Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would I got about blocking users from seeing a public site (ie, the guest user profile)?

Could you allow all ranges of ip except theirs?

Is there a way to block by domain?

For clarification, this is a public-only, non-authenticated site, no login.

share|improve this question
By "block by domain" do you mean blocking users from logging in from a certain domain or from even just visiting the site (as a guest user) from a certain domain? – Ryan Guest Feb 12 '13 at 22:15
Ryan, I edited to answer your question. – Shane McLaughlin Feb 13 '13 at 0:05
You do know that application-level IP filtering is considered non-secure, right? You may want to look at other methods of securing your application. A little background on what you're trying to do business-wise may help get better answers. Also, in your question, who is "theirs"? Is it a target group of users you are trying to block, or a target group of users you are trying to allow? – jkraybill Feb 13 '13 at 3:55

Salesforce provides some really good documentation on what is possible using the Public Access Settings for Sites:

  • Set the object permissions for your site. You can grant “Read” and “Create” permissions on all standard objects except products, price books, and ideas; and “Read,” “Create,” “Edit,” and “Delete” on all custom objects. All permissions that aren't set by default must be set manually.


We recommend setting the sharing to private for the objects on which you grant “Read” access for your site. This ensures that users accessing your site can view and edit only the data related to your site.

We also recommend securing the visibility of all list views. Set the visibility of your list views to Visible to certain groups of users, and specify the groups to share to. List views whose visibility is set to Visible to all users may be visible to public users of your site. To share a list view with public users, create a new public group for those users and give them visibility. If the object's sharing is set to private, public users won't be able to see those records, regardless of list view visibility.

  • Control the visibility of custom apps. If you want to expose a custom app and its associated tabs to public users, make only that app visible and make it the default to avoid exposing other pages. If any of your site pages use standard Salesforce headers, other visible applications may be seen by public users.

  • Set the login hours during which users can access the site.

  • Restrict the IP address ranges from which you can access the site. sites ignore company-wide IP range restrictions in order to provide public access; however, you can restrict the IP range here.


To set restrictions based on IP or login hours, HTTPS is required. You must use the secure URL associated with your domain to access your site.

To enforce HTTPS on all sites pages and allow all IP addresses to access your site, create the following IP ranges: to, :: to ::fffe:ffff:ffff, and ::1:0:0:0 to ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff. However, as this may degrade the performance of your site, don't enforce HTTPS unless it is absolutely required. Changing from HTTP to HTTPS doesn't affect logged in users until the next time they log in.

Both IP addresses in a range must be either IPv4 or IPv6. In ranges, IPv4 addresses exist in the IPv4-mapped IPv6 address space ::ffff:0:0 to ::ffff:ffff:ffff, where ::ffff:0:0 is and ::ffff:ffff:ffff is A range can’t include IP addresses inside of the IPv4-mapped IPv6 address space if it also includes IP addresses outside of the IPv4-mapped IPv6 address space. Ranges such as to ::1:0:0:0 or :: to ::1:0:0:0 are not allowed. You can set up IPv6 addresses in all organizations, but IPv6 is only enabled for login in sandbox organizations from the Spring ’12 release and later.

  • Enable Apex controllers and methods for your site. Controllers and methods that are already associated with your site's Visualforce pages are enabled by default.

  • Enable Visualforce pages for your site. Changes made here are reflected on the Site Visualforce Pages related list on the Site Details page, and vice versa.

share|improve this answer
If it forces you to use HTTPS in order to restrict by IP address that might be a deal breaker since that would rule out custom web addresses, because ssl on sites requires using the domain. You can still set the ip restrictions on the guest/site profile, for sure, though... – Peter Knolle Feb 12 '13 at 21:47
I read the docs, but I found the ip restriction section confusing (restricting access vs. restricting logins). – Shane McLaughlin Feb 13 '13 at 0:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.