Macs are well protected by default, but "Macs don't get viruses" is a myth that criminals now rely on: Mac password stealers are sold as a service, and they usually get in because the owner was persuaded to install or paste something. This guide explains, in plain English, the Mac security settings a home user should check and why: your user account and Touch ID, administrator and standard accounts, FileVault encryption, software updates, Gatekeeper and XProtect, the firewall, privacy permissions, login items, Find My, backups and Lockdown Mode. It also answers the question most people ask: does a Mac need antivirus? It is written for people with a personal MacBook or iMac and for the relative who looks after everyone else's. Work Macs managed by an employer are covered in the macOS Security Guide for Enterprises. Menus here follow recent macOS versions with System Settings; if a setting is not where we say, use the search field in System Settings.
This is an independent guide from NHI Mgmt Group, based on Apple's public documentation as of November 2026. It is not sponsored or reviewed by Apple. Product features change, so confirm settings against Apple's current documentation.
Key takeaways
- Macs do get malware, mostly by invitation. Fake apps, cracked software and instructions to paste a command into Terminal are how most Mac infections start, so your habits matter as much as settings.
- Turn on FileVault and keep the recovery route safe. FileVault encrypts the whole disk; if you lose both your password and the recovery key, Apple says the data is lost.
- Install updates automatically. macOS updates and the background security updates that feed XProtect are the main defence against new threats.
- Use a standard account day to day. An administrator password prompt then becomes a warning sign rather than a routine click.
- Built-in protection is good; antivirus is optional. Gatekeeper, notarisation and XProtect cover known malware; extra tools can help, but no product protects you from running something you were tricked into running.
Do Macs need antivirus? The malware myths
| Myth | Reality |
|---|---|
| Macs cannot get viruses | Mac malware is common, especially password and crypto wallet stealers. The Atomic macOS Stealer Guide describes one family sold as a service since 2023 |
| Macs have no built-in antivirus | macOS includes XProtect, which uses signatures Apple updates separately from macOS, checks for known malware and can remove it |
| If it came from a website that looks official, it is safe | Fake download sites and search adverts for popular apps are a common delivery route. Download from the Mac App Store or the developer's own site |
| A Terminal command from a "verification" page is harmless | "Paste this into Terminal" lures avoid the checks that protect downloaded apps. No genuine website asks you to do this to prove you are human |
| Antivirus makes risky behaviour safe | No tool catches everything; security software adds a layer but does not replace updates, Gatekeeper and care |
So: most home users who keep macOS updated, leave Gatekeeper on and avoid pirated software are well covered by the built-in protection. A reputable third-party security tool can add value if you often download software from outside the App Store or want web filtering, but it is a choice, not a necessity.
How identity and access work on a Mac
Your Mac user account password unlocks the Mac, decrypts the disk when FileVault is on and is required to approve system changes. Your Apple Account, signed in under System Settings, controls iCloud, Find My and Activation Lock.
- Login password: use a strong one you do not use anywhere else. Set the screen to require it immediately after sleep or the screen saver starts (System Settings, Lock Screen).
- Touch ID: on Macs that have it, Touch ID unlocks the Mac and approves purchases and password autofill, so you can use a longer password without typing it all day. Set it up under System Settings, Touch ID and Password.
- Automatic login: leave it off (System Settings, Users and Groups). With it on, anyone who opens the lid gets in.
- Apple Account: turn on two-factor authentication and add a Recovery Contact. See the Securing Your Apple ID and Google Account Guide.
- Passwords and passkeys: the Passwords app stores and syncs passwords and passkeys through iCloud Keychain, end-to-end encrypted. See the Passkeys for Everyone Guide.
