As Salesforce suggested These guest user site profiles are associated to guest user licenses which give the ability to only read/create on standard objects and not update.

Is there any workaround to update Contact standard object from Salesforce Site?

  • I think I have got this functionality and I know it shouldn't be possible....the main vulnerability (I guess) is allowing randoms to update other people contacts, in my form the contact fields are displayed but I lookup the email to see if a record exists. On save I issue an upsert. The site permissions show read/create and the field level permissions show as visible and that's all I've done I think.... If I look at a record via salesforce the feed shows " crm test site guest user changed last name from... To..." So it does seem to work???? Wondering how as the answers are all true...
    – n34_panda
    Apr 5, 2016 at 16:47

3 Answers 3


A solution to this problem is to create a custom object with fields that map to fields on the standard object to be updated and give permission to the guest user to update this new object type. Include a reference to the standard object from this 'shadow' object to form a link between the custom and standard records. Create an insert/update trigger on both the custom and standard objects to keep the 2 in-sync so that when the custom is updated it updates the standard record to match.


You can do this in different ways but the most simple is using the keyword "Without Sharing" in the controller for that page.

public without sharing class yourcontroller {

     //update logic here

More info

  • pretty sure that doesn't work - the guest site user doesn't have update access regardless of permissions granted via sharing Jan 22, 2015 at 18:39
  • We do this to allow the guest user to update their account and it definitely works.
    – PepeFloyd
    Jan 22, 2015 at 18:44
  • Is this guest user logging in though? I don't believe an anonymous guest user sessions on sites can update a standard object? Jan 22, 2015 at 18:58
  • No, the user is not logging in. I actually just verified this works right now.
    – PepeFloyd
    Jan 23, 2015 at 15:55
  • Yeah - that just worked for me too...I stand corrected. I swear that didn't used to work though - I have always ended up using the approach suggested by Richard Durrant... Jan 23, 2015 at 16:30

You could try implementing via an @future method. From the guest site you'd pass your intended field values and contact record id to the @future method, where you would then instantiate a new contact sObject using the id you passed it, and then perform an update.

  • pretty sure that doesn't work - the @future still runs in the context of the guest site user Jan 22, 2015 at 18:38
  • Maybe. Sure Ive done something like this before. Will test. Jan 22, 2015 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .