Case: Mandatory 2FA Cut Account Takeovers to Zero

Case: Mandatory 2FA Cut Account Takeovers to Zero
Agency with 63 editor/admin accounts had 3 confirmed takeovers in one quarter via reused passwords from a breach dump.

Enforcement SOP we ran:

— Step 1: Set a 14-day grace window. Email every user the enrollment link, log who enrolled.
— Step 2: Day 14, flip the plugin to force for roles administrator and editor only — leave subscribers alone.
— Step 3: Day 14, downgrade unenrolled admins to no-access until they enroll. 7 accounts hit this.
— Step 4: Issue 10 single-use recovery codes per user, store nowhere on the server.
— Step 5: Audit enrollment weekly via the plugin export.

Outcome: 56/63 enrolled by day 14, all 63 by day 19. Account takeovers: 3 the prior quarter, 0 in the 6 months after.

Run this every time.