What are the Guest User Profile security best practices?

The Guest User Profile controls what unauthenticated (public) visitors can see and do. Security best practices:

1. Apply the Minimum Access Principle — grant only the specific object and field permissions required for public pages.
2. Enable Secure Guest User Record Access (in Digital Experiences Settings) to prevent guest users from accessing records they don't own via URL manipulation.
3. Avoid granting guest users access to sensitive objects (Contacts, Accounts) unless strictly required.
4. Use Guest User Sharing Rules cautiously — sharing records with guest users makes them publicly accessible.
5. Restrict Apex class access — only expose Apex classes that are needed for guest-accessible functionality.
6. Regularly audit the Guest User Profile permissions during org security reviews.