I'm seeing this critical update in my environment. According to this, I need to remove the update, delete, View All Data, or Modify All Data permissions enabled for guest users.

On one of my public pages, I'm doing an update on the Contact record. If I remove update permission from the guest user, My end user will not able to update their contact information.

What are the alternatives to this? How can I allow updates on Contacts without giving access to salesforce?


5 Answers 5


Use the Attribute ignoreEditPermissionForRendering = "True" for apex:inputFIeld for the resolution.

Please find the latest release notes.



I was going through this article and found that as a best practice we can give edit access to the guest user using Apex classes running in without sharing mode

The overall recommendation and best practice is to address “Read” and “Create” needs with the permissions on the Guest User Profile, record read visibility via Guest User Sharing Rules, and Edits by Apex methods residing in classes running in without sharing mode.


You need to use a custom controller so the apex executes in system mode.

You also cannot use apex:inputField because Visualforce will infer that you are trying to update a record and will prevent action methods from firing. Use apex:inputText, apex:inputCheckbox, etc.

Create Guest User Sharing Rules to share the records you want the guest user to be able to update.

Perform the updates in a without sharing class.


I had a similar issue and this is how I solved it:

  • I used sharing rules to share the relevant records with "Read Access" to the Guest user. (Write access is not available.)
  • Used IgnoreEditPermissionForRendering = "True" tag for apex:inputField components to render the page.
  • Finally, used a "without sharing" class to do the updates.

Hope this helps!!


This change applies to all Salesforce orgs with one or more standard or custom objects with View All Data, Modify All Data, update, or delete permissions enabled for guest users. Guest users can’t have the update or delete permissions on objects. Guest users can only update or delete records in System Mode. Guest users can’t have View All Data or Modify All Data access on objects.


To give you more time, you can opt-out of this update. Before the Winter ’21 release: Activate the Opt-Out of Enforcing Guest User Object Permission Changes update to keep the permissions unchanged. If you opt-out, your opt-out period is only valid for the Winter ’21 release. With the Spring ’21 release, these permissions are permanently removed for guest users, and can no longer be enabled.


I hope this helps.

  • That I know, my question is what is it's alternative solutions Sep 7, 2020 at 20:54
  • I don't think there is an alternative for it. Sep 8, 2020 at 2:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .