WordPress’s Two Factor plugin already checks the codes. Instead of writing yet another 2FA plugin, I filed bugs against it, fixed some, and built two small add-ons beside it: one for policy, one for onboarding. Here’s why separating mechanism from policy works.