fix: reword mixed-audience login failure notice to be informational

[dknauss]

Companion to PR #917 and PR #921. Fixes #919.

What changed

maybe_show_last_login_failure_notice() in class-two-factor-core.php.

Before:

WARNING: Your account has attempted to login %1$s times without providing a valid two factor token. The last failed login occurred %2$s ago. If this wasn't you, you should reset your password.

After:

%1$s failed verification code attempts on this account. The last attempt was %2$s ago. If you did not make these attempts, review your account security after logging in.

Why each change

Remove "WARNING:" — same rationale as PR #921: a severity prefix for a temporary informational notice is alarming and inappropriate.

Remove "If this wasn't you" — the notice is shown on the 2FA form, after the user has already entered the correct password. That reader is either the legitimate account owner (who mistyped a code) or someone who knows the password. Either way, "if this wasn't you" frames a known-password holder as a potential stranger to their own account, which is disorienting.

Remove "you should reset your password" — the failed attempts were 2FA failures, not password failures. Resetting the password doesn't protect an account whose password is already known. The appropriate action (review sessions, rotate 2FA credentials) belongs after login, so the new text says so.

"attempted to login … without providing a valid two factor token" → "failed verification code attempt on this account" — shorter, plain-language phrasing that doesn't require the user to parse "two factor token" to understand what happened.

Tests

Two tests updated/added (185 total, all passing):

• test_maybe_show_last_login_failure_notice — updated string assertions to match new text
• test_login_failure_notice_language_is_calm_and_informational — new test asserting absence of WARNING, wasn't you, and reset your password; asserts presence of failed verification code and review your account security

Not addressed here

This notice is only shown when there is no rate-limit error already displayed (see the elseif condition in login_html()). The rate-limit error message itself was addressed in PR #921.

🤖 Assisted by Claude Code

Try in Playground

What you'll see: The 2FA email code entry form with the updated failure notice above it. This notice is distinct from the rate-limit error in PR #921 — it appears after the rate-limit window has passed (or when there were prior failures but no current lockout). The code entry form and Resend Code button are present and functional.

What to test manually:

• Compare the notice text to the "Before" in this PR: no WARNING:, no "if this wasn't you", no "reset your password"
• The notice is factual and deferred — it tells the account holder what happened and where to act (after login), rather than alarming them mid-login
• To see the notice without a lockout error: the demo seeds 3 failed attempts 5 minutes ago, past the rate-limit window, so login_html() takes the elseif branch that shows this notice but not the rate-limit error from PR Improve rate-limit UX: calm error message and hide resend button during lockout #921

Technical: Installs the plugin from this PR branch (dknauss/two-factor@ux/notice-mixed-audience) via GitHub archive zip through the Playground CORS proxy — live patch code. A mu-plugin shim sets up a demo user with 3 failed verification attempts recorded 5 minutes ago, then calls Two_Factor_Core::login_html() directly, landing at /wp-login.php?action=two_factor_notice_demo.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: dknauss <dpknauss@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.