I would like to understand the difference between protected and public visibility on custom settings.

I know a managed package custom setting is protected and cannot be accessed everywhere from the https://help.salesforce.com/HTViewHelpDoc?id=cs_define.htm&language=en_US, but I'm trying to understand any use case for that.

What happens if I create a custom settings and use protected vs private? Does it allow me to restrict access for users based on visibility or restricts accessing from apex or formulas?

1 Answer 1


There's no difference between public and protected custom settings in an unmanaged package scenario. Anyone with Customize Application can modify the values of the custom settings.

For a managed package, protected completely hides the values from the subscriber. This includes Apex Code, validation rules, workflow rules, flows, Visualforce pages, triggers, custom buttons and links, and any other place you might be able to access custom settings normally.

The usual case for using protected custom settings is to provide a data store that administrators cannot modify. Passwords, encryption keys, license settings, and other things that you simply do not want to allow administrators to modify should be placed in protected custom settings. This includes settings that can be "messed up" if not modified in a controlled manner.

Public custom settings allow administrators to view and modify values, as well as allow them to create code that can manipulate those values. Use public custom settings for things like "user preferences" or other non-sensitive data that isn't vital to your application's operation.

  • Thank you @sfdcfox, understood the difference with great explanation.
    – Anurag
    Jul 7, 2016 at 16:10
  • 2
    @Vignesh no, managed code can access the settings. The purpose is to provide controlled access to the settings.
    – sfdcfox
    Aug 10, 2016 at 7:14
  • 1
    @sfdcfox, one more quick question. Does the custom settings need the FLS CRUD check suggested by checkmarx? Or can we mark it false positive? Aug 10, 2016 at 7:33
  • 1
    @Vignesh it is most definitely a false positive. You can do whatever you want with your own data.
    – sfdcfox
    Aug 10, 2016 at 7:36
  • 1
    @ИскренСтаниславов Credentials should ideally not be exposed in the client, as that could be a security risk. Most of the time, calls should go through Apex, and the settings should only be used on the server. If credentials must be exposed to the client, additional security considerations may be necessary, like whitelisting domains or IP addresses.
    – sfdcfox
    Dec 15, 2023 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .