v1.6.6

changelog.txt

@@ -1,5 +1,25 @@
 == Changelog ==
 
+= 1.6.6 =
+
+_Release date: 2026-09-17_
+
+**Added**
+
+* Forced-enrollment warning on the profile 2FA section: when a user's role enforces 2FA but they have no verification method configured yet, the 2FA section of their profile (wp-admin and the frontend shortcode) opens with a warning notice asking them to activate at least one method. While a grace period is active, the notice appends the remaining days.
+
+**Compatibility**
+
+* WordPress: 5.6 – 7.1
+* PHP: 8.0 – 8.5
+
+**Tests**
+
+* PHP Coding Standards: PHP_CodeSniffer 3.13.6 / WPCS 3.4.1 — 0 errors
+* PHPStan: level 9 — 0 errors
+* PHPCompatibility: 8.0–8.5 — 0 issues
+* PHPUnit: 9.6.36 — 93 tests, 189 assertions
+
 = 1.6.5 =
 
 _Release date: 2026-09-17_

includes/user/class-profile-settings.php

@@ -97,6 +97,13 @@ class Profile_Settings {
 	 */
 	private Trusted_Devices $trusted_devices;
 
+	/**
+	 * Grace period manager.
+	 *
+	 * @var Grace_Period
+	 */
+	private Grace_Period $grace_period;
+
 	/**
 	 * Whether the post-save redirect should focus the 2FA section.
 	 *
@@ -113,6 +120,7 @@ class Profile_Settings {
 		$this->otp_manager              = new OTP_Manager();
 		$this->recovery_codes           = new Recovery_Codes();
 		$this->trusted_devices          = new Trusted_Devices();
+		$this->grace_period             = new Grace_Period();
 	}
 
 	/**
@@ -170,6 +178,57 @@ class Profile_Settings {
 	}
 
 
+	/**
+	 * Render the forced-enrollment warning on the profile 2FA section.
+	 *
+	 * Shown when the user's role enforces 2FA but no verification method is
+	 * configured yet, so the requirement is visible before the login flow
+	 * (grace notice, setup wizard, or login block) kicks in. When a grace
+	 * period is active, the number of remaining days is appended.
+	 *
+	 * @since 1.6.6
+	 *
+	 * @param \WP_User $user User whose profile section is being rendered.
+	 *
+	 * @return void
+	 */
+	public function render_forced_enrollment_warning( \WP_User $user ): void {
+		$user_settings = $this->user_settings_repository->get_user_settings( $user->ID );
+
+		if ( empty( $this->config->get_required_methods_for_user( $user ) ) || ! empty( $user_settings['methods'] ) ) {
+			return;
+		}
+
+		$grace_note = '';
+		$grace_days = $this->config->get_grace_period_days();
+
+		if ( $grace_days > 0 && $this->grace_period->is_active( $user, $grace_days ) ) {
+			$remaining = $this->grace_period->get_days_remaining( $user, $grace_days );
+
+			/* translators: %d: number of days remaining to complete the setup. */
+			$grace_note = sprintf(
+				_n(
+					'You have %d day left to complete the setup.',
+					'You have %d days left to complete the setup.',
+					$remaining,
+					'robotstxt-2fa'
+				),
+				$remaining
+			);
+		}
+		?>
+		<div class="notice notice-warning inline robotstxt-2fa-forced-warning">
+			<p>
+				<strong><?php esc_html_e( 'Two-factor authentication is required for your account.', 'robotstxt-2fa' ); ?></strong>
+				<?php esc_html_e( 'You have not set up any verification method yet. Activate at least one method below to keep access to your account.', 'robotstxt-2fa' ); ?>
+				<?php if ( '' !== $grace_note ) : ?>
+					<em><?php echo esc_html( $grace_note ); ?></em>
+				<?php endif; ?>
+			</p>
+		</div>
+		<?php
+	}
+
 	/**
 	 * Render profile settings UI.
 	 *
@@ -313,6 +372,7 @@ class Profile_Settings {
 		}
 		?>
 		<h2 id="<?php echo esc_attr( self::SECTION_ANCHOR ); ?>"><?php esc_html_e( 'Two-Factor Authentication', 'robotstxt-2fa' ); ?></h2>
+		<?php $this->render_forced_enrollment_warning( $user ); ?>
 		<?php wp_nonce_field( self::NONCE_ACTION, self::NONCE_FIELD ); ?>
 		<table class="form-table" role="presentation">
 			<tbody>

