Two-factor authentication becomes required

Every account now needs two-factor authentication: an authenticator app or a passkey. You have 14 days to turn it on under Settings → Password and authentication; a reminder shows until you do. After that, the security settings are the only page that opens until it is on.

Public forms are also better protected against spam, and every page sends stricter security headers.