“allowlist”

Make two-factor mandatory for all WordPress users (emailed-code floor, per-role exclusions) and lock the XML-RPC/REST API-login path to an allowlist. Optional must-use mode.

Enables optional WordPress features and Elementor widgets through positive allowlists.

Detect major page builders, show install/active state, and remove orphaned postmeta or allowlisted options only when each stack is inactive. Includes WP-CLI.