I have a basic visualforce page that uses the standard controller for an object (Custom_Object__c). The object is a detail record, with the master being another custom object (Parent_Object__c).

The page simply shows a handful of read-only fields. The page is exposed via a Force.com site.

This is working fine in the sandbox. But in production, the page is logging this error: System.VisualforceException: Read access denied for Custom_Object__c, controller action methods may not execute

I've given the site Guest user Read access to both the child and parent object. I've also created a sharing rule that gives the Guest read-only access to all parent objects, just in case. But no luck. I've also confirmed that the visualforce page has been added as an authorized page in the Site settings.

Normally, I'd assume the Guest user can't use a standard controller after the Summer 20 security changes. But if so, why would this be working fine in the sandbox?

I'm currently comparing security settings between the sandbox and production. I see that "Secure guest user record access" is checked in both environments. Any other ideas?

  • between sandbox and prod, who is owner of the records? and does the sharing rule take that into account (related doc)
    – cropredy
    Nov 7, 2020 at 1:51
  • Good idea. But the owner in both environments is the system admin.
    – JimG
    Nov 7, 2020 at 18:57
  • I checked the Sharing button and confirmed that the parent record shows as being shared to the Guest user via the sharing rule. And the error message seems to say that this is a CRUD access issue. I granted access to sibling and grandparent objects as well, but no luck.
    – JimG
    Nov 8, 2020 at 16:10

1 Answer 1


I ended up using a custom controller instead of a standard controller. Even then, it wasn't working. I finally had to work around Field Level Security by creating variables and putting the field values into them.

//doesn't work, even if granted field access:

//Workaround in controller:
public string someField = Custom_Object__c.Some_Field__c;
//workaround in page:

I'm sure this isn't the best solution. But it's a read-only page and it's the only thing I could get to work. I tried everything else: object access, FLS, sharing rules, debug logs, PageMessages, site settings, etc.

The strangest part is that this was working in the sandbox...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .