Mac security settings checklist: FileVault, firewall, updates and the rest
Three settings protect a Mac most: automatic updates, FileVault, and Gatekeeper left at its default so only App Store and identified developers' apps open. The firewall, login items and Find My take five more minutes.
By the editors of ProtectYour.com Last reviewed 6 min read
Affiliate disclosure: this guide links to Bitdefender. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money
Key takeaways
- Turn on automatic updates, turn on FileVault, and leave Gatekeeper at App Store and identified developers. Those three cover most real Mac threats.
- Macs with Apple silicon or a T2 chip encrypt the disk automatically, but FileVault is what ties it to your login password.
- Turn on the firewall under System Settings > Network > Firewall. It is off by default.
- Review Login Items & Extensions now and then: unwanted background items are a common sign of adware.
- Lockdown Mode is for people at risk of targeted spyware. Most people should not turn it on.
Before you start
Paths below follow Apple's Mac User Guide as of October 2026. All of them are in Apple menu > System Settings; if a pane has moved, use the search field at the top of the sidebar. You need to be an administrator for some of them. For the background on what macOS already protects against, see do Macs need antivirus?
1. Automatic updates
Go to System Settings > General > Software Update, click the info button next to Automatic updates, and turn on everything, including Install Security Responses and system files. Safari is updated with macOS, so a Mac that stays current keeps its browser current too. App Store apps update from the App Store; apps you downloaded elsewhere usually have a "Check for updates" item in their own menu. See Apple: Keep your Mac up to date.
Apple does not publish a fixed support period for Macs. If Software Update stops offering anything for months and your Mac cannot install the current macOS, check Apple's security releases page for your version and plan a replacement once fixes stop.
2. FileVault
Apple says Macs with Apple silicon or a T2 chip encrypt their data automatically, and turning on FileVault adds the requirement that your login password be entered before anyone can decrypt it. Older Macs need FileVault to be encrypted at all.
- Go to System Settings > Privacy & Security > FileVault and click Turn On.
- Choose how to get back into the disk if you forget your password: your iCloud account, or a recovery key. If you pick the key, store it somewhere other than the Mac (a password manager or a printed copy at home).
Apple is blunt about the risk: forget both your password and the recovery key and the files are lost forever. See Apple: Protect data on your Mac with FileVault.
3. Gatekeeper: keep the default
Gatekeeper checks that apps from outside the App Store are signed by an identified developer and notarized by Apple, meaning Apple scanned them for known malware. In System Settings > Privacy & Security, under Security, leave the setting for where apps may come from at the App Store and known developers (or the App Store only, if that is all you use).
The main way Macs get infected is a person overriding this warning, usually for a cracked app, a fake video player or a "Flash update". If a site gives you instructions to right-click and open an app anyway, or to paste a command into Terminal, stop. See Apple: Safely open apps on your Mac.
4. Turn on the firewall
The macOS firewall is off by default. It blocks unwanted incoming connections, which matters most on hotel, cafe and airport Wi-Fi. Go to System Settings > Network > Firewall and turn it on. The defaults are fine for most people; Options lets you block all incoming connections or turn on stealth mode if you want to go further. Turning on a sharing service such as File Sharing opens a way through, so switch off sharing services you do not use in General > Sharing. See Apple: Block connections with a firewall. Our public Wi-Fi guide covers the other habits.
5. Review login items and extensions
Go to System Settings > General > Login Items & Extensions. The top list is apps that open when you log in; the Allow in the Background list is helpers that run all the time. Adware and fake "Mac cleaner" tools tend to show up here. Turn off anything you do not recognise, then look it up before deleting the app. See Apple: Login Items & Extensions settings.
While you are in Privacy & Security, glance at Accessibility, Full Disk Access and Screen & System Audio Recording. Those permissions let an app see or control everything. Remote-support tools left over from a tech support scam often sit there.
6. Lock screen, Find My and your Apple Account
- Lock screen: in System Settings > Lock Screen, require your password immediately (or within a minute) after the screen saver starts or the display turns off.
