macOS has a well-earned reputation for strong default security, but “better than most” is not the same as “optimally configured.” Apple’s macOS security settings include powerful protections — Gatekeeper, SIP, FileVault, XProtect, and Lockdown Mode — but several of them require user activation or configuration beyond the defaults. Mac users who have never reviewed their security settings are almost certainly running with at least a few gaps that a deliberate review would close. This guide walks through every major macOS security settings category, explains what each controls, and provides the specific path to configure each one correctly. If you want the full context, see our Complete Guide to Online Security and Privacy.
The macOS security settings are distributed across System Settings (the centralised settings app replacing System Preferences in recent macOS versions), individual application preferences, and advanced configurations accessible through Terminal for power users. This guide focuses on the graphical System Settings configurations that apply to all users, with notes on where Terminal provides additional hardening for those comfortable with command-line tools.
macOS Security Settings: FileVault, Gatekeeper, and SIP
The three foundational macOS security settings are FileVault encryption, Gatekeeper application controls, and System Integrity Protection (SIP). Each addresses a different threat layer, and all three should be confirmed active on any Mac used for sensitive work or personal data.
FileVault is macOS’s full-disk encryption feature, equivalent to BitLocker on Windows. When FileVault is active, the entire disk is encrypted using XTS-AES-128 encryption — a Mac that is stolen or lost with FileVault enabled provides the thief with hardware only; the data is mathematically inaccessible without the login password. Enable FileVault: System Settings → Privacy & Security → FileVault → Turn On FileVault. Choose whether to use the iCloud account or a local recovery key as the recovery method — iCloud recovery is convenient but means Apple has a path to assist recovery; a local key stored securely (in the password manager’s secure notes) provides a recovery path that does not involve Apple. These macOS security settings take effect after the next restart; encryption runs in the background and the Mac remains fully usable during the process.
Gatekeeper controls which applications the Mac will launch based on their code signing status. System Settings → Privacy & Security → Security (scroll down) shows the “Allow apps downloaded from” setting. The macOS security settings here are: App Store only (most restrictive), App Store and identified developers (recommended baseline — allows apps signed with an Apple developer certificate), and Anywhere (disables Gatekeeper entirely — never select this). The “identified developers” setting is the right balance for most users: it allows legitimate software outside the App Store while blocking unsigned applications that have not passed even Apple’s minimum code-signing requirement. Attempting to open an unsigned app shows a warning; right-clicking and choosing “Open” allows a one-time override for applications you have deliberately chosen to trust.
macOS Security Settings: Privacy Controls
macOS security settings for privacy are primarily managed at System Settings → Privacy & Security, where a list of permission categories mirrors what iOS provides: Location Services, Contacts, Calendars, Reminders, Photos, Microphone, Camera, Screen Recording, Accessibility, Full Disk Access, and more. The audit approach is the same as for iOS — review each category, remove access from any app that does not have a clear functional need for it, and pay particular attention to:
Full Disk Access is the most sensitive macOS security settings permission. An app with Full Disk Access can read any file on the Mac, including those in protected system directories. Review System Settings → Privacy & Security → Full Disk Access and remove any application that does not genuinely require it. Backup software (Time Machine, Carbon Copy Cloner), antivirus tools, and certain system utilities have legitimate needs; most other applications do not. The list frequently accumulates apps from one-time processes or setups that retained the permission without ongoing need.
Screen Recording permission allows an app to capture everything visible on the screen — a significant privacy exposure. System Settings → Privacy & Security → Screen Recording → review every app listed. Video conferencing apps (Zoom, Teams) have a legitimate need; few others do. Remove Screen Recording permission from any app whose reason for holding it is unclear. The macOS security settings for microphone and camera follow the same pattern — grant to communication apps, revoke from everything else, and note that the menu bar indicators (microphone dot, camera light) show in real time when these are actively in use. According to Apple’s privacy documentation, the Privacy & Security settings are the primary interface through which users control app data access — apps cannot access these resources without explicit user permission, and the settings remain in place until explicitly changed.
macOS Security Settings: The Step-by-Step Security Review
- Confirm FileVault is active. System Settings → Privacy & Security → FileVault. If it shows “Turn On FileVault,” enable it immediately. If it shows “Turn Off FileVault,” it is correctly active — do not turn it off.
- Set the screen lock. System Settings → Lock Screen → “Require password after screen saver begins or display is turned off” → set to “Immediately.” Also configure the screen to lock automatically: System Settings → Displays → Advanced → “Prevent automatic sleeping” should be off; screen saver or display sleep should be set to 5–10 minutes. These macOS security settings prevent physical access to an unattended Mac.
- Enable the firewall. System Settings → Network → Firewall → enable the firewall. Click Options to configure: enable “Block all incoming connections” if the Mac does not need to receive inbound connections (most home Macs do not). Enable “Enable stealth mode” to prevent the Mac from responding to network probes.
- Enable automatic updates. System Settings → General → Software Update → enable all automatic update options including system data files and security responses. macOS security settings for updates should be fully automatic — security patches should never wait for manual action.
- Review Login Items and background processes. System Settings → General → Login Items & Extensions → review every app listed under “Open at Login” and every item under Background Extensions. Remove any app you do not recognise or no longer use. These macOS security settings control what has persistent access to the system from startup.
- Enable Lockdown Mode for high-risk users. System Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode. This macOS security settings option is specifically designed for users facing targeted attacks — journalists, activists, executives. It disables features like message link previews, web browsing technologies, and certain types of attachments to dramatically reduce the attack surface. Most users do not need Lockdown Mode, but those with elevated threat profiles should strongly consider it.
