From c2cd777fecf97dd677f18ff3b7f54aaa379434af Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 10:59:07 +0200
Subject: [PATCH 01/19] Specify the return types

---
 class-two-factor-core.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 7752abc5..34d64cc1 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -568,7 +568,8 @@ public static function fetch_user( $user = null ) {
 	 * @see Two_Factor_Core::get_available_providers_for_user()
 	 *
 	 * @param int|WP_User $user Optional. User ID, or WP_User object of the the user. Defaults to current user.
-	 * @return array
+	 *
+	 * @return Two_Factor_Provider[] List of provider instances indexed by provider key.
 	 */
 	public static function get_enabled_providers_for_user( $user = null ) {
 		$user = self::fetch_user( $user );
@@ -602,7 +603,7 @@ public static function get_enabled_providers_for_user( $user = null ) {
 	 * @see Two_Factor_Core::get_enabled_providers_for_user()
 	 *
 	 * @param int|WP_User $user Optional. User ID, or WP_User object of the the user. Defaults to current user.
-	 * @return array List of provider instances.
+	 * @return Two_Factor_Provider[] List of provider instances indexed by provider key.
 	 */
 	public static function get_available_providers_for_user( $user = null ) {
 		$user = self::fetch_user( $user );

From e547cfc258df6923cc7ab0121c006503dc86daca Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 11:01:18 +0200
Subject: [PATCH 02/19] Only configured providers should be set to enabled

---
 class-two-factor-core.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 34d64cc1..657104c4 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2043,7 +2043,7 @@ private static function get_recommended_providers( $user ) {
 	 */
 	private static function render_user_providers_form( $user, $providers ) {
 		$primary_provider_key      = self::get_primary_provider_key_selected_for_user( $user );
-		$enabled_providers         = self::get_enabled_providers_for_user( $user );
+		$available_providers       = self::get_available_providers_for_user( $user );
 		$recommended_provider_keys = self::get_recommended_providers( $user );
 
 		// Move the recommended providers first.
@@ -2071,7 +2071,7 @@ private static function render_user_providers_form( $user, $providers ) {
 					<th><?php echo esc_html( $object->get_label() ); ?></th>
 					<td>
 						<label class="two-factor-method-label">
-							<input id="enabled-<?php echo esc_attr( $provider_key ); ?>" type="checkbox" name="<?php echo esc_attr( self::ENABLED_PROVIDERS_USER_META_KEY ); ?>[]" value="<?php echo esc_attr( $provider_key ); ?>" <?php checked( in_array( $provider_key, $enabled_providers, true ) ); ?> />
+							<input id="enabled-<?php echo esc_attr( $provider_key ); ?>" type="checkbox" name="<?php echo esc_attr( self::ENABLED_PROVIDERS_USER_META_KEY ); ?>[]" value="<?php echo esc_attr( $provider_key ); ?>" <?php checked( in_array( $provider_key, $available_providers, true ) ); ?> />
 							<?php /* translators: %s: authentication method name. */ ?>
 							<strong><?php echo esc_html( sprintf( __( 'Enable %s', 'two-factor' ), $object->get_label() ) ); ?></strong>
 							<?php if ( in_array( $provider_key, $recommended_provider_keys, true ) ) : ?>
@@ -2105,7 +2105,7 @@ private static function render_user_providers_form( $user, $providers ) {
 						<select name="<?php echo esc_attr( self::PROVIDER_USER_META_KEY ); ?>">
 							<option value=""><?php echo esc_html( __( 'Default', 'two-factor' ) ); ?></option>
 							<?php foreach ( $providers as $provider_key => $object ) : ?>
-								<option value="<?php echo esc_attr( $provider_key ); ?>" <?php selected( $provider_key, $primary_provider_key ); ?> <?php disabled( ! in_array( $provider_key, $enabled_providers, true ) ); ?>>
+								<option value="<?php echo esc_attr( $provider_key ); ?>" <?php selected( $provider_key, $primary_provider_key ); ?> <?php disabled( ! in_array( $provider_key, $available_providers, true ) ); ?>>
 									<?php echo esc_html( $object->get_label() ); ?>
 								</option>
 							<?php endforeach; ?>

From cbe4754502d7029a4ddbe18b55cea17108c9d6fa Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 11:36:01 +0200
Subject: [PATCH 03/19] Ensure the method is configured before storing it as
 enabled

---
 class-two-factor-core.php | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 657104c4..060913a4 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2209,13 +2209,23 @@ public static function user_two_factor_options_update( $user_id ) {
 				return;
 			}
 
+			$user               = self::fetch_user( $user_id );
 			$providers          = self::get_supported_providers_for_user( $user_id );
 			$enabled_providers  = $_POST[ self::ENABLED_PROVIDERS_USER_META_KEY ];
 			$existing_providers = self::get_enabled_providers_for_user( $user_id );
 
 			// Enable only the available providers.
-			$enabled_providers = array_intersect( $enabled_providers, array_keys( $providers ) );
-			update_user_meta( $user_id, self::ENABLED_PROVIDERS_USER_META_KEY, $enabled_providers );
+			$enabled_providers = array_intersect_key( $providers, array_flip( $enabled_providers ) );
+
+			// Ensure the enabled providers are configured and can be enabled.
+			foreach ( $enabled_providers as $provider_key => $provider ) {
+				if ( ! $provider->is_available_for_user( $user ) ) {
+					// TODO: Use the `user_profile_update_errors` filter to show these errors too.
+					unset( $enabled_providers[ $provider_key ] );
+				}
+			}
+
+			update_user_meta( $user_id, self::ENABLED_PROVIDERS_USER_META_KEY, array_keys( $enabled_providers ) );
 
