Fantastic and easy to use plugin

Thanks, mdriess!

Keep in mind that those plugins don’t protect a website from brute-forcing user passwords via XML-RPC interface which is enabled in WordPress by default. You have to completely disable XML-RPC or not to use two-factor plugin at all. Just in case, a review of two-factor authentication plugins: https://wpcerber.com/two-factor-authentication-plugins-for-wordpress/