Guest user licenses are required for force.com sites. EE/UE orgs are allowed to create up to 25 sites hence the 25 guest user licenses.
- Each site has a special user with a user type called guest user type
- Guest users have no password, no role and have no API access on their profile.
- You can't login or do client side api call (only within apex code). If you need API access for guest users, the "Guest API Access Enabled" org permission needs to be enabled.
- There is no session for guest browsing
- Each guest user (site) has a unique profile (public access settings)
- These profiles are associated to guest user licenses which give the ability to read/create on standard objects and full CRUD on custom objects. However, by default no CRUD is given. Admins needs to enable the right level of access based on their flow
- We advise private sharing for the objects that are enabled for sites
- Guest user licenses can't be used for any other purposes other than Force.com Sites.