macOS ships with three layers of free, automatic protection: Gatekeeper (only run signed/notarised apps), XProtect (built-in malware blocker), and SIP (System Integrity Protection). Some malware tries to disable them.
Step 1: Check Gatekeeper
- System Settings → Privacy & Security
- Scroll to Allow applications downloaded from
- It should be set to App Store or App Store and identified developers
- If neither option is selected, Gatekeeper has been weakened
Step 2: Check SIP
- Open Terminal (Spotlight → Terminal)
- Type
csrutil statusand press Enter - You should see System Integrity Protection status: enabled
- If it says disabled and you did not deliberately turn it off, your Mac has been tampered with
Step 3: Check the Firewall and FileVault
- System Settings → Network → Firewall should be On
- System Settings → Privacy & Security → FileVault should be On
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers