From your Security settings, click Enable two-factor authentication. Scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, or similar), then enter the 6-digit code it generates to confirm setup.
You'll be shown a set of one-time recovery codes - save them somewhere safe. Each one can be used once to sign in if you ever lose access to your authenticator app, and they're only ever shown at setup time.
Once enabled, every sign-in asks for your password first, then your 6-digit code (or a recovery code). You can regenerate recovery codes or disable two-factor authentication entirely from the same Security page.