Securely Share Your Experience Cloud Sites with Guest Users

Get a printable version of the security guide here.

• Guest User Security Policies and Timelines
  To improve data security for orgs with guest users, Salesforce made some security improvements. Use this topic as a starting point to understand all the security improvements and updates, including timelines for enforcement and how to prepare for the changes.
• Guest User Setup Checklist
  Setting up guest users in your Experience Cloud site requires a number of different settings and configurations. Use this high-level checklist to help you keep track of all the tasks and considerations.
• Give Secure Access to Unauthenticated Users with the Guest User Profile
  Use a guest user profile to control public access to data, content, and objects in your site that don't require authentication. For example, you can create a customer support community where existing and potential customers can view public discussions, known issues, and solutions posted by other members or support without logging in.
• Assign Records Created by Guest Users to a Default User in the Org
  To increase the security of your Salesforce data, guest users are no longer automatically the owner of records they create. Instead, when a guest user creates a record, the record is assigned to a default active user in the org, who becomes the owner.
• Secure Data Accessible by Guest Users
  Protect your data by securing the data created by unauthenticated guest users prior to Salesforce’s enforcement of the guest user security policies in the Winter ’21 and Spring ’21 releases.
• SEO Best Practices and Considerations for Guest Users
  To configure your site for search engine optimization (SEO), Salesforce uses the guest user profile to identify the public pages and objects available for indexing. A search engine is considered a guest, or unauthenticated, user. For Experience Builder sites, Salesforce automatically generates a sitemap with a list of the publicly accessible content. For sites built with Salesforce Tabs +Visualforce, you’re responsible for creating the sitemap and indicating which pages are included.
• Control Public Access to Your Experience Builder Sites
  Set the public access level to your Experience Builder site, and set page-specific access to your site pages.
• Object-Specific Security Best Practices for Guest Users
  After you configure the guest user profile and the site guest user record, keep object-specific best practices in mind for guest user access.
• Test Guest User Access in Your Experience Cloud Site
  After you’ve implemented the recommended security settings, take your Experience Cloud site on a test drive to see what guest users see.