Salesforce - Enable guest user on your digital experience site or community

Learnings - 

👉How guest user profiles work in Salesforce

👉Configuring a guest user profile

👉Managing access and best practices

Guest users in Salesforce Communities/Sites 

• Guest user profiles are used for controlling the public or unauthenticated access to your org's data i.e. it controls the access you give to the users who have not logged into your community. 

• Guest users can always see login and login error pages in your site. 

• Every time a portal or site is created in your Salesforce org, a Guest User Profile is automatically created at the backend. These auto-created profiles are very restrictive and do not allow any data or object visibility to guest users.

• Each community or site has a guest user associated with it. If you have 10 communities in your org, you will have 10 different guest users.

Configuring guest user profiles in Salesforce

Guest user profiles are not visible in the Setup>Profile section. Follow the below steps to go to the Guest user profile.

• Navigate to Setup>Digital Experiences>All Sites.

• Click on Builder.

• In Experience Builder, click gear icon(☸) and select General.

• Under the Guest User Profile section, click the profile name.

• Click Edit //You are now in the Guest User Profile section.

• Do changes as per your business rules. Try to expose as little as possible.

• Create sharing rules for the objects you want to share.

• Click Save.

Best practices and considerations

• Guest users are always active in any org and have access to any active community which is public.

• Configure an owner for any record created by guest users so that guest users do not own anything. If the guest user is the owner of the record, any guest user will be able to see the record. For example, if Mukesh is a guest user and creates a case and becomes owner, then Rakesh, also a guest user will be able to see the case. 

• Use the Secure guest user record access setting. It restricts the visibility and access that guest users have to your org’s data.

• Review all default object permissions in the guest user profile, and apply the most restrictive permissions for the guest user. 

• Review all system permissions, and deselect the permissions that aren’t necessary for your use case.

• Review all Visualforce and Apex pages that guest users can access. Remove pages that you don’t want guest users to access.

• Remove field-level access to fields that you don’t want guest users to see.

References:

https://help.salesforce.com/articleView?id=sf.rss_config_guest_user_profile.htm&type=5