See #994

Security Fixes

• Ensure that regular passwords can't bypass the two-factor requirement for REST API and XML-RPC requests by @faisalahammad in #989. Thanks mqrble for responsibly reporting the issue.
• Add diagnostics for failed login nonce verification by @georgestephanis in #973. Thanks Ananda Dhakal (Patchstack) for responsibly reporting the issue.

New Features

• Add WP-CLI support with wp two-factor commands by @masteradhoc in #905 and docs in #998
• Respect intentional bypass via the two_factor_is_required_for_user filter by @masteradhoc in #882
• Add a two_factor_fallback_provider_for_user filter for when a user's stored providers are no longer registered by @masteradhoc in #882
• Add early notice for soon exhausting recovery codes by @masteradhoc in #907
• Add privacy policy content registration by @masteradhoc in #869

Bug Fixes

• Fail closed when CSPRNG is unavailable during nonce generation by @dknauss in #877
• Only clear the login nonce once it has expired by @georgestephanis in #980
• Fix unslashed REMOTE_ADDR warning in email provider by @masteradhoc in #975
• Fix TOTP verify button after resetting authenticator app by @lakrisgubben in #979
• Remove two_factor_enabled_providers option on uninstall by @faisalahammad in #903
• Fix misleading notice by @masteradhoc in #858
• Reword mixed-audience login failure notice to be informational by @dknauss in #922
• Rework fail-safe by @masteradhoc in #927
• Add coverage for provider-specific fallback notices by @dknauss in #923
• Fix HTML5 validation issues by @masteradhoc in #910
• Fix users list table fatals (wp_die) when a user's 2FA provider is deregistered by @masteradhoc in #933

Development Updates

• Prepare for the WordPress 7.0 release by @masteradhoc in #834
• Prepare for the WordPress 7.1 release by @masteradhoc in #900
• Sync login_header() and login_footer() with WP 7.1 by @masteradhoc in #963
• Update PHPStan to 2.x and exclude includes/ from analysis by @masteradhoc in #972
• Validate against PHPStan version 3, 4 and 5 by @masteradhoc in #948
• Update wp-coding-standards/wpcs to 3.4.1 by @obenland in #947
• Fix PHPCS and PHPStan issues across multiple files by @aslamdoctor in #818
• Remove ReflectionProperty::setAccessible() and ReflectionMethod::setAccessible() calls in the test suite by @masteradhoc in #942
• Fix Codecov badge by adding OIDC permission for tokenless upload by @nimesh-xecurify in #856
• Update GitHub Actions workflows by @johnbillion in #892
• Update Playground PR preview action to v4 by @obenland in #985
• Add FAQ entries for Multisite, locked-out users, and role enforcement by @masteradhoc in #881
• Update .md files with the latest two-factor changes and requirements by @masteradhoc in #929
• Update PR template by @masteradhoc in #870
• Unbreak CI: PHPStan false positive and matrix fail-fast by @georgestephanis in #974

Dependency Updates

• Bump the qrcode-generator runtime dependency by @kasparsd
• Bump qs and express by @dependabot[bot] in #895
• Bump adm-zip and @wordpress/scripts by @dependabot[bot] in #988

See #994

Security Fixes

• Ensure that regular passwords can't bypass the two-factor requirement for REST API and XML-RPC requests by @faisalahammad in #989. Thanks mqrble for responsibly reporting the issue.
• Add diagnostics for failed login nonce verification by @georgestephanis in #973. Thanks Ananda Dhakal (Patchstack) for responsibly reporting the issue.

New Features

• Add WP-CLI support with wp two-factor commands by @masteradhoc in #905
• Respect intentional bypass via the two_factor_is_required_for_user filter by @masteradhoc in #882
• Add a two_factor_fallback_provider_for_user filter for when a user's stored providers are no longer registered by @masteradhoc in #882
• Add early notice for soon exhausting recovery codes by @masteradhoc in #907
• Add privacy policy content registration by @masteradhoc in #869

Bug Fixes

• Fail closed when CSPRNG is unavailable during nonce generation by @dknauss in #877
• Only clear the login nonce once it has expired by @georgestephanis in #980
• Fix unslashed REMOTE_ADDR warning in email provider by @masteradhoc in #975
• Fix TOTP verify button after resetting authenticator app by @lakrisgubben in #979
• Remove two_factor_enabled_providers option on uninstall by @faisalahammad in #903
• Fix misleading notice by @masteradhoc in #858
• Reword mixed-audience login failure notice to be informational by @dknauss in #922
• Rework fail-safe by @masteradhoc in #927
• Add coverage for provider-specific fallback notices by @dknauss in #923
• Fix HTML5 validation issues by @masteradhoc in #910
• Fix users list table fatals (wp_die) when a user's 2FA provider is deregistered by @masteradhoc in #933