readme.txt

@@ -4,7 +4,7 @@ Tags: security, two-factor authentication, login, otp
 Requires at least: 5.6
 Tested up to: 7.0
 Requires PHP: 8.0
-Stable tag: 1.6.5
+Stable tag: 1.6.6
 License: GPLv3 or later
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
 
@@ -59,6 +59,14 @@ Yes. Activate the plugin at the network level. Network administrators can set an
 
 == Changelog ==
 
+= 1.6.6 =
+
+_Release date: 2026-09-17_
+
+**Added**
+
+* Forced-enrollment warning on the profile 2FA section: when a user's role enforces 2FA but they have no verification method configured yet, the 2FA section of their profile (wp-admin and the frontend shortcode) opens with a warning notice asking them to activate at least one method. While a grace period is active, the notice appends the remaining days.
+
 = 1.6.5 =
 
 _Release date: 2026-09-17_
@@ -76,18 +84,6 @@ _Release date: 2026-09-11_
 
 * Compatibility with Restrict Content Pro's "Hijack Login URL" option: RCP's `login_url` filter made every `wp_login_url()` call return a membership page, so the 2FA verification redirect landed on a restricted page where the verification form cannot render, and the visitor was bounced to the registration page. Verification-stage URLs are now built from the canonical `wp-login.php`, mirroring WordPress core's URL construction before the filterable output. The "Back to login" link keeps the site-configured login URL.
 
-= 1.6.3 =
-
-_Release date: 2026-08-24_
-
-**Changed**
-
-* Manager detection now uses the ecosystem presence constant (`ROBOTSTXT_MANAGER_NOTICED`, defined by Manager 1.6.2+) with a fallback to the plugin-list scan for older Manager versions.
-
-**Fixed**
-
-* Compatibility with the ALTCHA Spam Protection plugin: when "Protect login" was enabled, submitting the 2FA verification code failed with "[ALTCHA] Sorry, your request could not be processed.". The ALTCHA interceptor is now disabled while the verification screen is shown; the first login step keeps its ALTCHA check.
-
 = Previous versions =
 
 For the full changelog see the [changelog](https://www.robotstxt.software/plugins/robotstxt-2fa/) page.

robotstxt-2fa.php

@@ -4,7 +4,7 @@
  * Plugin URI:        https://www.robotstxt.software/plugins/robotstxt-2fa/
  * Update URI:        https://www.robotstxt.software/plugins/robotstxt-2fa/
  * Description:       Adds two-factor authentication to the WordPress login flow.
- * Version:           1.6.5
+ * Version:           1.6.6
  * Author:            ROBOTSTXT
  * Author URI:        https://www.robotstxt.software/
  * Text Domain:       robotstxt-2fa
@@ -25,7 +25,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 
 if ( ! defined( 'ROBOTSTXT_2FA_VERSION' ) ) {
-	define( 'ROBOTSTXT_2FA_VERSION', '1.6.5' );
+	define( 'ROBOTSTXT_2FA_VERSION', '1.6.6' );
 }
 
 if ( ! defined( 'ROBOTSTXT_2FA_FILE' ) ) {

vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'robotstxt/robotstxt-2fa',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'ed617610896f05f9dc90a3b0f53b19c9dacd59a5',
+        'reference' => 'f1d493aefc9da797d99b3b635736b6c627166ddf',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -40,7 +40,7 @@
         'robotstxt/robotstxt-2fa' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'ed617610896f05f9dc90a3b0f53b19c9dacd59a5',
+            'reference' => 'f1d493aefc9da797d99b3b635736b6c627166ddf',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),