Reviewing guest user object, record, and field exposure
Key Takeaway
Guest users get record access only through guest user sharing rules, because their org-wide default is Private and can't be changed. Object and field permissions alone don't expose any records.
Guest users are unauthenticated visitors to a public Experience Cloud site, so any record shared with them is open to anyone without a login. Admins check what guest users can reach with two tools. The Guest User Exposure card in Org Health and Usage gives a quick health signal across all sites. The Guest User Sharing Rule Access Report shows the exposed objects, records, and fields for each site.
Where guest access comes from
The "Secure guest user record access" setting is enabled in all orgs with Experience Cloud sites. You can't disable it.
Because of the setting, guest user org-wide defaults are Private for every object, including objects not listed on the Sharing Settings page. You can't change that Private level.
Guest exposure comes from two layers.
| Layer | Comes from | Most it can grant |
|---|---|---|
| Object and field access | The guest user profile, plus any permission sets or permission set groups assigned to the guest user | Read and Create object permissions |
| Record access | Guest user sharing rules only | Read Only |
Guest users can't be given Edit, Delete, "View All Records", or "Modify All Records", even through a permission set or permission set group.
Because the org-wide default stays Private, object and field permissions don't open any records on their own. A guest user can see a record only when a guest user sharing rule shares it. So when you delete a rule or narrow its criteria, guest users lose read access to any records that no remaining rule shares, even if the profile still grants Read on the object and its fields.
A city library runs a public site that shows a custom object called Book Club Meeting. The guest user profile grants Read on the object and its fields. One guest user sharing rule shares meetings where Audience equals Public. A librarian creates a meeting with Audience set to Members Only. That meeting doesn't match the rule, so visitors to the site can't see it. The profile's Read permission doesn't change the result, because the rule is the only source of record access for guest users.