Admin Account Security Best Practices?

Thanks to you all for taking the time as these are helpful responses.

So, it looks like 2FA is always a good idea, and if all goes south at least I have SSH access. Makes sense.

Also,

You are absolutely correct. I did set up an Admin and I was posting from that, not from system. My mistake.

Does anyone know if you can change a setting to NOT allow username logins (ie. and require email)?

Thanks again.