Two-factor authentication adds a code to your sign-in so a stolen password is not enough.
Turn it on in Settings, then Account, then Security. Follow the steps to link an authenticator app and save your backup codes somewhere safe.
If you lose your phone, use a backup code. If you have none, contact support; we will need to verify your identity before turning it off.