Skip to main content
A guest portal user is a visitor who reaches your Experience Cloud site without logging in. There is no fusionCore switch for guest access — you enable and scope it through standard Salesforce: the site’s guest user profile and public access settings. fusionCore recognizes a guest at runtime and adjusts what its components display, but what a guest is allowed to see comes down to that guest user profile. To message guests on a page (for example, to prompt them to log in), place the guestUserNotification component on the relevant portal page in Experience Builder.
A misconfigured guest profile can expose orders. fusionCore’s order access check treats every guest user as authorized — it returns true for any guest. fusionCore does not restrict which orders a guest can load. Guest access control is therefore entirely the Experience Cloud guest-profile sharing configuration. Grant the guest profile only the object and record access it strictly needs, and never give the guest profile broad read access to Orders or Financial Events.

​
Prerequisites

  • A portal site already created — see Setting up a Portal Site.
  • A user with admin permissions to manage site settings.

​
How to Configure the Guest User

1

Open the site's guest user preferences

In Setup, search for All Sites in the Quick Find box and select it. Find your portal site and click Workspaces, then open Administration and select Preferences. The guest-access options live here — for example, whether guest users can view asset and library files or access public Chatter API requests.
The Administration Preferences screen for a portal site, with the guest-user file and API access checkboxes highlighted

Guest user preferences in the site's Administration workspace

2

Open the site guest user

Each Experience Cloud site has its own guest user, named Site Guest User, [Site Name] (for example, fusionCore Site Guest User). In Setup, search for Users in the Quick Find box, select it, and open the site guest user. The guest user runs on the site’s guest profile, shown in the Profile field.
The User detail page for the fusionCore Site Guest User in Setup, with the record name highlighted

The site guest user record in Setup

3

Assign the guest permission set group

On the guest user record, go to Permission Set Group Assignments, click Edit Assignments, move fusionCore - Portal Guest User from Available to Enabled, and click Save. Delivered by the fusionCore Layouts package, this group bundles the guest-facing portal permission sets — Checkout and Payment Confirmation, plus Stripe portal access — so you assign one group instead of the individual sets.
The Permission Set Group Assignments screen for the fusionCore Site Guest User, with the fusionCore - Portal Guest User group enabled

Assigning the portal guest permission set group to the site guest user

If your site takes guest payments through Stripe, your implementation may also assign the fusionCore - Stripe Site Guest User group. Both groups are delivered by the fusionCore Layouts package.
4

Review the guest profile's sharing and object access

Before going live, audit the guest profile’s object and record access. Because fusionCore does not restrict guest order access, the guest profile is the only thing standing between a guest and your records. Remove any access the guest does not strictly need.