 			// Primary provider must be enabled.
 			$new_provider = isset( $_POST[ self::PROVIDER_USER_META_KEY ] ) ? $_POST[ self::PROVIDER_USER_META_KEY ] : '';

From b908f44d851b455b8635703a7339538de2a24763 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 11:48:41 +0200
Subject: [PATCH 04/19] this is now a key

---
 class-two-factor-core.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 060913a4..80c337ea 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2071,7 +2071,7 @@ private static function render_user_providers_form( $user, $providers ) {
 					<th><?php echo esc_html( $object->get_label() ); ?></th>
 					<td>
 						<label class="two-factor-method-label">
-							<input id="enabled-<?php echo esc_attr( $provider_key ); ?>" type="checkbox" name="<?php echo esc_attr( self::ENABLED_PROVIDERS_USER_META_KEY ); ?>[]" value="<?php echo esc_attr( $provider_key ); ?>" <?php checked( in_array( $provider_key, $available_providers, true ) ); ?> />
+							<input id="enabled-<?php echo esc_attr( $provider_key ); ?>" type="checkbox" name="<?php echo esc_attr( self::ENABLED_PROVIDERS_USER_META_KEY ); ?>[]" value="<?php echo esc_attr( $provider_key ); ?>" <?php checked( isset( $available_providers[ $provider_key ] ) ); ?> />
 							<?php /* translators: %s: authentication method name. */ ?>
 							<strong><?php echo esc_html( sprintf( __( 'Enable %s', 'two-factor' ), $object->get_label() ) ); ?></strong>
 							<?php if ( in_array( $provider_key, $recommended_provider_keys, true ) ) : ?>
@@ -2105,7 +2105,7 @@ private static function render_user_providers_form( $user, $providers ) {
 						<select name="<?php echo esc_attr( self::PROVIDER_USER_META_KEY ); ?>">
 							<option value=""><?php echo esc_html( __( 'Default', 'two-factor' ) ); ?></option>
 							<?php foreach ( $providers as $provider_key => $object ) : ?>
-								<option value="<?php echo esc_attr( $provider_key ); ?>" <?php selected( $provider_key, $primary_provider_key ); ?> <?php disabled( ! in_array( $provider_key, $available_providers, true ) ); ?>>
+								<option value="<?php echo esc_attr( $provider_key ); ?>" <?php selected( $provider_key, $primary_provider_key ); ?> <?php disabled( ! isset( $available_providers[ $provider_key ] ) ); ?>>
 									<?php echo esc_html( $object->get_label() ); ?>
 								</option>
 							<?php endforeach; ?>

From a807a589676f6f1d725cda7d9a8c66286a673c24 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 12:11:24 +0200
Subject: [PATCH 05/19] Specify the return type

---
 class-two-factor-core.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 80c337ea..e6e09270 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -319,7 +319,8 @@ public static function get_providers() {
 	 * @see Two_Factor_Core::get_available_providers_for_user()
 	 *
 	 * @param  WP_User|int|null $user User ID.
-	 * @return array List of provider instances indexed by provider key.
+	 *
+	 * @return Two_Factor_Provider[] List of provider instances indexed by provider key.
 	 */
 	public static function get_supported_providers_for_user( $user = null ) {
 		$user      = self::fetch_user( $user );

From 4460a6ef280d9892e826d9bb1a4d1971013c2e4f Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 12:25:42 +0200
Subject: [PATCH 06/19] Account for the list being instances of providers

---
 class-two-factor-core.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index e6e09270..d51da281 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2230,7 +2230,7 @@ public static function user_two_factor_options_update( $user_id ) {
 
 			// Primary provider must be enabled.
 			$new_provider = isset( $_POST[ self::PROVIDER_USER_META_KEY ] ) ? $_POST[ self::PROVIDER_USER_META_KEY ] : '';
-			if ( ! empty( $new_provider ) && in_array( $new_provider, $enabled_providers, true ) ) {
+			if ( ! empty( $new_provider ) && isset( $enabled_providers[ $new_provider ] ) ) {
 				update_user_meta( $user_id, self::PROVIDER_USER_META_KEY, $new_provider );
 			} else {
 				delete_user_meta( $user_id, self::PROVIDER_USER_META_KEY );
@@ -2263,7 +2263,7 @@ public static function user_two_factor_options_update( $user_id ) {
 				// No providers, enabling one (or more)
 				( ! $existing_providers && $enabled_providers ) ||
 				// Has providers, and is disabling one (or more), but remaining with 2FA.
-				( $existing_providers && $enabled_providers && array_diff( $existing_providers, $enabled_providers ) )
+				( $existing_providers && $enabled_providers && array_diff_key( $existing_providers, $enabled_providers ) )
 			) {
 				if ( $user_id === get_current_user_id() ) {
 					// Keep the current session, destroy others sessions for this user.

