HardenMac Mac Security Checklist

Free · The whole sequence

The Mac Security Checklist

Most Mac security checklists are settings lists. This one starts where people actually arrive — something happened, or you think it might have — and works outward to the settings. Six stages, in order: check, disconnect, revoke, rotate, rebuild, harden.

Nothing on this page scans your Mac or proves it is clean. It is a sequence, not a diagnosis. Work through it from wherever you are: if nothing has happened, stages 1 and 6 are the two that matter today.

What should be on a Mac security checklist?

A Mac security checklist has two halves that people routinely merge, and shouldn't. The first half is incident work — what you do when something may already have happened, in an order that stops the loss spreading. The second half is standing work — the macOS settings and habits that reduce how much a single bad install could reach in the first place.

Doing the second half in the middle of the first is one of the most common ways people lose accounts they could have kept. Turning on FileVault while an attacker is still holding a live session in your email does nothing for the email.

The idea that sets the order: removing malware is not the same as getting your accounts back. A stolen session cookie or OAuth token is a separate credential from your password — it survives a password change and it was designed to skip the two-factor prompt. Why removal isn't recovery.

Stage 1 — Check: is something actually wrong?

Start by separating a worry from a signal. A slow Mac is a weak signal. An admin password prompt you did not initiate, a command you were told to paste into Terminal, or an account alert about a sign-in you don't recognise are strong ones.

  1. Write down what made you suspicious, with the date and rough time, before you change anything. You will want this later and you will not remember it.
  2. Open System Settings > General > Login Items & Extensions and read both the Open at Login list and the App Background Activity list. Anything you cannot name is a question, not a verdict.
  3. List third-party launch items from Terminal (read-only): 
    ls -la /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents
    Items here are normal — on the Mac used to write this page they were Little Snitch, Backblaze and a couple of app updaters. Apple's own services do not live in these folders; they live under /System.
  4. Review browser extensions and profiles, in every browser and every profile you use.
  5. Check the security or sign-in notification emails for your main accounts.

For a longer walk-through of each of those places, see how to check a Mac for infostealer signs. For a five-minute version of the whole question, use the free First-Response Self-Check.

Stage 2 — Disconnect: contain before you clean

If you think something is running right now, the goal is to stop data leaving while you think, without destroying what you would need to understand it.

If you expect professional help, don't power the Mac off — ask first. For most individuals and small operators, containing access and securing accounts from another device matters more than preserving volatile memory.

Stage 3 — Revoke: end the sessions, not just the passwords

This is the stage most checklists skip, and it is the one that decides whether you keep your accounts. Three different things can grant access to an account:

So for each important account, work the pair together, in this order:

  1. Review active sessions and devices; sign out all other sessions where the provider supports it.
  2. Remove devices you don't recognise.
  3. Review connected apps, third-party access and app passwords; revoke anything unexplained or unnecessary.
  4. Review two-factor methods, passkeys, backup codes, recovery email and recovery phone — a changed recovery address is how people lose an account permanently.
  5. Then change the password.

Stage 4 — Rotate: control accounts first

Order by what can reset what. An attacker with your email can reset most of the rest, so your email is not the fifth thing on the list.

  1. Primary email and every recovery email.
  2. Password manager.
  3. Apple Account, or whichever identity provider you sign in with.
  4. Banking, payment and identity accounts.
  5. Domain registrar, DNS, hosting and any work-admin account.
  6. Cloud storage and backups.
  7. Developer and deployment platforms — API keys, access tokens, SSH keys.
  8. AI tools and automation platforms, including anything you connected to your mail, files or repositories.
  9. Social and publishing accounts.

The free First-Response Checklist is this list in printable form, with the containment steps attached.

Stage 5 — Rebuild: restore documents, not machine state

If you decide to erase and reinstall, the reinstall is the easy part. The trap is the restore. A full migration or whole-system backup restore can carry back the exact things you erased the Mac to get rid of: old applications, browser profiles, Library contents, launch items, shell profiles and automation configs.

Stage 6 — Harden: the macOS settings checklist

Paths below were checked against macOS 26 (Tahoe) on 2026-08-11. Apple moves these panes between releases; if a name has shifted, search for it inside System Settings.

  1. Updates. System Settings > General > Software Update. Turn on automatic updates, including the rapid security responses.
  2. Where apps may come from. System Settings > Privacy & Security > Allow applications from. Apple describes App Store as "the most secure setting to protect your system from malware"; App Store and Known Developers is the practical setting for most people.
  3. FileVault. System Settings > Privacy & Security > FileVault > Turn On FileVault. Keep the recovery key somewhere that is not on the Mac.
  4. Firewall. System Settings > Network > Firewall. Worth turning on — and worth understanding, because it only filters incoming connections. What the Mac firewall does and doesn't cover.
  5. Login Items & Extensions. System Settings > General > Login Items & Extensions. Prune Open at Login and App Background Activity to things you can name. Review the extension categories underneath while you are there.
  6. Stored secrets. Move passwords out of browser autofill and into a password manager. Put passkeys or a hardware security key on the accounts from stage 4, positions one to three. Browser-stored passwords and card details are exactly what infostealer-class malware is built to collect.
  7. Screen lock and Find My. Require a password immediately after sleep; keep Find My on.
  8. A backup you have actually restored from. Untested backups are a plan, not a backup.

Reduce what the Mac can reach

Hardening settings limits how easily something gets in. The other half is limiting how far it gets afterwards — which accounts were signed in, which drives were syncing, which AI tools and automations held live access to your mail, files and repositories. That surface is usually much larger than people expect, and it is invisible until you write it down.

The free Mac Exposure Check walks you through it in a few minutes and computes everything inside your own browser tab; the Free Mac Exposure Map is the same territory in document form. The paid HardenMac Safety & Recovery Protocol extends both into the decision gates and the full recovery sequence — out now for $29 (founder’s price) via the front page.

How often should you run this checklist?

The two halves run on different clocks. Stages 1–5 are event-driven: you run them when something triggers them, and you run them in order. Stage 6 is a review — monthly is a reasonable rhythm, and the parts that drift fastest are login items, browser extensions and connected apps, because those change every time you try a new tool.

Common questions about Mac security checklists

Do Macs need antivirus?

macOS has built-in protections, and they catch known things. They are least useful against the delivery method that dominates this category: you were persuaded to run something yourself, or to paste a command into Terminal. Antivirus is a reasonable layer; it is not a substitute for the revoke-and-rotate work in stages 3 and 4, because a security product on your Mac cannot sign someone out of your email.

Is macOS secure by default?

It is reasonably locked down against software that tries to install itself without you. It is far weaker against software you were talked into installing, because at that point it is running with your permissions, doing things you appeared to authorise.

What is the first thing to do if I think my Mac is compromised?

Stop using that Mac for anything involving accounts, and move to a different device. Everything else — checking, cleaning, deciding whether to wipe — is easier once your accounts are being handled from somewhere you trust.

Does changing my passwords fix it?

Not on its own. Password changes do not always end existing sessions and do not revoke connected-app access. Change the password after you have signed out other sessions and reviewed connected apps, not instead of it.

Should I erase my Mac?

It is the higher-confidence path when something ran with admin rights, when persistence was involved, when behaviour came back after you removed it, or when you simply cannot account for what ran. It is also the more disruptive one. Deciding is stage 5; the removal page lays out the conditions.

Sources

HardenMac is experience-based guidance, not professional advice, and not antivirus or incident response. It does not scan this Mac, its accounts, files or network, and it cannot detect or rule out a problem. Menu names vary by macOS version; if a setting has moved, search for its name inside System Settings.