Default Access Rules for VIP Sites

[kevinfodness]

• Enable login with WordPress.com
• Match by email address
• Enforce use of 2FA on WordPress.com accounts
• Enforce use of 2FA on site logins also
• Require login in order to access non-production environments

For Jetpack SSO auto-configuration, his would involve:

• filtering jetpack_sso_match_by_email and returning 1
• filtering jetpack_sso_require_two_step and returning 1
• filtering jetpack_active_modules and ensuring sso is in the list

We could go a step further and filter jetpack_remove_login_form to return true to force the use of WP.com accounts if we so desire (which could be disabled on a per-site basis, but the default security posture would be to force the use of WP.com accounts)