (I am quite fond of passwords consisting of two letters, then two digits, then two letters, then two digits: such passwords, like 'ke89fz44', are not too hard to memorize, and still offer a non-ridiculous amount of entropy, a bit above 32 bits, which is more than can be hoped for when users choose "randomly" in their head).