https://blog.wpsec.com/2fa/
How to Break Into WordPress Installations, and How Implementing 2-Factor-Authentication Can Prevent It