Overview
As part of our ongoing commitment to security and continual product improvement, Payments2Us requires customers hosting Payments2Us forms on Salesforce Sites or Experience Cloud to disable the Lightning Features for Guest Users setting.
This security update helps ensure your organisation's data remains protected and aligns with Salesforce security best practices.
Action Required: Disable (untick) the Lightning Features for Guest Users setting on the Salesforce Site hosting your Payments2Us forms.
Â
Why is this change required?
When Lightning Features for Guest Users is enabled, additional Lightning functionality is available to unauthenticated (guest) users.
While this functionality may be useful in some implementations, it can also increase your organisation's security exposure by providing unnecessary capabilities to public users.
Disabling this setting is an important security hardening measure that:
- Reduces the attack surface of your Salesforce Experience Cloud or Salesforce Sites environment.
- Limits unnecessary functionality available to guest users.
- Helps align your Salesforce environment with security best practices.
- Improves the overall security of your public-facing Payments2Us forms.
Â
Before You Begin
Before disabling this setting, please confirm that none of your public-facing functionality depends on Lightning Features for Guest Users.
If your organisation has custom functionality or Lightning components that require this setting, we strongly recommend:
- Testing the change in a Salesforce Sandbox.
- Verifying all public-facing processes continue to function correctly.
- Contacting Payments2Us Support if you are unsure whether your implementation depends on this setting.
Â
How to Disable Lightning Features for Guest Users
Follow the steps below in Salesforce.
Step 1: Go to your setup within Salesforce by clicking the cog, type ‘Sites’ in the quick find, and then click on ‘All Sites’.Â
Step 2: Then click on the site page that hosts payments2us forms, often called ‘Payment’.
Step 3: Then click on ‘Edit’.
Step 4: Finally, untick the Lightning features for guest users checkbox and click ‘Save’.
Â
Frequently Asked Questions
Why do I need to disable the Lightning Features for Guest Users setting?
Disabling this setting is a mandatory security requirement.Â
Leaving it enabled can increase the functionality available to unauthenticated guest users, which may increase your organisation's security exposure.Â
Disabling the setting is an important security hardening measure that helps reduce the attack surface of your Salesforce Experience Cloud/Sites environment.
Is this change mandatory?
Yes. All customers hosting Payments2Us forms using Salesforce Experience Cloud or Salesforce Sites should disable the Lightning Features for Guest Users setting unless Payments2Us Support has specifically advised otherwise after reviewing your implementation.
Will disabling this setting affect my users?
This setting only affects guest (unauthenticated) users.
If your public-facing pages rely on Lightning functionality for guest users, disabling this setting may impact those features.
We recommend testing the change in a Sandbox before applying it to Production.
How can I determine whether this setting is required for my organisation?
We believe any organisation using Payments2us forms within a Salesforce Sites page should complete this security step. This means if you use public facing Payments2us Forms (including Studio) we recommend making sure this update is completed.
Further to this we would recommend you review your public-facing Experience Cloud or Salesforce Sites implementation to determine whether any guest user functionality depends on Lightning features. If you are unsure, our support team can help assess your configuration and advise on the appropriate course of action.
Â
What should I do before making this change?
Before disabling the setting, we recommend:
•    Reviewing any public-facing pages or processes that use guest user access.
•    Testing the change in a sandbox environment.
•    Confirming that your business processes continue to function as expected before deploying the change to production.
What if my organisation requires this setting to remain enabled?
If you believe your implementation depends on this setting, please contact our support team before making any changes. We can discuss your configuration, discuss alternative approaches where appropriate, and help you implement the most secure solution.
Who should I contact if I need assistance?
If you do not have a Salesforce Administrator or implementation partner, or if you require additional assistance with your Payments2Us configuration, please contact the Payments2Us Support Team. We are happy to help assess the impact of this change and provide guidance where required.
Â