functions.php

<?php
/**
 * Enable email-based 2FA by default.
 *
 * We configure MailHog to catch outbound mail on our local/staging
 * environments. To avoid unnecessary hassle, we have disabled our default
 * email-based 2FA on local/staging environments.
 *
 * @link https://link.from.pw/3P7cH9u
 * @author pjv
 *
 * @param $providers
 * @param $user_id
 * @return mixed
 */
function pw_default_2fa( $providers, $user_id ) {

	// Bail if email-based 2FA is not available.
	if ( ! class_exists( 'Two_Factor_Email' ) ) {
		return $providers;
	}

	// Bail if this isn't a production site.
	if ( 'production' !== wp_get_environment_type() ) {

		// Disable email-based 2FA for local/staging environments.
		if ( ( $key = array_search( 'Two_Factor_Email', $providers ) ) !== false ) {
			unset( $providers[ $key ] );
		}

		return $providers;
	}

	$force_roles = apply_filters( 'kanuka_default_2fa_roles', array(
		'administrator',
		'editor',
	) );

	$user = get_user_by( 'id', $user_id );

	if ( empty( array_intersect( $force_roles, $user->roles ) ) ) {
		return $providers;
	}

	if ( empty( $providers ) ) {
		$providers[] = 'Two_Factor_Email';
	}

	return $providers;
}
add_filter( 'two_factor_enabled_providers_for_user', 'pw_default_2fa', 10, 2 );