Support Two-Factor 0.16

[oBusk]

Two-Factor 0.16 added a site-wide provider selection page (Settings → Two-Factor, #764) backed by the two_factor_enabled_providers option. It enforces that selection through two filters:

• two_factor_providers — removes deselected providers from Two_Factor_Core::get_providers() entirely.
• two_factor_enabled_providers_for_user at priority 10, registered on init — intersects the user's enabled providers with the selection.

This plugin registers its filter at mu-plugin load, so it ran before core's at the same priority and the appended Two_Factor_Email key was intersected straight back out. And with Email deselected the class is not registered at all, so the appended key resolves to nothing downstream. Either way the user logs in with no second factor, with no error.

Changes

• Re-register Two_Factor_Email on two_factor_providers at PHP_INT_MAX so the fallback always resolves to a live provider.
• Move the fallback filter to PHP_INT_MAX so it runs after core's site-wide enforcement filter.
• README: require Two-Factor 0.16+ (^0.16, not ^0.9 — caret on 0.x resolves >=0.9 <0.10 and would never install 0.16).
• README: state plainly that installing this force-enables email 2FA site-wide, and why that trade-off is accepted.
• README: drop the removed FIDO U2F references (#439), and correct the application password caveat — since 0.14 application password logins over REST and XML-RPC are permitted by default for 2FA users.

Notes

composer.json still only requires php. The Two-Factor plugin is not declared as a dependency because it is installed from a third-party package repository that the consuming project has to configure itself; the requirement stays documented in the README install snippet.

🤖 Generated with Claude Code

https://claude.ai/code/session_01STLtCzgtqWf58hHC4vrJ5G