Users on this make site with the capabilitycapability A capability is permission to perform one or more types of task. Checking if a user has a capability is performed by the current_user_can function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability). to publish posts are required to have two-factor authentication enabled. This rule has been in place since September 2025. Currently, the process of enforcing this is manual. Any administrator on this make site is welcome and encouraged to audit privileged users to ensure they have not disabled 2fa. A great time to perform an audit is when adding a contributor as an Author+ level user to the site.
Audit Process
To start, use the filters available on the Users Admin page to filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. users by role. Administrator, Editor, and Author should each be checked individually to ensure that the Two-Factor column does not say Disabled. Any users who do not have 2FA enabled should be messaged privately in SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/ (see the message template below), and their role should be changed to contributor. You should also message at least one other active administrator so they are aware of whose role was changed and post in #core that you have changed X users roles without mentioning them by name (we don’t want to name and shame).
Message Template
:wave: I just was auditing make.wordpress.org/core and noticed that you do not have 2fa enabled. Based on https://make.wordpress.org/core/2025/09/11/two-factor-authentication-is-required-for-all-people-with-the-capabilities-to-publish-here-on-make-core/ I've downgraded your account. Let me know when you have enabled it, and I'll be happy to restore you as an {{ROLE}}.{{ROLE}} should be replaced with the role the user had before downgrading
Recent Audits
After performing an audit, please add a row at the top of this table below the headerHeader The header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes. with who performed the audit and the date.
| Date | Auditor(s) |
|---|---|
| 2 July 2026 | @jorbin |
