WordPress Secure Login Setup

I maintain a small WordPress site that houses my railroad club’s archival documents (fewer than 40 members). I now need a proper login system added so only registered club members can reach the protected area.

Here is what I need you to handle for me:

• Install and configure a free, reputable WordPress security plugin that lets me create individual usernames and passwords. I have looked at “All-in-One” and similar tools but I am happy to use whichever free solution you recommend.

• Activate protections against brute-force attacks—specifically rate-limiting failed login attempts and adding a CAPTCHA on the form.

• Enable two-factor authentication. I am open to email, SMS, phone call, or an authenticator-app approach; please explain the pros and cons and then set up whichever method we decide on.

Once the plugin is in place, I will take care of user onboarding, page restrictions, and any further customization. Your deliverable is a working, tested login flow with 2FA and lock-out safeguards, plus a short note outlining how to manage or adjust the settings later.

I look forward to your recommendations and a quick, secure implementation.