v1.6.7

changelog.txt

@@ -1,5 +1,45 @@
 == Changelog ==
 
+= 1.6.7 =
+
+_Release date: 2026-09-17_
+
+**Fixed**
+
+* The forced-setup wizard felt like a broken redirect loop: the wizard redirect bounced users to the profile with no explanation (it now carries a flag that renders a clear "activate at least one verification method, then save" warning), and saving with an expired form nonce silently did nothing (it now raises a visible "form session expired" error so users know to try again).
+
+**Compatibility**
+
+* WordPress: 5.6 – 7.1
+* PHP: 8.0 – 8.5
+
+**Tests**
+
+* PHP Coding Standards: PHP_CodeSniffer 3.13.6 / WPCS 3.4.1 — 0 errors
+* PHPStan: level 9 — 0 errors
+* PHPCompatibility: 8.0–8.5 — 0 issues
+* PHPUnit: 9.6.36 — 98 tests, 197 assertions
+
+= 1.6.6 =
+
+_Release date: 2026-09-17_
+
+**Added**
+
+* Forced-enrollment warning on the profile 2FA section: when a user's role enforces 2FA but they have no verification method configured yet, the 2FA section of their profile (wp-admin and the frontend shortcode) opens with a warning notice asking them to activate at least one method. While a grace period is active, the notice appends the remaining days.
+
+**Compatibility**
+
+* WordPress: 5.6 – 7.1
+* PHP: 8.0 – 8.5
+
+**Tests**
+
+* PHP Coding Standards: PHP_CodeSniffer 3.13.6 / WPCS 3.4.1 — 0 errors
+* PHPStan: level 9 — 0 errors
+* PHPCompatibility: 8.0–8.5 — 0 issues
+* PHPUnit: 9.6.36 — 93 tests, 189 assertions
+
 = 1.6.5 =
 
 _Release date: 2026-09-17_

includes/user/class-grace-period.php

@@ -41,6 +41,7 @@ class Grace_Period {
 	public function register_hooks(): void {
 		add_action( 'admin_init', array( $this, 'maybe_redirect_to_setup_wizard' ) );
 		add_action( 'robotstxt_2fa_method_enabled', array( $this, 'clear_pending_setup' ), 10, 2 );
+		add_action( 'admin_notices', array( $this, 'maybe_show_setup_required_notice' ) );
 	}
 
 	/**
@@ -167,10 +168,45 @@ class Grace_Period {
 			return;
 		}
 
-		wp_safe_redirect( admin_url( 'profile.php#robotstxt-2fa-settings' ) );
+		// The query flag lets the profile show WHY the user was redirected,
+		// so the mandatory setup does not feel like a silent loop.
+		$profile_url = add_query_arg( 'robotstxt-2fa-setup-required', '1', admin_url( 'profile.php' ) );
+
+		wp_safe_redirect( $profile_url . '#robotstxt-2fa-settings' );
 		exit;
 	}
 
+	/**
+	 * Explain the setup wizard redirect on the profile screen.
+	 *
+	 * Rendered after {@see self::maybe_redirect_to_setup_wizard()} bounced the
+	 * user back to their profile. Without it, users land on a regular profile
+	 * page with no hint that 2FA enrollment is mandatory before they can
+	 * continue to the dashboard — which reads as a broken redirect loop.
+	 *
+	 * @since 1.6.7
+	 *
+	 * @return void
+	 */
+	public function maybe_show_setup_required_notice(): void {
+		if ( ! $this->is_pending_setup() ) {
+			return;
+		}
+
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only flag; no state change.
+		if ( ! isset( $_GET['robotstxt-2fa-setup-required'] ) ) {
+			return;
+		}
+		?>
+		<div class="notice notice-warning robotstxt-2fa-setup-required">
+			<p>
+				<strong><?php esc_html_e( 'Two-factor authentication is required.', 'robotstxt-2fa' ); ?></strong>
+				<?php esc_html_e( 'You must activate at least one verification method in the Two-Factor Authentication section of this page, then save, before you can continue to the dashboard.', 'robotstxt-2fa' ); ?>
+			</p>
+		</div>
+		<?php
+	}
+
 	/**
 	 * Retrieve the grace period start timestamp, creating it on first call.
 	 *

includes/user/class-profile-settings.php

@@ -97,6 +97,13 @@ class Profile_Settings {
 	 */
 	private Trusted_Devices $trusted_devices;
 
