Having migrated from Joomla, I was shocked to see no 2FA (two factor authentication) options or hooks in WordPress. I posted on the support forums and was blasted (the only word I think appropriate) by the core devs for having the temerity to suggest this security enhancement. In Joomla, the core has hooks to enable 2FA plugins to use. Any dev of a login/user profile type plugin knows to check these hooks, and the way it is implemented is common for all the plugins. Moreover, in the core, at the time a year ago, 2 methods were part of core, one of which was Google 2FA. It will only activate if the server PHP release is new enough to support it.

The site owner makes a global decision as to whether to offer registered users the option of opting in. Each user can opt in, or not. That is up to them. No-one is forced to activate 2FA on their account. The site owner can choose to 'suggest' that users do.

There is a perfectly usable pair of plugins that provide this functionality, one for 2FA and to make it 2 step login. Not a SINGLE plugin out there for user/profile control supports these 2FA plugins. The plugin devs don't want to, because the core WP team are so adamant they won't do it.

This inward, insular approach/reply to my simple query stunned me. And then someone pointed something out to me that I hadn't spotted. Go to Settings => and where is the general settings panel for user control? There isn't any. Everything, by default, has to be done per user. Can it be right that users mean so little to WordPress? I had to buy plugins to fill that gap, and they are quite poor and fragmented in design and purpose.