Let people log in without solving a puzzle, transcribing a code, or memorising anything. Don't block password managers, allow paste, and offer a method that needs no cognitive function test.
WCAG 3.3.8 — Accessible Authentication (Minimum) (Level AA)
WCAG 3.3.9 — Accessible Authentication (Enhanced) (Level AAA)