From 0bb68256ce9d0e82fe4096880af076aa2c795536 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 12:28:11 +0200
Subject: [PATCH 07/19] Add error tracking

---
 class-two-factor-core.php | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index d51da281..3c5ef3ec 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -85,6 +85,13 @@ class Two_Factor_Core {
 	 */
 	private static $password_auth_tokens = array();
 
+	/**
+	 * Keep track of any errors related to setting updates.
+	 *
+	 * @var array
+	 */
+	private static $profile_errors = array();
+
 	/**
 	 * Set up filters and actions.
 	 *
@@ -373,6 +380,17 @@ public static function add_settings_action_link( $links ) {
 		return $links;
 	}
 
+	/**
+	 * Register an error associated with the current request.
+	 *
+	 * @param WP_Error $error Error instance.
+
+	 * @return void
+	 */
+	private static function add_error( WP_Error $error ) {
+		self::$profile_errors[ $error->get_error_code() ] = $error;
+	}
+
 	/**
 	 * Check if the debug mode is enabled.
 	 * 

From c6283a8242cec507f149adb01852722e5bf26eee Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 12:28:36 +0200
Subject: [PATCH 08/19] Relay our errors to WP core profile logic

---
 class-two-factor-core.php | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 3c5ef3ec..ff26b27c 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -113,6 +113,7 @@ public static function add_hooks( $compat ) {
 		add_filter( 'manage_users_columns', array( __CLASS__, 'filter_manage_users_columns' ) );
 		add_filter( 'wpmu_users_columns', array( __CLASS__, 'filter_manage_users_columns' ) );
 		add_filter( 'manage_users_custom_column', array( __CLASS__, 'manage_users_custom_column' ), 10, 3 );
+		add_action( 'user_profile_update_errors', array( __CLASS__, 'action_user_profile_update_errors' ) );
 
 		/**
 		 * Keep track of all the user sessions for which we need to invalidate the
@@ -391,6 +392,25 @@ private static function add_error( WP_Error $error ) {
 		self::$profile_errors[ $error->get_error_code() ] = $error;
 	}
 
+	/**
+	 * Attach Two-Factor profile errors to WordPress core profile update errors.
+	 *
+	 * @since NEXT
+	 *
+	 * @param WP_Error $errors WP_Error object passed by core.
+	 *
+	 * @return void
+	 */
+	public static function action_user_profile_update_errors( WP_Error $errors ) {
+		foreach ( self::$profile_errors as $profile_error ) {
+			foreach ( $profile_error->get_error_codes() as $code ) {
+				foreach ( $profile_error->get_error_messages( $code ) as $message ) {
+					$errors->add( $code, $message );
+				}
+			}
+		}
+	}
+
 	/**
 	 * Check if the debug mode is enabled.
 	 * 

From 7ebde70eb8fc145c193a6cee23af852396cf14b9 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 12:29:08 +0200
Subject: [PATCH 09/19] Pass along our errors

---
 class-two-factor-core.php | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index ff26b27c..e6cbdc58 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2252,6 +2252,7 @@ public static function user_two_factor_options_update( $user_id ) {
 			$providers          = self::get_supported_providers_for_user( $user_id );
 			$enabled_providers  = $_POST[ self::ENABLED_PROVIDERS_USER_META_KEY ];
 			$existing_providers = self::get_enabled_providers_for_user( $user_id );
+			$provider_errors    = new WP_Error();
 
 			// Enable only the available providers.
 			$enabled_providers = array_intersect_key( $providers, array_flip( $enabled_providers ) );
@@ -2259,11 +2260,26 @@ public static function user_two_factor_options_update( $user_id ) {
 			// Ensure the enabled providers are configured and can be enabled.
 			foreach ( $enabled_providers as $provider_key => $provider ) {
 				if ( ! $provider->is_available_for_user( $user ) ) {
-					// TODO: Use the `user_profile_update_errors` filter to show these errors too.
 					unset( $enabled_providers[ $provider_key ] );
+
+					$provider_errors->add(
+						'two_factor_provider_not_configured_' . $provider_key,
+						sprintf(
+							/* translators: %s: provider label. */
+							__( 'The %s method must be configured before it can be enabled.', 'two-factor' ),
+							esc_html( $provider->get_label() )
+						),
+						[
+							'provider' => $provider_key,
+						]
+					);
 				}
 			}
 
+			if ( $provider_errors->has_errors() ) {
+				self::add_error( $provider_errors );
+			}
+
 			update_user_meta( $user_id, self::ENABLED_PROVIDERS_USER_META_KEY, array_keys( $enabled_providers ) );
 
 			// Primary provider must be enabled.

From 93c16c4aae378076f264e494c8aabf2e66328b63 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 13:03:59 +0200
Subject: [PATCH 10/19] Describe the return type

---
 class-two-factor-core.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index e6cbdc58..fb788b7c 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -275,7 +275,7 @@ private static function get_providers_classes( $providers ) {
 	 *
 	 * @since 0.2.0
 	 *
-	 * @return array
+	 * @return Two_Factor_Provider[]
 	 */
 	public static function get_providers() {
 		$providers = self::get_default_providers();

From 3badf513fe16d23b32c02bb033ac38640417a006 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 13:05:41 +0200
Subject: [PATCH 11/19] Introduce our own error API

---
 class-two-factor-core.php | 86 +++++++++++++++++++++++++++++++++------
 1 file changed, 73 insertions(+), 13 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index fb788b7c..c6538288 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -1984,8 +1984,6 @@ public static function manage_users_custom_column( $output, $column_name, $user_
 	 * @param WP_User $user WP_User object of the logged-in user.
 	 */
 	public static function user_two_factor_options( $user ) {
-		$notices = array();
-
 		$providers = self::get_supported_providers_for_user( $user );
 
 		wp_enqueue_style( 'user-edit-2fa', plugins_url( 'user-edit.css', __FILE__ ), array(), TWO_FACTOR_VERSION );
@@ -2002,29 +2000,55 @@ public static function user_two_factor_options( $user ) {
 				self::get_user_two_factor_revalidate_url()
 			);
 
