Setting up a Mac workstation that is both locked down and pleasant to use

Most hardening guides read like a list of things to disable, and they produce a machine that is technically safer and quietly miserable to use. The switched-off features come back one at a time over the following month, usually in a hurry, usually without being switched back.

This is the opposite approach: build a machine you enjoy using, where the security properties are load-bearing rather than bolted on. Roughly ninety minutes, in this order.

Phase 1 — The free wins (20 minutes)

Everything here is already installed and costs nothing in convenience.

The full reasoning behind each is in the settings nobody turns on.

Phase 2 — Encrypted, filtering DNS (10 minutes)

The single best effort-to-benefit ratio available. A filtering resolver over DoH or DoT blocks tracker and malware domains system-wide, encrypts your lookups against the local network and your ISP, and requires no ongoing decisions.

Do this before installing any security software. A large fraction of what an outbound firewall would otherwise prompt you about simply stops happening. Setup details in the DNS privacy guide.

Phase 3 — Outbound monitoring, in observation mode (15 minutes)

Install a connection monitor and block nothing for the first week. You are building a baseline, not enforcing a policy. Blocking on day one is the reliable way to break something important and conclude the whole category is not worth it.

Phase 4 — The layout that makes it work (10 minutes)

This is the phase that hardening guides omit and the one that determines whether any of the above survives contact with a normal working week.

Monitoring only works if the monitor is visible, and it is only visible if it has a fixed pane that nothing else is allowed to occupy. Achieving that by dragging window edges is tedious enough that people stop after four days.

Install a keyboard window manager so the arrangement is three keystrokes rather than forty seconds of dragging. Rectangle is the usual choice — free, open source, macOS 10.15 and later, Intel and Apple Silicon — and it is worth noting that it also passes the audit criteria in the menu bar audit: one job, one permission, no telemetry.

Phase 5 — Start enforcing (week two)

Once you know your baseline, block deliberately and in this order:

1. Advertising and analytics endpoints. Safe, high value, nothing breaks.
2. Software you actively distrust. If you distrust it enough to block it, consider whether it should be installed at all.
3. Chatty updaters — throttle rather than block; out-of-date software is a worse problem.
4. System services: leave alone unless you have a specific, researched reason.

Phase 6 — Maintenance (quarterly, 20 minutes)

• Re-audit every permission list. Grants outlive the software that requested them.
• Review login items and launch agents.
• Skim a week of connection logs for anything new.
• After a major macOS upgrade, re-check that permissions survived and utilities still launch.

What this deliberately leaves out

No VPN unless you are frequently on untrusted networks — it does not stop apps phoning home. No antivirus for a careful single user. No aggressive blocklists that break sites in ways you cannot diagnose. No Lockdown Mode unless you are a plausible target.

The measure of a good setup is not how much it blocks. It is whether you are still running it in six months.

Frequently asked questions