---
schema_version: "1"
id: 2706edeacf1333ec0ca08ffcd052ef74511463c45f501941bfd7a9d678c0d1ce
title: Visualforce Page Security
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/pages_page_level_security.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.pages_page_level_security.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: deddf8a600a81c03bf40f0eae9f183b73550de9042dab6777147138086fab8a6
description: You can specify which users can execute a particular Visualforce page based on their profile or an associated permission set.
products:
  - Salesforce Platform
release: "264"
---
# Visualforce Page Security

You can specify which users can execute a particular Visualforce page based on their profile or an associated permission set.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Contact Manager</strong>, <strong>Group</strong>, <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

Permission for a Visualforce page is checked at the top level only. Once users can access a page, they can execute all Apex that’s associated with the page. This includes:

- The controller for the page and any Apex classes called from the controller class.
- Any extension classes for the page and any Apex called from an extension.
- Any Apex classes associated with custom components within the page.
- Any classes associated with the page through the use of `apex:include` or `apex:composition`.

For example, if page A depends on a controller that calls an Apex class B, and a user has access only to page A but not class B, the user can still execute the code in page A. Likewise, if a Visualforce page uses a custom component with an associated controller, security is only checked for the controller associated with the page, _not_ for the controller associated with the component.

If users have the “Customize Application” permission, they can access all Visualforce pages in the associated organization. However, they can still have restrictions related to Apex classes. The “Customize Application” permission doesn’t allow users to ignore those restrictions in a Visualforce page unless they have Visualforce page access. Users without the “Customize Application” permission can still view Visualforce page ids and names.

Also, to include Apex in a page, users must have the “Author Apex” permission or access to the Apex class.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_code-264-0-0-production-enus/789bc523-706b-4ae4-8fe9-be6322e38b6b/images/icon_note.png)

Note Organizations with Salesforce Sites or Customer Portals can enable Visualforce pages either by assigning them to user profiles or by enabling them for the entire site.

- **[Set Visualforce Page Security from a Page Definition](https://help.salesforce.com/s/articleView?id=platform.pages_security_page_def.htm&release=264.0.0&type=5)**  
    Set Visualforce page security.
- **[Set Visualforce Page Security from Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_setting_visualforce_access.htm&release=264.0.0&type=5)**  
    Specify Visualforce page access in permission sets.
- **[Set Visualforce Page Security from Profiles](https://help.salesforce.com/s/articleView?id=platform.users_profiles_visualforce_access.htm&release=264.0.0&type=5)**  
    Set Visualforce security directly from a profile to give that profile’s users access to the specified Visualforce page.

#### See Also

- [Security Guidelines for Apex and Visualforce Development](https://help.salesforce.com/s/articleView?id=platform.review_and_certification.htm&release=264.0.0&type=5 "Understand and guard against vulnerabilities in your code as you develop custom applications.")
- [_Visualforce Developer's Guide_](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/)
- [Set Visualforce Page Security from a Page Definition](https://help.salesforce.com/s/articleView?id=platform.pages_security_page_def.htm&release=264.0.0&type=5 "Set Visualforce page security.")
- [Set Visualforce Page Security from Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_setting_visualforce_access.htm&release=264.0.0&type=5 "Specify Visualforce page access in permission sets.")
- [Set Visualforce Page Security from Profiles](https://help.salesforce.com/s/articleView?id=platform.users_profiles_visualforce_access.htm&release=264.0.0&type=5 "Set Visualforce security directly from a profile to give that profile’s users access to the specified Visualforce page.")