Two-factor authentication is a pain, but I recommend it. Over at iMore, Serenity Caldwell has rounded up all their guides to turning on two-factor on various services.
With two-factor turned on, even if someone else has your password, they can’t gain access to your accounts. That’s because they need a second factor, generally a string of digits generated by an app on your phone.
Like I said, it’s a pain. But you should still probably turn it on.