-			$notices['warning two-factor-warning-revalidate-session'] = sprintf(
-				esc_html__( 'To update your Two-Factor options, you must first revalidate your session.', 'two-factor' ) .
-					' <a class="button" href="%s">' . esc_html__( 'Revalidate now', 'two-factor' ) . '</a>',
-				esc_url( $url )
+			self::add_error(
+				new WP_Error(
+					'two_factor_revalidate_session',
+					sprintf(
+						__( 'To update your Two-Factor options, you must first revalidate your session.', 'two-factor' ) .
+						' <a class="button" href="%s">' . esc_html__( 'Revalidate now', 'two-factor' ) . '</a>',
+						esc_url( $url )
+					),
+					[
+						'type' => 'warning'
+					]
+				)
 			);
 		}
 
 		if ( empty( $providers ) ) {
-			$notices['notice two-factor-notice-no-providers-supported'] = esc_html__( 'No providers are available for your account.', 'two-factor' );
+			self::add_error(
+				new WP_Error(
+					'two_factor_no_providers_supported',
+					__( 'No providers are available for your account.', 'two-factor' ),
+					[
+						'type' => 'notice'
+					]
+				)
+			);
 		}
 
 		// Suggest enabling a backup method if only one method is enabled and there are more available.
 		if ( count( $providers ) > 1 && 1 === count( $enabled_providers ) ) {
-			$notices['warning two-factor-warning-suggest-backup'] = esc_html__( 'To prevent being locked out of your account, consider enabling a backup method like Recovery Codes in case you lose access to your primary authentication method.', 'two-factor' );
+			self::add_error(
+				new WP_Error(
+					'two_factor_suggest_backup',
+					__( 'To prevent being locked out of your account, consider enabling a backup method like Recovery Codes in case you lose access to your primary authentication method.', 'two-factor' ),
+					[
+						'type' => 'warning'
+					]
+				)
+			);
 		}
+
+		$generic_errors = array_filter(
+			self::$profile_errors,
+			static fn ( $error ) => ! array_key_exists( 'provider', $error->get_error_data() )
+		);
+
 		?>
 		<h2><?php esc_html_e( 'Two-Factor Options', 'two-factor' ); ?></h2>
 
-		<?php foreach ( $notices as $notice_type => $notice ) : ?>
-		<div class="<?php echo esc_attr( $notice_type ? 'notice inline notice-' . $notice_type : '' ); ?>">
-			<p><?php echo wp_kses_post( $notice ); ?></p>
-		</div>
-		<?php endforeach; ?>
+		<?php self::render_errors( $generic_errors ); ?>
 
 		<fieldset id="two-factor-options" <?php echo $show_2fa_options ? '' : 'disabled="disabled"'; ?>>
 		<?php
@@ -2072,6 +2096,23 @@ private static function get_recommended_providers( $user ) {
 		return (array) apply_filters( 'two_factor_recommended_providers', $providers, $user );
 	}
 
+	/**
+	 * Render WP errors.
+	 *
+	 * @param WP_Error[] $errors List of errors to render.
+	 */
+	private static function render_errors( array $errors ) {
+		foreach ( $errors as $error ) {
+			wp_admin_notice(
+				implode( '</p><p>', $error->get_error_messages() ),
+				array(
+					'type' => $error->get_error_data()['type'] ?? 'error',
+					'additional_classes' => [ 'inline' ],
+				)
+			);
+		}
+	}
+
 	/**
 	 * Render the user settings.
 	 * 
@@ -2109,6 +2150,7 @@ private static function render_user_providers_form( $user, $providers ) {
 				<tr>
 					<th><?php echo esc_html( $object->get_label() ); ?></th>
 					<td>
+						<?php self::render_errors( self::get_provider_errors( $provider_key ) ); ?>
 						<label class="two-factor-method-label">
 							<input id="enabled-<?php echo esc_attr( $provider_key ); ?>" type="checkbox" name="<?php echo esc_attr( self::ENABLED_PROVIDERS_USER_META_KEY ); ?>[]" value="<?php echo esc_attr( $provider_key ); ?>" <?php checked( isset( $available_providers[ $provider_key ] ) ); ?> />
 							<?php /* translators: %s: authentication method name. */ ?>
@@ -2157,6 +2199,24 @@ private static function render_user_providers_form( $user, $providers ) {
 		<?php
 	}
 
+	/**
+	 * Get the errors marked for a specific provider.
+	 *
+	 * @param string $provider_key The provider key to get errors for.
+	 *
+	 * @return WP_Error[] List of errors for the provider.
+	 */
+	private static function get_provider_errors( string $provider_key ) {
+		return array_filter(
+			self::$profile_errors,
+			static function ( $error ) use ( $provider_key ) {
+				$error_data = $error->get_error_data();
+
+				return isset( $error_data['provider'] ) && $provider_key === $error_data['provider'];
+			}
+		);
+	}
+
 	/**
 	 * Enable a provider for a user.
 	 *

From 6a52da86ea7e41b9e2f7a4f1554da8b881908d11 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 13:32:01 +0200
Subject: [PATCH 12/19] Ensure there are errors to render

---
 class-two-factor-core.php | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index c6538288..701a2d70 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2103,13 +2103,15 @@ private static function get_recommended_providers( $user ) {
 	 */
 	private static function render_errors( array $errors ) {
 		foreach ( $errors as $error ) {
-			wp_admin_notice(
-				implode( '</p><p>', $error->get_error_messages() ),
-				array(
-					'type' => $error->get_error_data()['type'] ?? 'error',
-					'additional_classes' => [ 'inline' ],
-				)
-			);
+			if ( is_wp_error( $error ) && $error->has_errors() ) {
+				wp_admin_notice(
+					implode( '</p><p>', $error->get_error_messages() ),
+					array(
+						'type' => $error->get_error_data()['type'] ?? 'error',
+						'additional_classes' => [ 'inline' ],
+					)
+				);
+			}
 		}
 	}
 

