Seven macOS Security Settings Worth Checking Today
macOS defaults are good but not uniformly on. Seven security settings worth checking, where to find each, and the state to leave it in.
macOS defaults are good, but they aren’t uniformly switched on, and two of the most useful protections actually ship disabled. The seven settings below are worth a look today. For each one, here’s what it does, where to find it, and the state to leave it in, and none of them takes more than a minute.
The two settings that ship switched off
Start with the pair Apple leaves off, because they’re the highest-value clicks here. FileVault, in System Settings > Privacy & Security, encrypts your entire disk so the contents are unreadable without your login. On Apple silicon the performance cost is effectively zero, handled by dedicated hardware, so the only real question is whether you’d rather anyone who walks off with your drive could read your files. When you turn it on, macOS offers to tie recovery to your iCloud account or to give you a one-time recovery key instead. If you choose the key, store it somewhere that isn’t the encrypted Mac, because losing it means losing the data too.
The firewall, in System Settings > Network, is the second. It blocks unsolicited incoming connections, and while a fresh Mac has few services listening, the protection matters the moment you join a shared or public network. Switch it on and leave it on; there’s no everyday downside. If you want a little more, its options include a stealth mode that stops your Mac from answering probes that map out devices on a network, which is a reasonable extra for a laptop that roams.
Lock the screen the moment you step away
Set your Mac to require the password immediately after it sleeps or the screen saver starts. The setting lives in the Lock Screen section of System Settings, and the default grace period, often five minutes, is a quiet gift to anyone near your table in a cafe or library. Five minutes is plenty of time for someone to sit down at a Mac you thought was safely closed.
Changing “Require password after sleep or screen saver begins” to Immediately closes that window. On a Mac with Touch ID the friction is barely there, since a fingerprint gets you back in as fast as you left. It’s worth turning off “Show password hints” in the same section, and separately, in Notifications settings, setting previews to show only after you sign in, so a glance at a sleeping Mac reveals nothing about your messages or accounts.
Leave Gatekeeper and updates where they are
Two settings are less about changing something and more about confirming it. In Privacy & Security, keep the “App Store and identified developers” option selected so macOS keeps blocking unsigned software by default. Modern macOS deliberately makes running an unsigned app awkward, with no simple “anywhere” switch in the menu anymore, and that friction is the feature, not a bug to work around.
While you’re there, open General > Software Update and click the small info button to reveal the automatic-update sub-toggles. Make sure security responses and system files are set to install on their own. Those cover the fastest-moving fixes, and letting them apply quietly is the single best thing you can do between manual check-ins.
Audit what your apps can actually see
Walk through Privacy & Security and look at who has access to Camera, Microphone, Screen Recording, and Full Disk Access. Each of these lists the apps you’ve granted a sensitive permission, and it’s easy to accumulate more than you’d choose today. Revoke anything that no longer has a clear reason to be there.
Full Disk Access is the one people forget. It’s a broad grant that lets an app read essentially everything, often handed to a backup tool or a cleaner years ago and never revisited, so it deserves the closest look on the page. Screen Recording is worth a second glance too, since a video-call or screenshot app you stopped using may still hold permission to watch everything on your display.
Make theft an inconvenience, not a loss
Confirm Find My is on for your Mac, which brings Activation Lock with it. The combination means a stolen or lost Mac can be located, locked, and erased remotely, and it can’t simply be wiped and reused by whoever ends up with it. That turns a theft from a data disaster into an insurance claim and a bad day. Find My leans on you being signed into iCloud with Location Services enabled, so confirm both are active rather than assuming a new Mac was set up the way you’d want.
Set these seven once and they mostly look after themselves. From there, a short monthly security pass keeps the moving parts current, and if you spend time on networks you don’t own, our public Wi-Fi checklist covers the habits that pair with the firewall you just switched on.
Common questions
Why is the Mac firewall off by default?
It's mostly a historical choice. A fresh Mac runs very few services that listen for incoming connections, so the firewall has little to do out of the box and Apple leaves it off. It's still worth turning on, especially for a laptop that joins networks you don't control, where blocking unsolicited incoming connections adds a cheap layer of safety.
Does FileVault slow a Mac down?
Not in any way you'll notice. Encryption and decryption are handled by dedicated hardware on Apple silicon and on recent Intel Macs with the T2 chip, so the performance cost is effectively zero. Without FileVault, anyone who removes your drive can read every file on it, which makes the near-free protection an easy choice.
Is 'App Store and identified developers' safe enough?
For most people, yes. That setting lets you run software that Apple has notarized, meaning it was scanned for known malware, while still blocking unsigned apps by default. The real risk isn't the setting; it's choosing to override it for a specific app, so the caution belongs at that moment, not in the default.
Recommended next step
Make everyday Mac care easier with BlueHammer
Clean up storage, organize files, browse privately, and keep everyday protection in one place.
Run a security check