Admin roles and privileged access
The first account created on a Mac is an administrator. Administrators can install software for everyone, change security settings and approve system extensions. A standard account can still install most apps from the App Store and use the Mac normally, but must enter an administrator's name and password for system-wide changes.
| Setup | Good for | Trade-off |
|---|---|---|
| One administrator account used daily | Simplest; fine for confident single users who rarely install software | A malicious installer only needs your own password to make system changes |
| Standard daily account plus a separate administrator | Shared family Macs, children, anyone who wants a deliberate pause before system changes | You type the administrator name and password more often |
| Separate standard accounts per family member | Shared Macs: each person's files, Keychain and browser are separate | Needs a little setup in Users and Groups |
Create users in System Settings, Users and Groups. Turn off the Guest User if you do not need it. Whichever setup you choose, treat an unexpected password prompt with suspicion: Mac stealers commonly show a fake system dialog asking for your password, because it unlocks the Keychain.
Integrations, apps and connected accounts
Gatekeeper, notarisation and XProtect
Apple describes three layers of malware protection: preventing launch of malware, blocking it from running, and removing it. Gatekeeper checks that downloaded apps come from the App Store or from an identified developer and have been notarised (scanned by Apple). XProtect detects known malware using signatures that Apple updates independently of macOS, checks for them daily by default, and a remediation engine removes known malware it finds.
- Where: System Settings, Privacy and Security, Security, "Allow applications from". Keep it on App Store and identified developers (or App Store only).
- Overriding: macOS lets you open a blocked app from the same Privacy and Security screen. Only do this for software you are certain about; a download that tells you to override Gatekeeper is a red flag.
Privacy permissions
System Settings, Privacy and Security lists what each app may access: Location Services, Contacts, Photos, Camera, Microphone, Screen and System Audio Recording, Accessibility, Full Disk Access and more. Accessibility, Full Disk Access and Screen Recording are the most powerful; only apps you trust and actively use should be on those lists. See the macOS TCC and Privacy Permissions Management Guide for how these permissions work underneath.
Login items and background apps
System Settings, General, Login Items and Extensions shows apps that open at login and apps allowed to run in the background. macOS notifies you when something adds a background item. Turn off entries you do not recognise or no longer use; malware often hides here.
Safari
In Safari, Settings, Security, keep "Warn when visiting a fraudulent website" on. In Settings, Privacy, keep "Prevent cross-site tracking" on; Safari's Privacy Report shows the trackers it blocked.
Accessories
On Mac laptops with Apple silicon, new USB and Thunderbolt accessories must be approved before they can connect. Leave the setting under Privacy and Security, "Allow accessories to connect", on "Ask for new accessories".
Logging and detection: what to watch for
- Background item notifications: a "background item added" message for an app you did not just install deserves a look in Login Items and Extensions.
- Unexpected password prompts: a prompt that appears without you doing anything, or that asks for your password to "fix" something, may be a fake. Cancel it and check what is running.
- Permission requests: an app you just installed asking for Accessibility, Full Disk Access or Screen Recording without a clear reason.
- Apple Account alerts: a sign-in notification for a device you do not own.
- Browser changes: a new homepage, search engine or extension you did not add.
If you think the Mac is infected: disconnect from the internet, change your Apple Account, email and banking passwords from another device, check Login Items and Privacy and Security lists, update macOS, and consider erasing and reinstalling from a backup taken before the problem. Revoke saved sessions for important accounts, because stealers take browser cookies as well as passwords.
Hardening baseline
FileVault
FileVault encrypts the startup disk so a stolen Mac's data cannot be read without your password. Turn it on in System Settings, Privacy and Security, FileVault. You choose a recovery method: let your iCloud account unlock the disk, or create a recovery key you must store safely yourself. Apple warns that if you forget your password and lose the recovery key, your files are lost forever. On Macs with Apple silicon or a T2 chip, data is already encrypted at the hardware level, and FileVault adds the requirement for your password to unlock it.
Software updates
System Settings, General, Software Update, then the information button next to Automatic Updates. Turn on downloading new updates, installing macOS updates, installing app updates from the App Store, and installing security responses and system files. The last option is what keeps XProtect and other background security data current.
Firewall
The macOS firewall (System Settings, Network, Firewall; you may need to scroll) protects the Mac from unwanted contact started by other computers, that is, incoming connections. Turn it on, especially on laptops used on public Wi-Fi in cafes, hotels and stations. Under Options you can add apps and services and set each to allow or block incoming connections; when an app you do not recognise asks to accept incoming connections, choose Deny. The firewall does not control what your own apps send out, so it complements, rather than replaces, careful choice of software.
Sharing
System Settings, General, Sharing: turn off anything you do not use, especially Remote Login, Remote Management, Screen Sharing and File Sharing.
Find My and backups
Turn on Find My Mac under System Settings, your name, iCloud, Find My Mac; with it on, Activation Lock stops someone reusing a stolen Mac. Back up with Time Machine to an external drive (System Settings, General, Time Machine, Add Backup Disk) and tick Encrypt Backup; Apple suggests a drive at least twice the size of your Mac's storage. Time Machine keeps hourly backups for 24 hours, daily backups for a month and weekly backups after that, until the drive is full. See the Backup Security and Immutable Backup Guide.
Lockdown Mode
Lockdown Mode (System Settings, Privacy and Security) is an extreme, optional protection for people who may be personally targeted by sophisticated spyware. It restricts message attachments, web technologies and connections. Most home users do not need it.
Baseline settings
| Setting | Where in System Settings | Recommended |
|---|---|---|
| FileVault | Privacy and Security | On, with a safe recovery method |
| Automatic Updates | General, Software Update | All options on, including security responses |
| Allow applications from | Privacy and Security | App Store and identified developers |
| Firewall | Network | On, especially for laptops |
| Require password after sleep | Lock Screen | Immediately |
| Automatic login and Guest User | Users and Groups | Off |
| Daily account | Users and Groups | Standard account on shared Macs |
| Sharing services | General, Sharing | All off unless needed |
| Login items and background apps | General, Login Items and Extensions | Only items you recognise |
| Find My Mac | Your name, iCloud | On |
| Time Machine | General, Time Machine | On, encrypted |
Common misconfigurations
- Installing "cracked" or free versions of paid apps: a leading route for Mac stealers, and they often tell you to override Gatekeeper.
- Pasting Terminal commands from a website or chat: fake CAPTCHA and "fix your Mac" pages use this to bypass macOS checks.
- Typing your password into any dialog that asks: the system password unlocks your Keychain, so fake prompts are how stealers get it.
- FileVault on, recovery key lost: encryption protects you from thieves and from yourself; store the key or use iCloud recovery.
- Turning off "security responses and system files" updates: stops XProtect receiving new detections.
- No backup, or a backup drive always plugged in and unencrypted: a theft, failure or ransomware takes everything at once.
Practitioner checklist
- Turn on FileVault and record where the recovery key is, or confirm iCloud recovery.
- Turn on every Automatic Updates option, including security responses and system files.
- Keep "Allow applications from" on App Store and identified developers, and never override it for software you are unsure about.
- Turn off automatic login and the Guest User; require the password immediately after sleep.
- Use a standard account day to day on shared Macs, with a separate administrator.
- Turn on the firewall, especially on laptops; turn off unused Sharing services.
- Review Privacy and Security permissions and Login Items and Extensions; remove what you do not recognise.
- Turn on Find My Mac and two-factor authentication on your Apple Account.
- Set up encrypted Time Machine backups and test that you can restore a file.
Standards and references
- Apple Platform Security: Protecting against malware in macOS
- Apple Mac User Guide: Protect data on your Mac with FileVault
- Apple Mac User Guide: Keep your Mac up to date
- Apple Mac User Guide: Block connections to your Mac with a firewall
- Apple Support: Back up your Mac with Time Machine
- Apple Support: Allow accessories to connect to your Mac
- Apple Support: About Lockdown Mode
Related NHI Mgmt Group resources: macOS Security Guide for Enterprises · Atomic macOS Stealer Guide · Apple Platform Security Explained · Securing Your Apple ID and Google Account Guide