You should indeed enable two factor authentication and not only on gmail. It is also good practice to enable account login notifications.