+	/**
+	 * Grace period manager.
+	 *
+	 * @var Grace_Period
+	 */
+	private Grace_Period $grace_period;
+
 	/**
 	 * Whether the post-save redirect should focus the 2FA section.
 	 *
@@ -113,6 +120,7 @@ class Profile_Settings {
 		$this->otp_manager              = new OTP_Manager();
 		$this->recovery_codes           = new Recovery_Codes();
 		$this->trusted_devices          = new Trusted_Devices();
+		$this->grace_period             = new Grace_Period();
 	}
 
 	/**
@@ -170,6 +178,57 @@ class Profile_Settings {
 	}
 
 
+	/**
+	 * Render the forced-enrollment warning on the profile 2FA section.
+	 *
+	 * Shown when the user's role enforces 2FA but no verification method is
+	 * configured yet, so the requirement is visible before the login flow
+	 * (grace notice, setup wizard, or login block) kicks in. When a grace
+	 * period is active, the number of remaining days is appended.
+	 *
+	 * @since 1.6.6
+	 *
+	 * @param \WP_User $user User whose profile section is being rendered.
+	 *
+	 * @return void
+	 */
+	public function render_forced_enrollment_warning( \WP_User $user ): void {
+		$user_settings = $this->user_settings_repository->get_user_settings( $user->ID );
+
+		if ( empty( $this->config->get_required_methods_for_user( $user ) ) || ! empty( $user_settings['methods'] ) ) {
+			return;
+		}
+
+		$grace_note = '';
+		$grace_days = $this->config->get_grace_period_days();
+
+		if ( $grace_days > 0 && $this->grace_period->is_active( $user, $grace_days ) ) {
+			$remaining = $this->grace_period->get_days_remaining( $user, $grace_days );
+
+			/* translators: %d: number of days remaining to complete the setup. */
+			$grace_note = sprintf(
+				_n(
+					'You have %d day left to complete the setup.',
+					'You have %d days left to complete the setup.',
+					$remaining,
+					'robotstxt-2fa'
+				),
+				$remaining
+			);
+		}
+		?>
+		<div class="notice notice-warning inline robotstxt-2fa-forced-warning">
+			<p>
+				<strong><?php esc_html_e( 'Two-factor authentication is required for your account.', 'robotstxt-2fa' ); ?></strong>
+				<?php esc_html_e( 'You have not set up any verification method yet. Activate at least one method below to keep access to your account.', 'robotstxt-2fa' ); ?>
+				<?php if ( '' !== $grace_note ) : ?>
+					<em><?php echo esc_html( $grace_note ); ?></em>
+				<?php endif; ?>
+			</p>
+		</div>
+		<?php
+	}
+
 	/**
 	 * Render profile settings UI.
 	 *
@@ -313,6 +372,7 @@ class Profile_Settings {
 		}
 		?>
 		<h2 id="<?php echo esc_attr( self::SECTION_ANCHOR ); ?>"><?php esc_html_e( 'Two-Factor Authentication', 'robotstxt-2fa' ); ?></h2>
+		<?php $this->render_forced_enrollment_warning( $user ); ?>
 		<?php wp_nonce_field( self::NONCE_ACTION, self::NONCE_FIELD ); ?>
 		<table class="form-table" role="presentation">
 			<tbody>
@@ -798,6 +858,20 @@ class Profile_Settings {
 		$nonce = sanitize_text_field( wp_unslash( $_POST[ self::NONCE_FIELD ] ) );
 
 		if ( ! wp_verify_nonce( $nonce, self::NONCE_ACTION ) ) {
+			/*
+			 * A stale form (nonce expired) previously returned silently, which
+			 * left wizard-trapped users clicking Save with no visible result
+			 * while the setup-required redirect kept bouncing them back to the
+			 * profile. Fail loudly so the user knows to try again.
+			 */
+			$this->focus_section = true;
+			add_settings_error(
+				'robotstxt-2fa',
+				'robotstxt-2fa-nonce-expired',
+				__( 'Your form session expired and nothing was saved. Please try saving again.', 'robotstxt-2fa' ),
+				'error'
+			);
+
 			return;
 		}
 

readme.txt

@@ -4,7 +4,7 @@ Tags: security, two-factor authentication, login, otp
 Requires at least: 5.6
 Tested up to: 7.0
 Requires PHP: 8.0
-Stable tag: 1.6.5
+Stable tag: 1.6.7
 License: GPLv3 or later
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
 
