Guest Site User Policies

• Ensure List Views are shared only with certain groups or set to private.
• Set internal and external organization-wide sharing defaults to ‘private’ on all objects with non-public data. Alternate sharing models may be permitted with proper justification (e.g., adequate restrictions at the create, read, update and delete [CRUD] level).
• Set all Sharing rules to not share any data with the Site Guest User.
• Apply the Restrict Access to @AuraEnabled Apex Methods for Guest and Portal Users Based on User Profile Critical Update .

• Set the Organization Wide Defaults (OWD) to ‘private’.
• Review field-level security for each object - Site Guest Users should have access to only the Custom/Standard objects that are required for their business function, that contain only public data.
• Configure Sharing Rules/Permission sets to not open access for Custom/Standard object.
• Ensure all active profiles have no access to standard or custom objects that could contain personal information, per the Best Practices and Considerations When Configuring the Guest User Profile documentation
• Confirm the View All Users, Object access, and API Enabled checkboxes are not enabled.
• Transfer ownership of sensitive records created by the Site Guest User profile to an internal user by following the steps outlined in the Assign Records Created by Guest Users to a Default User in the Org documentation , and ensure ownership of all existing records are also transferred to an internal user.

• Review any custom Apex code
  • Check for public API methods returning data, and confirm methods cannot be used to exfiltrate object records
  • Enforce field-level security for all Apex classes/methods
  • Ensure all controllers are respecting permissions of the current user, per the following Help documentation:
    • Using the with sharing, without sharing, and inherited sharing Keywords
    • Enforcing Object and Field Permissions
• Maintain a process to keep JavaScript libraries in static resources continually updated to the latest security patch
• Reset the exposed API key credentials

Additional Resources

• Secure Your Community or Portal
• Give Secure Access to Unauthenticated Users with the Guest User Profile
• Secure Guest Users’ Sharing Settings and Record Access
• Configure the Guest User Profile