“enforcement” 2

Make two-factor mandatory for all WordPress users (emailed-code floor, per-role exclusions) and lock the XML-RPC/REST API-login path to an allowlist. Optional must-use mode.

A multi-site aware, WordPress mu-plugin to enforce WordPress Two-Factor, a 2FA plugin, security for all user roles at the point of registration.