Improve rate-limit UX: calm error message and hide resend button during lockout

[dknauss]

Companion to PR #917. Addresses #918 and #920.

What changed

Error message wording (class-two-factor-core.php)

Before:

ERROR: Too many invalid verification codes, you can try again in %s. This limit protects your account against automated attacks.

After:

Too many incorrect verification codes. Please wait %s and reload this page to try again.

The old message used an ERROR: severity prefix appropriate for system failures, not a temporary delay. "Automated attacks" frames a lockout caused by mistyped codes as a security incident, which is alarming and inaccurate for the legitimate user almost always reading it. The new message is calm, drops the attack framing, and tells the user what to do (wait and reload).

Resend Code button (providers/class-two-factor-email.php)

authentication_page() now checks Two_Factor_Core::is_user_rate_limited() before rendering the resend button and the "A verification code has been sent" prompt. While rate-limited, both are suppressed.

Showing an interactive resend button during a lockout implied it would work. Clicking it only returned the same rate-limit error. The button reappears normally once the lockout expires.

The rate-limit check in authentication_page() also prevents token regeneration while locked out — a user without a token will not receive a new email until the lockout expires and they reload.

Tests

Three new tests, all passing:

• test_rate_limit_error_message_is_calm_and_actionable — asserts no ERROR: prefix and no "automated attacks"
• test_authentication_page_hides_resend_button_when_rate_limited — asserts INPUT_NAME_RESEND_CODE absent from output
• test_authentication_page_does_not_send_email_when_rate_limited_and_no_token — asserts no email sent when called without a token during lockout

Not addressed here

Issue #919 (the "if this wasn't you, reset your password" warning that addresses two mutually exclusive audiences) is a separate concern affecting all providers, handled in PR #922.

Closes #918
Closes #920

Try it in Playground

Try this change in WordPress Playground — boots a locked-out 2FA login showing the calm rate-limit message with the Resend button suppressed.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: dknauss <dpknauss@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.