Enable 2FA in Settings → Security. Scan the QR code (or enter the secret) in an authenticator app, then confirm with a 6-digit code.
On the next login you will enter that code after your password (or Google sign-in).
Invalid or expired login 2FA tokens send you back to sign in from the start.