From f434e31c1f88e61530c991307b5ffc7a7d9dde67 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 13:32:25 +0200
Subject: [PATCH 13/19] Add an error per provider

---
 class-two-factor-core.php | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 701a2d70..9b95ffca 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2314,7 +2314,6 @@ public static function user_two_factor_options_update( $user_id ) {
 			$providers          = self::get_supported_providers_for_user( $user_id );
 			$enabled_providers  = $_POST[ self::ENABLED_PROVIDERS_USER_META_KEY ];
 			$existing_providers = self::get_enabled_providers_for_user( $user_id );
-			$provider_errors    = new WP_Error();
 
 			// Enable only the available providers.
 			$enabled_providers = array_intersect_key( $providers, array_flip( $enabled_providers ) );
@@ -2324,24 +2323,22 @@ public static function user_two_factor_options_update( $user_id ) {
 				if ( ! $provider->is_available_for_user( $user ) ) {
 					unset( $enabled_providers[ $provider_key ] );
 
-					$provider_errors->add(
-						'two_factor_provider_not_configured_' . $provider_key,
-						sprintf(
-							/* translators: %s: provider label. */
-							__( 'The %s method must be configured before it can be enabled.', 'two-factor' ),
-							esc_html( $provider->get_label() )
-						),
-						[
-							'provider' => $provider_key,
-						]
+					self::add_error(
+						new WP_Error(
+							'two_factor_provider_not_configured_' . $provider_key,
+							sprintf(
+								/* translators: %s: provider label. */
+								__( 'The %s method must be configured before it can be enabled.', 'two-factor' ),
+								esc_html( $provider->get_label() )
+							),
+							[
+								'provider' => $provider_key,
+							]
+						)
 					);
 				}
 			}
 
-			if ( $provider_errors->has_errors() ) {
-				self::add_error( $provider_errors );
-			}
-
 			update_user_meta( $user_id, self::ENABLED_PROVIDERS_USER_META_KEY, array_keys( $enabled_providers ) );
 
 			// Primary provider must be enabled.

From 2f6316d10a16347f514365834fd77c33fed3f912 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 13:39:03 +0200
Subject: [PATCH 14/19] Type inputs

---
 class-two-factor-core.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 9b95ffca..35c54ec3 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2042,7 +2042,7 @@ public static function user_two_factor_options( $user ) {
 
 		$generic_errors = array_filter(
 			self::$profile_errors,
-			static fn ( $error ) => ! array_key_exists( 'provider', $error->get_error_data() )
+			static fn ( WP_Error $error ) => ! array_key_exists( 'provider', $error->get_error_data() )
 		);
 
 		?>
@@ -2211,11 +2211,11 @@ private static function render_user_providers_form( $user, $providers ) {
 	private static function get_provider_errors( string $provider_key ) {
 		return array_filter(
 			self::$profile_errors,
-			static function ( $error ) use ( $provider_key ) {
-				$error_data = $error->get_error_data();
+			static function ( WP_Error $error ) use ( $provider_key ) {
+				$error_data = $error->get_error_data(); // This currently supports only one error per instance.
 
-				return isset( $error_data['provider'] ) && $provider_key === $error_data['provider'];
-			}
+				return isset( $error_data['provider'] ) && $error_data['provider'] === $provider_key;
+			 },
 		);
 	}
 

From 1a7853dd3034450e23bb1d57c704beedc71ee6e2 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 13:42:31 +0200
Subject: [PATCH 15/19] Per linter

---
 class-two-factor-core.php | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 35c54ec3..31cfcda8 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2008,9 +2008,9 @@ public static function user_two_factor_options( $user ) {
 						' <a class="button" href="%s">' . esc_html__( 'Revalidate now', 'two-factor' ) . '</a>',
 						esc_url( $url )
 					),
-					[
-						'type' => 'warning'
-					]
+					array(
+						'type' => 'warning',
+					)
 				)
 			);
 		}
@@ -2020,9 +2020,9 @@ public static function user_two_factor_options( $user ) {
 				new WP_Error(
 					'two_factor_no_providers_supported',
 					__( 'No providers are available for your account.', 'two-factor' ),
-					[
-						'type' => 'notice'
-					]
+					array(
+						'type' => 'notice',
+					)
 				)
 			);
 		}
@@ -2033,9 +2033,9 @@ public static function user_two_factor_options( $user ) {
 				new WP_Error(
 					'two_factor_suggest_backup',
 					__( 'To prevent being locked out of your account, consider enabling a backup method like Recovery Codes in case you lose access to your primary authentication method.', 'two-factor' ),
-					[
-						'type' => 'warning'
-					]
+					array(
+						'type' => 'warning',
+					)
 				)
 			);
 		}
@@ -2107,8 +2107,8 @@ private static function render_errors( array $errors ) {
 				wp_admin_notice(
 					implode( '</p><p>', $error->get_error_messages() ),
 					array(
-						'type' => $error->get_error_data()['type'] ?? 'error',
-						'additional_classes' => [ 'inline' ],
+						'type'               => $error->get_error_data()['type'] ?? 'error',
+						'additional_classes' => array( 'inline' ),
 					)
 				);
 			}
@@ -2208,14 +2208,14 @@ private static function render_user_providers_form( $user, $providers ) {
 	 *
 	 * @return WP_Error[] List of errors for the provider.
 	 */
-	private static function get_provider_errors( string $provider_key ) {
+	private static function get_provider_errors( string $provider_key ): array {
 		return array_filter(
 			self::$profile_errors,
 			static function ( WP_Error $error ) use ( $provider_key ) {
 				$error_data = $error->get_error_data(); // This currently supports only one error per instance.
 