@@ -59,6 +59,22 @@ Yes. Activate the plugin at the network level. Network administrators can set an
 
 == Changelog ==
 
+= 1.6.7 =
+
+_Release date: 2026-09-17_
+
+**Fixed**
+
+* The forced-setup wizard felt like a broken redirect loop: the wizard redirect bounced users to the profile with no explanation (it now carries a flag that renders a clear "activate at least one verification method, then save" warning), and saving with an expired form nonce silently did nothing (it now raises a visible "form session expired" error so users know to try again).
+
+= 1.6.6 =
+
+_Release date: 2026-09-17_
+
+**Added**
+
+* Forced-enrollment warning on the profile 2FA section: when a user's role enforces 2FA but they have no verification method configured yet, the 2FA section of their profile (wp-admin and the frontend shortcode) opens with a warning notice asking them to activate at least one method. While a grace period is active, the notice appends the remaining days.
+
 = 1.6.5 =
 
 _Release date: 2026-09-17_
@@ -68,26 +84,6 @@ _Release date: 2026-09-17_
 * Fatal error on the login screen with newer WordPress versions: the `login_message` filter can deliver null when no message is set (observed on WordPress 7.x with PHP 8.4, TypeError on a plain visit to wp-login.php). The message callback now accepts `string|null` and coalesces null to an empty string.
 * Hardened all externally-fed filter callbacks against null payloads: the four `authenticate` callbacks now accept `string|null` credentials (custom REST/SSO endpoints are known to apply the filter with null), and the `wp_redirect` filter callback coalesces a null location.
 
-= 1.6.4 =
-
-_Release date: 2026-09-11_
-
-**Fixed**
-
-* Compatibility with Restrict Content Pro's "Hijack Login URL" option: RCP's `login_url` filter made every `wp_login_url()` call return a membership page, so the 2FA verification redirect landed on a restricted page where the verification form cannot render, and the visitor was bounced to the registration page. Verification-stage URLs are now built from the canonical `wp-login.php`, mirroring WordPress core's URL construction before the filterable output. The "Back to login" link keeps the site-configured login URL.
-
-= 1.6.3 =
-
-_Release date: 2026-08-24_
-
-**Changed**
-
-* Manager detection now uses the ecosystem presence constant (`ROBOTSTXT_MANAGER_NOTICED`, defined by Manager 1.6.2+) with a fallback to the plugin-list scan for older Manager versions.
-
-**Fixed**
-
-* Compatibility with the ALTCHA Spam Protection plugin: when "Protect login" was enabled, submitting the 2FA verification code failed with "[ALTCHA] Sorry, your request could not be processed.". The ALTCHA interceptor is now disabled while the verification screen is shown; the first login step keeps its ALTCHA check.
-
 = Previous versions =
 
 For the full changelog see the [changelog](https://www.robotstxt.software/plugins/robotstxt-2fa/) page.

robotstxt-2fa.php

@@ -4,7 +4,7 @@
  * Plugin URI:        https://www.robotstxt.software/plugins/robotstxt-2fa/
  * Update URI:        https://www.robotstxt.software/plugins/robotstxt-2fa/
  * Description:       Adds two-factor authentication to the WordPress login flow.
- * Version:           1.6.5
+ * Version:           1.6.7
  * Author:            ROBOTSTXT
  * Author URI:        https://www.robotstxt.software/
  * Text Domain:       robotstxt-2fa
@@ -25,7 +25,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 
 if ( ! defined( 'ROBOTSTXT_2FA_VERSION' ) ) {
-	define( 'ROBOTSTXT_2FA_VERSION', '1.6.5' );
+	define( 'ROBOTSTXT_2FA_VERSION', '1.6.7' );
 }
 
 if ( ! defined( 'ROBOTSTXT_2FA_FILE' ) ) {

vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'robotstxt/robotstxt-2fa',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'ed617610896f05f9dc90a3b0f53b19c9dacd59a5',
+        'reference' => '2b6e97d03ffbc5f7734bbd30413c979f50de3d15',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -40,7 +40,7 @@
         'robotstxt/robotstxt-2fa' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'ed617610896f05f9dc90a3b0f53b19c9dacd59a5',
+            'reference' => '2b6e97d03ffbc5f7734bbd30413c979f50de3d15',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),