The best Mac security settings: a checklist

MacUpdated

The Mac security settings that matter most are a login password, a password after sleep, automatic login off, FileVault, the firewall, automatic updates and Find My Mac. Each one below has its exact path in System Settings.

Quick answer

Open System Settings and work through it: Touch ID & Password, Lock Screen ("Require password after screen saver begins or display is turned off"), Users & Groups (automatic login Off), Privacy & Security > FileVault, Network > Firewall, General > Software Update > Automatic Updates, your name > iCloud > Find My Mac, then Privacy & Security > Camera and Microphone.

This is the checklist. For what each feature is, see macOS security features explained.

Set a login password and add Touch ID

Apple's own checklist starts here: secure your Mac with a password that can't be easily guessed. Touch ID sits on top of it.

  1. Choose Apple menu > System Settings, then click Touch ID & Password in the sidebar.
  2. Click Add Fingerprint, enter your password and follow the onscreen instructions.
  3. Turn on "Unlock your Mac" so Touch ID unlocks it when you wake it from sleep.

The password still matters. Apple says you need it when you start your Mac, and users must re-enter it every 48 hours and after five incorrect fingerprint attempts.

Require a password after sleep or the screen saver

Apple says you should require a password to wake your Mac from sleep or from the screen saver.

  1. Choose Apple menu > System Settings, then click Lock Screen in the sidebar.
  2. Click the pop-up menu next to "Require password after screen saver begins or display is turned off".
  3. Choose a short time.

The NCSC's macOS guidance for organisations sets the screen to lock after 10 minutes of inactivity. Shortcuts and hot corners are in how to lock your Mac screen.

Turn off automatic login

Apple puts it bluntly: automatic login allows anyone to access your Mac simply by restarting it.

  1. Choose Apple menu > System Settings, then click Users & Groups in the sidebar.
  2. Click the "Automatically log in as" pop-up menu, then choose Off.

If several people use the Mac, Apple suggests a separate user account for each person and limiting how many of them are administrators.

Turn on FileVault

Apple says that on a Mac with Apple silicon or a T2 chip your data is already encrypted, and FileVault adds an extra layer by keeping someone from getting at it without your login password. On a Mac without either chip, you need FileVault to encrypt your data at all.

  1. Choose Apple menu > System Settings, click Privacy & Security in the sidebar, then click FileVault.
  2. Turn on FileVault. You may be asked for your password.
  3. Choose your iCloud account or a recovery key, in case you forget your password, then click Continue.

You need to be an administrator. Keep any recovery key somewhere other than the Mac.

Turn on the firewall

Apple says a firewall can protect your Mac from unwanted contact initiated by other computers when you're on the internet or a network.

  1. Choose Apple menu > System Settings, click Network in the sidebar, then click Firewall.
  2. Turn on Firewall.
  3. To change further settings, click Options.

More in Mac firewall: on or off.

Turn on automatic updates

The NCSC calls updating one of the most important, and quickest, things you can do to stay safe online.

  1. Go to System Settings, click General in the sidebar, then click Software Update.
  2. Click the Info button next to Automatic Updates.
  3. Turn on "Download new updates when available", "Install macOS updates" and "Install Security Responses and system files" (on macOS Tahoe 26 the last one is "Install system data files and security updates"), then click Done.

On macOS Tahoe 26 or later, also go to System Settings > Privacy & Security > Background Security Improvements and make sure Automatically Install is on.

Turn on Find My Mac

Find My Mac brings Activation Lock, which Apple says is designed to prevent others from using your Mac if it's lost or stolen.

  1. Choose Apple menu > System Settings.
  2. Click your name in the sidebar, then click iCloud.
  3. Click See All (or Show More Apps), click Find My Mac, then turn it on.

It needs Apple silicon or a T2 chip, macOS Catalina or later and two-factor authentication. See Mac Activation Lock.

Check camera and microphone access

  1. Choose Apple menu > System Settings, then click Privacy & Security in the sidebar.
  2. Click Camera, and turn access on or off for each app in the list.
  3. Go back, click Microphone, and do the same.

Apps that come with the Mac, such as FaceTime, have camera access without asking. A green light beside the built-in camera glows when it's on, and the Recording Indicator in Control Centre shows when the microphone is in use or was used recently.

Look through your Sharing settings

Some sharing services let other computers reach your Mac. Apple describes Remote Login as allowing remote login access, Remote Management as letting others access the Mac with Apple Remote Desktop, and File Sharing as letting other users reach your shared folders.

  1. Choose Apple menu > System Settings, click General in the sidebar, then click Sharing.
  2. Read down the list and turn off anything you don't use.

Apple says that when Screen Sharing is turned off, other computers on your network can't connect to your Mac.

Lockdown Mode, and who it's for

Apple describes Lockdown Mode as an optional, extreme protection for the very few people who, because of who they are or what they do, might be personally targeted by the most sophisticated digital threats. It adds that most people will never be targeted that way. With it on, most message attachments are blocked and some websites may not work as usual.

If that describes you, it needs macOS Ventura or later. Go to System Settings > Privacy & Security, click Lockdown Mode, then Turn On, and the Mac restarts.

Where Failshot fits

Most of these settings come back to your password. Your password is the first layer. Failshot is the second: second layer device security for your Mac. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video (video is on by default and can be switched off), and its window tells them the unlock was photographed. With the Mac's built-in camera, the green light comes on.

Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot is a free download for macOS 14 or later, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

New MacBook Pro? The New MacBook Pro guide covers buying one, setting it up and what to do with your old Mac.

More questions

What is the most important Mac security setting?

Apple doesn't rank them. Its own checklist for a secure Mac includes hard-to-guess passwords, a login for each user and a password to wake the Mac from sleep.

Is FileVault on by default on a Mac?

Apple says a Mac with Apple silicon or a T2 chip encrypts its data automatically, and FileVault adds the need for your login password to get at it. Check System Settings > Privacy & Security > FileVault to see whether it's on for yours.

Should I turn on Lockdown Mode?

Only if you could be personally targeted because of who you are or what you do. Apple calls it an extreme protection for very few people, and says your Mac won't work as it usually would with it on.

How often should my Mac lock itself?

The NCSC's macOS guidance for organisations uses 10 minutes of inactivity. Set the display timings and "Require password after screen saver begins or display is turned off" in System Settings > Lock Screen.

Sources