Development Updates

• Prepare for the WordPress 7.0 release by @masteradhoc in #834
• Prepare for the WordPress 7.1 release by @masteradhoc in #900
• Sync login_header() and login_footer() with WP 7.1 by @masteradhoc in #963
• Update PHPStan to 2.x and exclude includes/ from analysis by @masteradhoc in #972
• Validate against PHPStan version 3, 4 and 5 by @masteradhoc in #948
• Update wp-coding-standards/wpcs to 3.4.1 by @obenland in #947
• Fix PHPCS and PHPStan issues across multiple files by @aslamdoctor in #818
• Remove ReflectionProperty::setAccessible() and ReflectionMethod::setAccessible() calls in the test suite by @masteradhoc in #942
• Fix Codecov badge by adding OIDC permission for tokenless upload by @nimesh-xecurify in #856
• Update GitHub Actions workflows by @johnbillion in #892
• Update Playground PR preview action to v4 by @obenland in #985
• Add FAQ entries for Multisite, locked-out users, and role enforcement by @masteradhoc in #881
• Update .md files with the latest two-factor changes and requirements by @masteradhoc in #929
• Update PR template by @masteradhoc in #870
• Unbreak CI: PHPStan false positive and matrix fail-fast by @georgestephanis in #974

Dependency Updates

• Bump the qrcode-generator runtime dependency by @kasparsd
• Bump qs and express by @dependabot[bot] in #895
• Bump adm-zip and @wordpress/scripts by @dependabot[bot] in #988

What's Changed

Breaking Changes

• Remove legacy FIDO U2F provider support by #439 from @georgestephanis.

New Features

• Add a dedicated settings page for plugin configuration in wp-admin by #764 from @masteradhoc.
• Add a new support links filter so consumers can customize contextual recovery/help links by #615 from @StevenDufresne.
• Refresh backup codes UI styling and behavior by #804 from @masteradhoc.

Bug Fixes

• Delete stored TOTP secrets when the TOTP provider is disabled by #802 from @sjinks.
• Harden provider handling so login/settings checks do not fail open when expected providers disappear by #586 from @georgestephanis.
• Ensure only configured providers are saved and enabled in user settings by #798 from @kasparsd.
• Improve settings-page accessibility and fix profile settings link behavior by #828 and #830 from @masteradhoc.
• Resolve PHPCS violations in provider files by #851 from @masteradhoc.

Development Updates

• Move login styles and provider scripts from inline output to enqueued/external assets by #807 and #814 from @masteradhoc and @aslamdoctor.
• Improve inline docs and static-analysis compatibility (WPCS/phpstan) by #810, #815, and #817 from @masteradhoc and @aslamdoctor.
• Improve unit test reliability and integrate CI code coverage reporting by #825, #841, and #842 from @nimesh-xecurify.
• Update readme docs and modernize CI workflow infrastructure by #835, #837, #843, and #849, and #843 from @masteradhoc and @jeffpaul.

Dependency Updates

• Bump qs from 6.14.1 to 6.14.2 by #794.
• Bump basic-ftp from 5.0.5 to 5.2.0 by #816.
• Apply automatic lint/format updates and associated Composer package refreshes by #799 from @kasparsd.

New Contributors

• @aslamdoctor made their first contribution in #817
• @StevenDufresne made their first contribution in #615
• @nimesh-xecurify made their first contribution in #825

Full Changelog: 0.15.0...0.16.0

Breaking Changes

• Trigger two-factor flow only when expected by @kasparsd in #660 and #793.

New Features

• Include user IP address and contextual warning in two-factor code emails by @todeveni in #728
• Consistent user experience for TOTP setup by @kasparsd in #792
• Optimize email text for TOTP by @masteradhoc in #789
• Add "Settings" action link to plugin list for quick access to profile by @hardikRathi in #740
• Additional form hooks by @eric-michel in #742
• Full RFC6238 Compatibility by @ericmann in #656

Documentation

• @since docs by @masteradhoc in #781
• Update user and admin docs, prepare for more screenshots by @jeffpaul in #701
• Add changelog & credits, update release notes by @jeffpaul in #696
• Clear readme.txt by @masteradhoc in #785
• Add date and time information above TOTP setup instructions by @masteradhoc in #772
• Clarify TOTP setup instructions by @masteradhoc in #763
• Update RELEASING.md by @jeffpaul in #787

