Skip to content

Require Email 2FA 1.6.1

Choose a tag to compare

View all tags
@dknauss dknauss released this 30 Jun 03:10
· 54 commits to main since this release
v1.6.1
23e98c1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First GitHub release of Require Email 2FA.

Highlights

  • Requires the WordPress.org Two Factor plugin and enforces the Email provider as a universal 2FA floor.
  • Preserves stronger user-configured factors such as TOTP, WebAuthn/passkeys, and backup codes.
  • Restricts XML-RPC/REST API logins to explicit service-account allowlists, and only with Application Password authentication.
  • Supports single-site activation, multisite network activation, per-site multisite activation, and optional mu-loader force-loading.
  • Includes an emergency FORCE_2FA_DISABLE kill switch for broken-mail recovery.
  • Adds rollout guidance, known limitations, filter-based configuration examples, contribution/security/support docs, issue/PR templates, Dependabot, CI, PHPCS/PHPCompatibility, PHPUnit tests, and WordPress Playground integration.
  • Playground demo now starts at the normal username/password screen (admin / password) and then shows the generated email 2FA code on the challenge screen via a demo-only helper, so the browser-only demo does not lock out users without a real mailbox.

Requirements

  • WordPress 6.5+
  • PHP 7.2+
  • Two Factor plugin (two-factor)
  • Working outbound email for users relying on email 2FA

Validation

  • PHP syntax checks passed.
  • composer check passed.
  • PHPUnit: 34 tests, 38 assertions.
  • Playground blueprint regenerated and verified against source.
  • WordPress Playground CLI blueprint smoke test passed with PHP 8.3 and multisite-safe site URL.
  • Pull request CI passed for the Playground login-flow fix before merging.
Assets 3
Loading