Know what the application can do
An explorer that displays public records has a different role from a wallet that signs transactions or a node interface that accepts administrative commands. Before installing software, identify which information and authority it will hold.
Do not provide signing secrets to a tool whose stated job is read-only observation. A wallet connection or unexplained signature request changes the task and deserves a separate review.
Start with the official release route
Use the Bitcoin Core download and verification page for Bitcoin Core releases. For other projects, use their own official distribution instructions. This site does not mirror executables or prescribe a fixed release version.
Check the platform and architecture, read release notes, and preserve the version and source in a maintenance record. Search advertisements and unsolicited support messages should not become your default software distribution channel.
Verify more than a matching checksum
A checksum tests whether a file matches an expected digest. That does not authenticate the digest’s source by itself. Follow the project’s signature-verification instructions and establish the expected signing identities through an appropriate route.
When the result differs from the documented expectation, stop and investigate. Do not disable safeguards simply because an unfamiliar tutorial says a warning can be ignored.
Plan recovery and updates together
Read the application’s backup requirements before changing a working setup. Wallet secrets, labels, descriptors, settings, and rebuildable blockchain data have different roles. A copy of one should not be treated as a complete backup of everything.
Use the software download security guide for a full checklist. For node-connected applications, also review the node planning guide and keep privileged interfaces out of public browser code.