A password is no longer enough
Second factors, backup codes and account recovery: what to set up first.
Start with your main email
Your mailbox is often the recovery channel for other services, making it a good starting point. Set a separate, long password and enable multifactor authentication in the security settings.
Add a second factor
Multifactor authentication adds another check to your password. A service may offer an authenticator app, a hardware key or another method. Choose phishing-resistant options when available: an ordinary one-time code can also be captured on a fake page.
Plan for a lost phone
Keep backup codes in a protected location separate from your sign-in device. Review your recovery address and remove obsolete phone numbers. A prepared backup method is more convenient than emergency recovery; avoid disabling protection just for convenience.
Do not approve an unfamiliar login
Decline sign-in prompts you did not initiate. Do not give codes to someone claiming to be support. Open your account settings independently and review active sessions.