How MemberMode handles password resets, including the front-end flow and the email that goes out.

TOTP-based 2FA built into the free plugin — works on wp-login and the frontend, with per-role enforcement.