 				return isset( $error_data['provider'] ) && $error_data['provider'] === $provider_key;
-			 },
+			},
 		);
 	}
 
@@ -2331,9 +2331,9 @@ public static function user_two_factor_options_update( $user_id ) {
 								__( 'The %s method must be configured before it can be enabled.', 'two-factor' ),
 								esc_html( $provider->get_label() )
 							),
-							[
+							array(
 								'provider' => $provider_key,
-							]
+							)
 						)
 					);
 				}

From 8d1c840fb2680d3e739c80fe84a7e32f37f02024 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 13:53:46 +0200
Subject: [PATCH 16/19] This is actually different from all others

---
 class-two-factor-core.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 31cfcda8..34acd9e5 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -608,7 +608,7 @@ public static function fetch_user( $user = null ) {
 	 *
 	 * @param int|WP_User $user Optional. User ID, or WP_User object of the the user. Defaults to current user.
 	 *
-	 * @return Two_Factor_Provider[] List of provider instances indexed by provider key.
+	 * @return string[] List of keys of enabled providers for the user.
 	 */
 	public static function get_enabled_providers_for_user( $user = null ) {
 		$user = self::fetch_user( $user );
@@ -642,6 +642,7 @@ public static function get_enabled_providers_for_user( $user = null ) {
 	 * @see Two_Factor_Core::get_enabled_providers_for_user()
 	 *
 	 * @param int|WP_User $user Optional. User ID, or WP_User object of the the user. Defaults to current user.
+	 *
 	 * @return Two_Factor_Provider[] List of provider instances indexed by provider key.
 	 */
 	public static function get_available_providers_for_user( $user = null ) {

From a5397aa23652cf159bd22abb112b445c01b7ccdd Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 14:03:36 +0200
Subject: [PATCH 17/19] Per linter

---
 class-two-factor-core.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 34acd9e5..a53c2531 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2043,7 +2043,10 @@ public static function user_two_factor_options( $user ) {
 
 		$generic_errors = array_filter(
 			self::$profile_errors,
-			static fn ( WP_Error $error ) => ! array_key_exists( 'provider', $error->get_error_data() )
+			static function ( WP_Error $error ) {
+				$error_data = $error->get_error_data();
+				return ! empty( $error_data['provider'] ); // Where the associated provider is not set.
+			}
 		);
 
 		?>

From fdec4b0810b9da080be97d357aedf86ff917d100 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 14:05:09 +0200
Subject: [PATCH 18/19] Per linter

---
 class-two-factor-core.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index a53c2531..339f30ec 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -2219,7 +2219,7 @@ static function ( WP_Error $error ) use ( $provider_key ) {
 				$error_data = $error->get_error_data(); // This currently supports only one error per instance.
 
 				return isset( $error_data['provider'] ) && $error_data['provider'] === $provider_key;
-			},
+			}
 		);
 	}
 

From 9707660481cf966f0c74cd6523d9132e4036cad5 Mon Sep 17 00:00:00 2001
From: Kaspars Dambis <hi@kaspars.net>
Date: Tue, 17 Feb 2026 14:16:08 +0200
Subject: [PATCH 19/19] Per phpstan this is always WP_Error

---
 class-two-factor-core.php | 86 +++++++++++++++++++--------------------
 1 file changed, 43 insertions(+), 43 deletions(-)

diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index 339f30ec..c38ed8d1 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -145,7 +145,7 @@ public static function add_hooks( $compat ) {
 
 	/**
 	 * Delete all plugin data on uninstall.
-	 * 
+	 *
 	 * @since 0.10.0
 	 *
 	 * @return void
@@ -213,7 +213,7 @@ public static function uninstall() {
 
 	/**
 	 * Get the registered providers of which some might not be enabled.
-	 * 
+	 *
 	 * @since 0.11.0
 	 *
 	 * @return array List of provider keys and paths to class files.
@@ -230,7 +230,7 @@ private static function get_default_providers() {
 
 	/**
 	 * Get the classnames for specific providers.
-	 * 
+	 *
 	 * @since 0.10.0
 	 *
 	 * @param array $providers List of paths to provider class files indexed by class names.
@@ -320,7 +320,7 @@ public static function get_providers() {
 
 	/**
 	 * Get providers available for user which may not be enabled or configured.
-	 * 
+	 *
 	 * @since 0.13.0
 	 *
 	 * @see Two_Factor_Core::get_enabled_providers_for_user()
@@ -345,7 +345,7 @@ public static function get_supported_providers_for_user( $user = null ) {
 
 	/**
 	 * Enable the dummy method only during debugging.
-	 * 
+	 *
 	 * @since 0.5.2
 	 *
 	 * @param array $methods List of enabled methods.
@@ -413,7 +413,7 @@ public static function action_user_profile_update_errors( WP_Error $errors ) {
 
 	/**
 	 * Check if the debug mode is enabled.
-	 * 
+	 *
 	 * @since 0.5.2
 	 *
 	 * @return boolean
@@ -427,7 +427,7 @@ protected static function is_wp_debug() {
 	 *
 	 * Fetch this from the plugin core after we introduce proper dependency injection
 	 * and get away from the singletons at the provider level (should be handled by core).
-	 * 
+	 *
 	 * @since 0.5.2
 	 *
 	 * @param integer $user_id User ID.
@@ -449,7 +449,7 @@ protected static function get_user_settings_page_url( $user_id ) {
 