Development Updates

• Pause deploys to SVN trunk for merges to master by @kasparsd in #738
• Fix CI checks for PHP compatability by @kasparsd in #739
• Fix Playground refs by @kasparsd in #744
• Persist existing translations when introducing new helper text in emails by @kasparsd in #745
• Fix missing_direct_file_access_protection by @masteradhoc in #760
• Fix mismatched_plugin_name by @masteradhoc in #754
• Introduce Props Bot workflow by @jeffpaul in #749
• Plugin Check: Fix Missing $domain parameter by @masteradhoc in #753
• Tests: Update to supported WP version 6.8 by @masteradhoc in #770
• Fix PHP 8.5 deprecated message by @masteradhoc in #762
• Exclude 7.2 and 7.3 checks against trunk by @masteradhoc in #769
• Fix Plugin Check errors: MissingTranslatorsComment & MissingSingularPlaceholder by @masteradhoc in #758
• Add PHP 8.5 tests for latest and trunk version of WP by @masteradhoc in #771
• Add phpcs:ignore for falsepositives by @masteradhoc in #777
• Fix(totp): otpauth link in QR code URL by @sjinks in #784
• Update deploy.yml by @masteradhoc in #773
• Update required WordPress Version by @masteradhoc in #765
• Fix: ensure execution stops after redirects by @sjinks in #786
• Fix WordPress.Security.EscapeOutput.OutputNotEscaped errors by @masteradhoc in #776

Dependency Updates

• Bump qs and express by @dependabot[bot] in #746
• Bump lodash from 4.17.21 to 4.17.23 by @dependabot[bot] in #750
• Bump lodash-es from 4.17.21 to 4.17.23 by @dependabot[bot] in #748
• Bump phpunit/phpunit from 8.5.44 to 8.5.52 by @dependabot[bot] in #755
• Bump symfony/process from 5.4.47 to 5.4.51 by @dependabot[bot] in #756
• Bump qs and body-parser by @dependabot[bot] in #782
• Bump webpack from 5.101.3 to 5.105.0 by @dependabot[bot] in #780

New Contributors

• @hardikRathi made their first contribution in #740
• @eric-michel made their first contribution in #742
• @masteradhoc made their first contribution in #754
• @ericmann made their first contribution in #656

Full Changelog: 0.14.2...0.15.0

What's Changed

New Features

• Add filter for rest_api_can_edit_user_and_update_two_factor_options by @gutobenn in #689

Development Updates

• Remove Coveralls tooling and add inline coverage report by @kasparsd in #717
• Update blueprint path to pull from main branch instead of a deleted f… by @georgestephanis in #719
• Fix blueprint and wporg asset deploys by @kasparsd in #734
• Upload release only on tag releases by @kasparsd in #735
• Bump playwright and @playwright/test by @dependabot[bot] in #721
• Bump tar-fs from 3.1.0 to 3.1.1 by @dependabot[bot] in #720
• Bump node-forge from 1.3.1 to 1.3.2 by @dependabot[bot] in #724
• Bump js-yaml by @dependabot[bot] in #725
• Mark as tested with the latest WP core version by @kasparsd in #730

New Contributors

• @gutobenn made their first contribution in #689

Full Changelog: 0.14.1...0.14.2

What's Changed

• Don't URI encode the TOTP url for display. by @dd32 in #711
• Removed the duplicate Security.md by @slvignesh05 in #712
• Fixed linting issues by @sudar in #707
• Update development dependencies and fix failing QR unit test by @kasparsd in #714
• Trigger checkbox js change event by @gedeminas in #688

New Contributors

• @slvignesh05 made their first contribution in #712
• @sudar made their first contribution in #707
• @gedeminas made their first contribution in #688

Full Changelog: 0.14.0...0.14.1

Changelog

Features:

• Enable Application Passwords for REST API and XML-RPC authentication (by default) by @joostdekeijzer in #697 and #698. Previously this required two_factor_user_api_login_enable filter to be set to true which is now the default during application password auth. XML-RPC login is still disabled for regular user passwords.
• Label recommended methods to simplify the configuration by @kasparsd in #676 and #675

Documentation:

• Add WP.org plugin demo by @kasparsd in #667
• Document supported versions of WP core and PHP by @jeffpaul in #695
• Document the release process by @jeffpaul in #684

Tooling:

• Remove duplicate WP.org screenshots and graphics from SVN trunk by @jeffpaul in #683

New Contributors

• @joostdekeijzer made their first contribution in #697

Full Changelog: 0.13.0...0.14.0

What's Changed

• Add two_factor_providers_for_user filter to limit two-factor providers available to each user by @kasparsd in #669
• Update automated testing to cover PHP 8.4 and default to PHP 8.3 by @BrookeDot in #665

Full Changelog: 0.12.0...0.13.0

What's Changed

• Simplify the Two Factor settings in user profile by @kasparsd in #654
• Fix PHP 8.4 Implicitly marking parameter $previous as nullable is deprecated by @BrookeDot in #664

Full Changelog: 0.11.0...0.12.0

What's Changed

• Remove duplicate two_factor_providers filter calls to allow disabling core providers by @kasparsd in #651
• Encourage setting up a second recovery method by @kasparsd in #642
• Focus in code input when totp is checked by @thrijith in #645
• Add autocomplete "one-time-code" attribute by @stefanmomm in #657
• Add filters for email token and backup code length by @kasparsd in #653
• Enable TOTP method when method is configured by @kasparsd in #643

New Contributors

• @stefanmomm made their first contribution in #657

Full Changelog: 0.10.0...0.11.0