WordPress / WordPress/two-factor
The 'two_factor_enabled_providers_for_user' filter behaves differently in version 0.16.0
Open
@masteradhoc is already working on this.
Since Jun 18, 2026.
- Dominant language
- PHP
- Stars
- 825
- Forks
- 187
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 17
Description
Describe the bug
Hi,
Prior to version 0.16.0, we used the two_factor_enabled_providers_for_user filter to programmatically disable all providers for a specific user when they accessed the site from our company IP address.
After updating to version 0.16.0, this behavior seems to have changed. When the provider list is empty, the plugin now automatically enables email as a provider.
Would it be possible to add either:
- an extra filter to explicitly allow an empty provider list, or
- an IP whitelist filter to support this use case?
Regards,
Floris Jansen
Steps to Reproduce
Update to version 0.16.0
Screenshots, screen recording, code snippet
No response
Environment information
No response
Please confirm that you have searched existing issues in this repository.
Yes
Please confirm that you have tested with all plugins deactivated except Two-Factor.
Yes
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.