 	/**
 	 * Get the URL for resetting the secret token.
-	 * 
+	 *
 	 * @since 0.5.2
 	 *
 	 * @param integer $user_id User ID.
@@ -472,7 +472,7 @@ public static function get_user_update_action_url( $user_id, $action ) {
 
 	/**
 	 * Get the two-factor revalidate URL.
-	 * 
+	 *
 	 * @since 0.9.0
 	 *
 	 * @param bool $interim If the URL should load the interim login iframe modal.
@@ -491,7 +491,7 @@ public static function get_user_two_factor_revalidate_url( $interim = false ) {
 
 	/**
 	 * Check if a user action is valid.
-	 * 
+	 *
 	 * @since 0.5.2
 	 *
 	 * @param integer $user_id User ID.
@@ -514,7 +514,7 @@ public static function is_valid_user_action( $user_id, $action ) {
 
 	/**
 	 * Get the ID of the user being edited.
-	 * 
+	 *
 	 * @since 0.5.2
 	 *
 	 * @return integer
@@ -535,7 +535,7 @@ public static function current_user_being_edited() {
 	/**
 	 * Trigger our custom update action if a valid
 	 * action request is detected and passes the nonce check.
-	 * 
+	 *
 	 * @since 0.5.2
 	 *
 	 * @return void
@@ -559,7 +559,7 @@ public static function trigger_user_settings_action() {
 	/**
 	 * Keep track of all the authentication cookies that need to be
 	 * invalidated before the second factor authentication.
-	 * 
+	 *
 	 * @since 0.5.1
 	 *
 	 * @param string $cookie Cookie string.
@@ -600,7 +600,7 @@ public static function fetch_user( $user = null ) {
 	/**
 	 * Get two-factor providers that are enabled for the specified (or current) user
 	 * but might not be configured, yet.
-	 * 
+	 *
 	 * @since 0.2.0
 	 *
 	 * @see Two_Factor_Core::get_supported_providers_for_user()
@@ -635,7 +635,7 @@ public static function get_enabled_providers_for_user( $user = null ) {
 	/**
 	 * Get all two-factor providers that are both enabled and configured
 	 * for the specified (or current) user.
-	 * 
+	 *
 	 * @since 0.2.0
 	 *
 	 * @see Two_Factor_Core::get_supported_providers_for_user()
@@ -666,7 +666,7 @@ public static function get_available_providers_for_user( $user = null ) {
 
 	/**
 	 * Fetch the provider for the request based on the user preferences.
-	 * 
+	 *
 	 * @since 0.9.0
 	 *
 	 * @param int|WP_User        $user Optional. User ID, or WP_User object of the the user. Defaults to current user.
@@ -705,7 +705,7 @@ public static function get_provider_for_user( $user = null, $preferred_provider
 	/**
 	 * Get the name of the primary provider selected by the user
 	 * and enabled for the user.
-	 * 
+	 *
 	 * @since 0.12.0
 	 *
 	 * @param WP_User|int $user User ID or instance.
@@ -811,7 +811,7 @@ public static function wp_login( $user_login, $user ) {
 	 * Is there a better way of finding the current session token without
 	 * having access to the authentication cookies which are just being set
 	 * on the first password-based authentication request.
-	 * 
+	 *
 	 * @since 0.5.1
 	 *
 	 * @param \WP_User $user User object.
@@ -830,7 +830,7 @@ public static function destroy_current_session_for_user( $user ) {
 	 * Trigget the two-factor workflow only for valid login attempts
 	 * with username present. Prevent authentication during API requests
 	 * unless explicitly enabled for the user (disabled by default).
-	 * 
+	 *
 	 * @since 0.4.0
 	 *
 	 * @param WP_User|WP_Error $user Valid WP_User only if the previous filters
@@ -865,7 +865,7 @@ public static function filter_authenticate( $user, $username, $password ) {
 	 * If the user can login via API requests such as XML-RPC and REST.
 	 *
 	 * Only logins with application passwords are permitted by default.
-	 * 
+	 *
 	 * @since 0.4.0
 	 *
 	 * @param integer $user_id User ID.
@@ -889,7 +889,7 @@ public static function is_user_api_login_enabled( $user_id ) {
 
 	/**
 	 * Is the current request an XML-RPC or REST request.
-	 * 
+	 *
 	 * @since 0.4.0
 	 *
 	 * @return boolean
@@ -930,7 +930,7 @@ public static function show_two_factor_login( $user ) {
 
 	/**
 	 * Displays a message informing the user that their account has had failed login attempts.
-	 * 
+	 *
 	 * @since 0.8.0
 	 *
 	 * @param WP_User $user WP_User object of the logged-in user.
@@ -963,7 +963,7 @@ public static function maybe_show_last_login_failure_notice( $user ) {
 	 *
 	 * They were also sent an email notification in `send_password_reset_email()`, but email sent from a typical
 	 * web server is not reliable enough to trust completely.
-	 * 
+	 *
 	 * @since 0.8.0
 	 *
 	 * @param WP_Error $errors Error object.
@@ -1008,7 +1008,7 @@ public static function maybe_show_reset_password_notice( $errors ) {
 
 	/**
 	 * Clear the password reset notice after the user resets their password.
-	 * 
+	 *
 	 * @since 0.8.0
 	 *
 	 * @param WP_User $user User object.
@@ -1183,7 +1183,7 @@ function() {
 
 	/**
 	 * Generate the two-factor login form URL.
-	 * 
+	 *
 	 * @since 0.3.0
 	 *
 	 * @param  array  $params List of query argument pairs to add to the URL.
@@ -1214,7 +1214,7 @@ public static function login_url( $params = array(), $scheme = 'login' ) {
 
