Place77

One-page checklist

Before you install: a download checklist

One page of checks to run before, during and after installing any program or app, each tied to the security agency or operating system document it comes from.

Written 2026-10-26; each key statement found in its source by a script run. Last reviewed against sources 2026-10-26.

Drawing of a clipboard holding a list of six rows, each with a square box, the first four ticked.

How to use this checklist

This page gathers every check on this site into one list, in the order you would use it, from deciding where to get a program to looking after it once it is installed. Each item names the document it comes from, so you can read the reasoning in full. The six guides explain each step in more depth; this page is the one to keep open while you work.

Not every item applies every time. An app from your phone's official store needs only a few of them; a large program downloaded from a vendor's website needs most of them.

The order matters. Most of the later checks only work if the earlier ones were done: a checksum is worth comparing only if it came from the real publisher, and a security warning means most when you know where the file should have come from. If you skip anything, skip from the end of a section, never the start.

Before you download

  • Check the official store or your package manager first. Apple calls the App Store the safest place to get Mac apps; Google Play Protect checks Play Store apps before you download them; WinGet on Windows and APT on Debian-based Linux install from known sources. (Apple Support; Google Play Help; Microsoft Learn; Debian Administrator's Handbook)
  • Otherwise go to the maker's own site by typing its address. Do not reach it through an advert, a search ad or a link in an email. (CISA, Protecting Against Malicious Code; FTC, Malware)
  • Avoid free-download sites, peer-to-peer sharing and "free" copies of paid programs. Free software can hide a Trojan horse. (FTC, Malware; CISA, Protecting Against Malicious Code)
  • Note the published checksum or signature, if the maker offers one, from a page you trust, before you download. (Debian, Verifying authenticity of Debian images; Ubuntu, How to verify your Ubuntu download)
  • Check the licence if you plan to use the program at work or pass copies on. Open source licences allow use for any purpose; obligations mostly attach to redistribution. (Open Source Initiative; GNU Project)

When the file arrives

  • Check the file is the kind you expected. A "document" or "video" that turns out to be a program is a warning sign. Gatekeeper asks before opening downloaded software for exactly this reason. (Apple Platform Security)
  • Compare the SHA-256 checksum. On Windows use Get-FileHash, which uses SHA-256 by default; on Linux use sha256sum. Compare the whole value, not the first few characters. (Microsoft Learn, Get-FileHash; Ubuntu)
  • Check the signature when one is published, for example with gpg on a signed checksum list. "Good signature" is what you want; BAD means stop. (Ubuntu; Debian)
  • Do not rely on MD5 or SHA-1 alone. Both are no longer considered secure against attack. (Microsoft Learn, Get-FileHash; NIST)
  • Take SmartScreen, Gatekeeper and Play Protect warnings seriously. A warning on a file you thought was official is a reason to recheck where it came from. (Microsoft Learn; Apple Support; Google Play Help)

While installing

  • Read every installer screen. Choose a custom install where offered and untick extra programs, toolbars or browser changes you did not ask for. Microsoft classes software that offers to install other software as potentially unwanted. (Microsoft Learn, Block potentially unwanted applications)
  • Cancel any installer that will not continue without an extra. Look for the program in an official store or package manager instead.
  • Do not override a security warning unless you are certain of the source. Apple says to use caution with any software for which your Mac shows an alert, and to override only when you are certain the app is from a trustworthy source and has not been tampered with. (Apple Support, Safely open apps on your Mac)

After installing

  • Turn on automatic updates for the operating system, apps, browsers and security software. (CISA; NCSC; FTC)
  • Install prompted updates soon, ideally at home on a trusted network with the device plugged in. (NCSC; CISA)
  • Get updates only through the software's own update feature or the vendor's site, never from an email, message or pop-up. (CISA, Understanding Patches and Software Updates)
  • Back up regularly, with at least one copy kept separate from the device. (NCSC; CISA)
  • Retire software and devices that no longer get security updates. (CISA; NCSC)

If something goes wrong

  • Stop signing in to accounts on the device until it is clean. (FTC, Malware)
  • Computer: update, scan with security software and follow its advice; if that fails, wipe and reinstall, then restore from the last known good backup. (NCSC, How to recover an infected device)
  • Phone or tablet: a factory reset is the safest fix, then restore from backup. (NCSC)
  • From a clean device, change passwords for affected accounts and any that share a password, and turn on 2-step verification. (NCSC, Recovering a hacked account; FTC; CISA)
  • Check email forwarding rules and bank statements. (NCSC; CISA)
  • Report it: in the US at ReportFraud.ftc.gov; in the UK, scam calls to Report Fraud. (FTC; NCSC)

Never

Five things none of the sources would do

  • Click an advert to download software.
  • Install an "update" that arrived by email, message or pop-up.
  • Call a phone number shown in a security warning. Real warnings never ask you to.
  • Give remote access to someone who contacted you about a problem with your computer.
  • Keep using a password that was typed on an infected device.

The items above draw on the FTC's guidance on malware and tech support scams, CISA's guidance on patches and malicious code, and the NCSC's recovery advice. The full list of documents is below.

Back to all guides