Require Email 2FA #8 in Security

Require Email 2FA This is a Multisite compatible, single-purpose, WordPress utility plugin with no admin user interface. It's intended to help site owners and maintainers rapidly roll out and enforce a mandatory two-factor authentication policy on WordPress sites or networks that may have many users — in the simplest and least disruptive way. Require Email 2FA imposes three requirements site- or network-wide: 1. The Two Factor plugin must be installed and activated. 2. All users must use Two Factor to log in. (Exceptions can be set with a constant or filter.) 3. Users who do not have a different method selected in their two-factor settings will receive time-based, one-time passcodes by email. The plugin also hardens the XML-RPC login path with a named allowlist of service accounts (added via a constant or filter). Note this allowlist governs XML-RPC, not REST — see Restricts XML-RPC logins below. (The same hardening will be applied to REST in a future version.) On multisite the plugin is network-only (Network Activate; per-site activation is blocked), and an optional mu-loader.php file can be moved to the /mu-plugins folder to make it un-deactivatable within the WordPress admi