 	/**
 	 * Get the hash of a nonce for storage and comparison.
-	 * 
+	 *
 	 * @since 0.7.2
 	 *
 	 * @param array $nonce Nonce array to be hashed. ⚠️ This must contain user ID and expiration,
@@ -1322,7 +1322,7 @@ public static function verify_login_nonce( $user_id, $nonce ) {
 	 *
 	 * This implements an increasing backoff, requiring an attacker to wait longer
 	 * each time to attempt to brute-force the login.
-	 * 
+	 *
 	 * @since 0.8.0
 	 *
 	 * @param WP_User $user The user being operated upon.
@@ -1714,7 +1714,7 @@ public static function _login_form_revalidate_2fa( $nonce = '', $provider = '',
 
 	/**
 	 * Process the 2FA provider authentication.
-	 * 
+	 *
 	 * @since 0.9.0
 	 *
 	 * @param object  $provider        The Two Factor Provider.
@@ -1834,7 +1834,7 @@ public static function reset_compromised_password( $user ) {
 
 	/**
 	 * Notify the user and admin that a password was reset for being compromised.
-	 * 
+	 *
 	 * @since 0.8.0
 	 *
 	 * @param WP_User $user The user whose password should be reset.
@@ -1858,7 +1858,7 @@ public static function send_password_reset_emails( $user ) {
 
 	/**
 	 * Notify the user that their password has been compromised and reset.
-	 * 
+	 *
 	 * @since 0.8.0
 	 *
 	 * @param WP_User $user The user to notify.
@@ -1888,7 +1888,7 @@ public static function notify_user_password_reset( $user ) {
 
 	/**
 	 * Notify the admin that a user's password was compromised and reset.
-	 * 
+	 *
 	 * @since 0.8.0
 	 *
 	 * @param WP_User $user The user whose password was reset.
@@ -1920,7 +1920,7 @@ public static function notify_admin_user_password_reset( $user ) {
 
 	/**
 	 * Show the password reset error when on the login screen.
-	 * 
+	 *
 	 * @since 0.8.0
 	 */
 	public static function show_password_reset_error() {
@@ -1940,7 +1940,7 @@ public static function show_password_reset_error() {
 
 	/**
 	 * Filter the columns on the Users admin screen.
-	 * 
+	 *
 	 * @since 0.2.0
 	 *
 	 * @param  array $columns Available columns.
@@ -1953,7 +1953,7 @@ public static function filter_manage_users_columns( array $columns ) {
 
 	/**
 	 * Output the 2FA column data on the Users screen.
-	 * 
+	 *
 	 * @since 0.2.0
 	 *
 	 * @param  string $output      The column output.
@@ -2078,7 +2078,7 @@ static function ( WP_Error $error ) {
 
 	/**
 	 * Get the recommended providers for a user.
-	 * 
+	 *
 	 * @since 0.14.0
 	 *
 	 * @param WP_User $user User instance.
@@ -2107,7 +2107,7 @@ private static function get_recommended_providers( $user ) {
 	 */
 	private static function render_errors( array $errors ) {
 		foreach ( $errors as $error ) {
-			if ( is_wp_error( $error ) && $error->has_errors() ) {
+			if ( $error->has_errors() ) {
 				wp_admin_notice(
 					implode( '</p><p>', $error->get_error_messages() ),
 					array(
@@ -2121,7 +2121,7 @@ private static function render_errors( array $errors ) {
 
 	/**
 	 * Render the user settings.
-	 * 
+	 *
 	 * @since 0.13.0
 	 *
 	 * @param WP_User $user User instance.
@@ -2227,7 +2227,7 @@ static function ( WP_Error $error ) use ( $provider_key ) {
 	 * Enable a provider for a user.
 	 *
 	 * The caller is responsible for checking the user has permission to do this.
-	 * 
+	 *
 	 * @since 0.8.0
 	 *
 	 * @param int    $user_id      The ID of the user.
@@ -2260,7 +2260,7 @@ public static function enable_provider_for_user( $user_id, $new_provider ) {
 	 * `get_primary_provider_for_user()` will pick a new one automatically.
 	 *
 	 * The caller is responsible for checking the user has permission to do this.
-	 * 
+	 *
 	 * @since 0.9.0
 	 *
 	 * @param int    $user_id            The ID of the user.
@@ -2397,7 +2397,7 @@ public static function user_two_factor_options_update( $user_id ) {
 	 * Update the current user session metadata.
 	 *
 	 * Any values set in $data that are null will be removed from the user session metadata.
-	 * 
+	 *
 	 * @since 0.9.0
 	 *
 	 * @param array $data The data to append/remove from the current session.
@@ -2426,7 +2426,7 @@ public static function update_current_user_session( $data = array() ) {
 
 	/**
 	 * Fetch the current user session metadata.
-	 * 
+	 *
 	 * @since 0.9.0
 	 *
 	 * @return false|array The session array, false on error.
@@ -2445,7 +2445,7 @@ public static function get_current_user_session() {
 
 	/**
 	 * Should the login session persist between sessions.
-	 * 
+	 *
 	 * @since 0.5.0
 	 *
 	 * @return boolean
@@ -2466,7 +2466,7 @@ public static function rememberme() {
 	 * This is required as WordPress creates a new session when the user password is changed.
 	 *
 	 * @see https://core.trac.wordpress.org/ticket/58427
-	 * 
+	 *
 	 * @since 0.9.0
 	 *
 	 * @param array $session The Session information.