read, the capability WordPress itself puts on profile.php, so editors, authors, contributors and shop managers can protect their own logins.
Free/PRO: Enrolment, the login challenge and recovery codes are Free. Only the enforce-for-every-administrator policy is Pro (two_factor_policy); its card on the same screen stays hidden below manage_options.
Notes:
- The enrolment QR is drawn on your own server. An earlier version fetched the image from a third-party QR service with the TOTP secret in the URL — the whole second factor handed to somebody else on every page view. Guard Forge ships its own encoder; the key and an
otpauth://link are printed beside the code for anyone who would rather type it. - Deleting the plugin always removes the enrolment table, licence or no licence: it holds shared secrets and recovery codes, and a database outlives the plugin that wrote it.