# Public sites: guest access and record ownership

*Experience Cloud Consultant Study Guide · Administration, Setup, and Configuration · Last updated October 24, 2026 · https://www.certifyforce.com/study-guide/experience-cloud-consultant/administration-setup-and-configuration/public-sites-guest-access-and-record-ownership*

How to open an Experience Builder site or a single page to guests, harden the per-site guest user profile (Read and Create only, API, flows and self-registration pages off), share records through guest user sharing rules, and handle guest-created records with a default owner.

- Certification: Salesforce Experience Cloud Consultant
- Exam section: Administration, Setup, and Configuration
- Study guide: https://www.certifyforce.com/study-guide/experience-cloud-consultant

**Official exam objective:**

> Determine the steps to build a public Experience.

## What the exam expects

- Make a whole site public, or open one page while the rest stays behind login.
- Show components such as the Navigation Menu to guests.
- Harden the guest user profile: object and system permissions, API, default Visualforce pages.
- Share records through guest user sharing rules, one guest user per site.
- Plan for guest records going to a default owner: routing, and flows or pages that assumed guest ownership.

Key terms:
- **Guest user**: the single user record that every unauthenticated visitor to one site shares.
- **Page access**: the Site Default Setting, Public or Requires Login choice in a page's Page Properties.
- **Guest user sharing rule**: a criteria-based sharing rule type that grants guests Read Only access.
- **Secure guest user record access**: the always-on setting that locks guest org-wide defaults to Private.
- **Guest record default owner**: the active, non-guest user who owns records guests create.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Site public access | Builder Settings, General: Guest users can see and interact with the site without logging in | [Control Public Access](https://help.salesforce.com/s/articleView?language=en_US&id=sf.community_builder_page_access_settings.htm&type=5) |
| Page access options | Site Default Setting, Public, Requires Login | [Control Public Access](https://help.salesforce.com/s/articleView?language=en_US&id=sf.community_builder_page_access_settings.htm&type=5) |
| Always public / always private | Login-related pages / Messages page | [Control Public Access](https://help.salesforce.com/s/articleView?language=en_US&id=sf.community_builder_page_access_settings.htm&type=5) |
| Guest users | One guest profile and guest user per site, shared by all visitors | [Guest User Profile](https://help.salesforce.com/s/articleView?language=en_US&id=sf.networks_public_access.htm&type=5) |
| Guest OWD | Private for all objects, unchangeable | [Guest Profile Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_guest_profile_best_practices.htm&language=en_US&type=5) |
| Guest sharing rules | Read Only; count toward 50 criteria-based rules per object | [Guest Profile Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_guest_profile_best_practices.htm&language=en_US&type=5) |
| Guest object permissions | Only Read and Create allowed; recommend no access, or maximum Read where possible; never View All or Modify All | [Guest Profile Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_guest_profile_best_practices.htm&language=en_US&type=5) |
| Default owner | Any active non-guest user with Read; prefer queues plus routing | [Default Owner Best Practices](https://help.salesforce.com/s/articleView?id=sf.networks_guest_record_default_owner_best_practices.htm&language=en_US&type=5) |
| Automation | Replace OwnerId = guest user with CreatedById | [Default Owner Best Practices](https://help.salesforce.com/s/articleView?id=sf.networks_guest_record_default_owner_best_practices.htm&language=en_US&type=5) |

## Check yourself

- Why do pages left at Site Default Setting stay private on a login-required site?
- Which object permissions can a guest user profile have?
- When does a guest lose access to a record they created?
- Why doesn't a guest sharing rule for one site help guests on another site?

## Sources

- [Control Public Access to Your Experience Builder Sites](https://help.salesforce.com/s/articleView?language=en_US&id=sf.community_builder_page_access_settings.htm&type=5)
- [Give Secure Access to Unauthenticated Users with the Guest User Profile](https://help.salesforce.com/s/articleView?language=en_US&id=sf.networks_public_access.htm&type=5)
- [Best Practices and Considerations When Configuring the Guest User Profile](https://help.salesforce.com/s/articleView?id=platform.networks_guest_profile_best_practices.htm&language=en_US&type=5)
- [Best Practices and Considerations for Using the Guest Record Default Owner](https://help.salesforce.com/s/articleView?id=sf.networks_guest_record_default_owner_best_practices.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Experience Cloud Consultant pack (USD $19): https://www.certifyforce.com/practice-exams