- Touch ID: set it up in Touch ID & Password so a quick unlock does not tempt you to weaken the lock.
- Find My Mac: click your name at the top of System Settings, then iCloud, and make sure Find My Mac is on. Activation Lock comes with it.
- Apple Account: the same account protects your iPhone. Two-factor authentication, a recovery contact and, if you want, Advanced Data Protection are covered in our iPhone settings checklist.
7. Lockdown Mode, for the few who need it
Lockdown Mode limits web technologies, message attachments, accessory connections and more, to shrink what mercenary spyware can attack. Apple describes it as an extreme protection for the very few people who might be personally targeted. If that is you: System Settings > Privacy & Security > Lockdown Mode > Turn On, and turn it on for your iPhone and iPad too, since each device is separate. See Apple: About Lockdown Mode.
Do you need antivirus on a Mac?
macOS has built-in malware detection (XProtect), updated by Apple in the background, plus Gatekeeper and notarization. With the settings above, most people who install from the App Store and known developers do not need more. A security suite adds most for families sharing one Mac, people who download a lot of software from the web, and anyone who wants web filtering against scam and phishing sites in every browser.
Mac settings at a glance
| Setting | Where in System Settings | Protects against |
|---|---|---|
| Automatic updates | General > Software Update | Known flaws |
| FileVault | Privacy & Security > FileVault | Stolen Mac |
| Gatekeeper default | Privacy & Security | Malicious downloads |
| Firewall | Network > Firewall | Incoming connections on shared Wi-Fi |
| Login items review | General > Login Items & Extensions | Adware, leftover remote tools |
| Find My Mac | [your name] > iCloud | Lost or stolen Mac |
| Lockdown Mode | Privacy & Security | Targeted spyware (few people) |
Skip
Common questions
Should I turn on FileVault on my Mac?
Yes. Macs with Apple silicon or a T2 chip already encrypt their disk, and FileVault adds the requirement that your login password be entered to decrypt it. Turn it on in System Settings > Privacy & Security > FileVault and keep the recovery key somewhere other than the Mac.
Is the Mac firewall on by default?
No. The macOS firewall is off by default. Turn it on in System Settings > Network > Firewall. It blocks unwanted incoming connections, which matters most on public Wi-Fi, and the default options suit most people.
Do Macs need antivirus software?
Most people do not, if they keep macOS updated, leave Gatekeeper at its default and install apps only from the App Store and identified developers. macOS includes XProtect malware detection. A paid suite adds most for shared family Macs and heavy web downloaders.
What is Lockdown Mode on a Mac?
Lockdown Mode is an optional, extreme protection for people who might be personally targeted by sophisticated spyware. It limits web technologies, message attachments and accessory connections. Turn it on in System Settings > Privacy & Security; most people should leave it off.
Your next step
If you want a paid toolAffiliate link
Bitdefender
Best for: Windows, Mac and Android users who want web protection, ransomware layers and several devices covered by one subscription.
Not for: Windows users happy with Microsoft Defender, and iPhone users: iOS apps cannot scan other apps, so the benefit there is mostly web filtering.
Visit BitdefenderRelated guides
- Do Macs and iPhones need antivirus?Apple builds malware defenses into macOS and locks iPhone apps into sandboxes. Most people need good habits more than another app, but Mac threats are real and growing.
- iPhone security settings checklist: the settings worth changing, in orderThree settings do most of the work on an iPhone: Stolen Device Protection, a passcode longer than six digits, and automatic updates. The rest of this checklist takes about 15 minutes.
- Windows 11 security settings checklist: encryption, Defender, Smart App Control and moreThree settings matter most on a Windows 11 PC: automatic updates, device encryption with the recovery key saved somewhere safe, and Microsoft Defender left on. Smart App Control and a standard everyday account close most of the rest.
- Why software updates matter, and how to turn them on for every device you ownInstalling updates is the single cheapest security habit there is. Switch on automatic updates everywhere, know when a device stops getting them, and replace it before that happens.