<?php
// Standard WP check if direct
defined( 'ABSPATH' ) || exit;

// Marking 2FA as required removes the Skip button from the Kadence Security setup
// prompt and enforces an emailed login code until the user configures a method.
// The enforced login path does not check the plugin's excluded user groups itself,
// so respect them here. Inert when Kadence Security is not active.
add_filter( "itsec_two_factor_requirement_reason", function ( $reason, $user ) {

    if ( $reason ) {
        return $reason;
    }

    if ( class_exists( "ITSEC_Two_Factor" )
        && method_exists( "ITSEC_Two_Factor", "is_user_excluded" )
        && ITSEC_Two_Factor::get_instance()->is_user_excluded( $user ) ) {
        return $reason;
    }

    return "user_type";
}, 10, 2 );