Time-based codes from apps like Google Authenticator | Passkeys/security keys, built-in device biometrics | Email or SMS codes | Recovery codes

Setting password expirations | Adding a CAPTCHA