- Review iCloud sharing. System Settings → [your name] → iCloud → review every app with iCloud access. Disable iCloud sync for any category of data (Notes, Health, Photos, Documents) that you prefer stored only on the device rather than in Apple’s cloud. These macOS security settings determine what data lives on Apple’s servers versus only on the device.
Step three — the firewall — is one of the most commonly disabled macOS security settings, often turned off by users following outdated online advice that the Mac firewall causes problems with specific applications. The current macOS firewall (Application Firewall, not ipfw) blocks inbound connections per application rather than blocking all traffic, so it rarely causes problems while providing meaningful protection on public networks. Enabling stealth mode specifically prevents the Mac from responding to ICMP ping requests and TCP connection probes, reducing visibility to network scanners.
macOS Security Settings: Advanced and Terminal-Level Hardening
| Setting | Location | macOS security settings recommendation | User level |
|---|---|---|---|
| System Integrity Protection (SIP) | Terminal: csrutil status | Confirm “enabled” — never disable | Any |
| Secure Boot | Recovery Mode → Startup Security Utility | Full Security mode; no external media boot | Any |
| Firmware password (Intel Macs) | Recovery Mode → Utilities → Startup Security | Set a firmware password to prevent boot from external media | Any |
| Safari privacy settings | Safari → Settings → Privacy | Prevent cross-site tracking ON; Hide IP address → from trackers | Any |
| Advanced sharing permissions | Terminal: sudo sharing -l | Confirm no unexpected shares are active | Intermediate |
| Remote Desktop | System Settings → General → Sharing → Remote Desktop | Off unless actively used | Any |
| SSH remote login | System Settings → General → Sharing → Remote Login | Off unless actively used; if on, key-based auth only | Intermediate |
The table’s SIP entry deserves specific attention in this macOS security settings guide. System Integrity Protection is a macOS security feature that prevents even root-level processes from modifying protected system files and directories. Verifying it is enabled requires Terminal: open Terminal → type csrutil status → it should return “System Integrity Protection status: enabled.” Some online guides about software compatibility recommend disabling SIP, which is a serious macOS security settings mistake. SIP is a fundamental protection against rootkit installation and persistence; disabling it to allow software compatibility is almost always the wrong trade-off. If software requires SIP to be disabled, the software should not be installed.
macOS Security Settings: Keychain and Credential Management
The macOS Keychain is the system-level credential storage that holds WiFi passwords, website logins, certificates, and other sensitive data. macOS security settings for the Keychain are managed through the Keychain Access application (in Applications → Utilities) and through System Settings for higher-level access controls. The Keychain is protected by the login password by default; the “login” keychain automatically unlocks when the user logs in, which means any application running under the user’s account can access its contents.
For users who want stronger macOS security settings for credential protection, creating a separate keychain with a different password for the most sensitive items — and setting it to lock after inactivity — prevents automatic access even if an attacker gains control of the user session. Keychain Access → File → New Keychain → set a strong password different from the login password. Move sensitive certificates, passwords, and secure notes to this keychain. It will need to be unlocked explicitly rather than automatically at login, adding friction in exchange for the additional protection layer.
iCloud Keychain — the cloud-synced credential store that shares passwords across Apple devices — is part of the macOS security settings ecosystem but operates under different trust assumptions from the local Keychain. iCloud Keychain is end-to-end encrypted using keys held only on enrolled devices; Apple cannot access the content. It is a reasonable credential storage option for users who accept the cloud sync trade-off. Users who prefer to keep credentials entirely local should use a dedicated password manager rather than either iCloud Keychain or the browser-stored credentials — our companion guide on using a password manager covers the setup that provides stronger security than either keychain option. Our guide on iPhone privacy settings covers the iOS equivalent of these macOS security settings for users who want consistent privacy configuration across both Apple platforms. Reviews from outlets like major technology publications consistently identify FileVault, the Application Firewall with stealth mode, and the Privacy & Security permission audit as the three highest-impact macOS security settings changes available to most Mac users — together addressing the physical theft, network exposure, and app permission over-reach that represent the primary security risks for consumer Mac use.
A commonly overlooked element of macOS security settings is the management of Bluetooth and AirDrop discoverability. Bluetooth, when left on and set to discoverable, allows nearby devices to detect the Mac and attempt connection. AirDrop configured to “Everyone” allows any nearby Apple device to send files to the Mac without any prior authentication. System Settings → General → AirDrop & Handoff → AirDrop → set to “Contacts Only” or “Receiving Off” when not actively using it. For Bluetooth, set to “Off” when not using Bluetooth peripherals — the macOS security settings for Bluetooth are in the Control Centre toggle or System Settings → Bluetooth. These are not high-priority macOS security settings for most home environments but become relevant in public spaces where Bluetooth proximity attacks and AirDrop abuse (receiving unwanted content from strangers) are realistic risks.
Guest Account and Sharing configuration round out the macOS security settings that most users never review. System Settings → Users & Groups → Guest User — the Guest Account allows anyone with physical access to the Mac to log in and browse the internet in a session that is wiped at logout. This is intentional Apple design — guest access to Safari is isolated and leaves no persistent data. Whether this is desirable depends on the physical environment: in a home office where others may occasionally need to use the Mac, it is a convenient option; in an office or public setting, it is an access point that should be disabled. System Settings → General → Sharing — review every service listed (File Sharing, Printer Sharing, Remote Login, Remote Management, Internet Sharing, Bluetooth Sharing). Each should be disabled unless actively in use. Remote Login enabled without a specific current need exposes the Mac to SSH connection attempts from the network — one of the macOS security settings most frequently left enabled and forgotten after a previous administration task. Related: Android Privacy Settings.
