Anonymous access: permission hierarchy when applied to a space
Asked by Mark:

Hi,

I have some questions based around setting-up anonymous (public) access for spaces/pages within a large company network (behind firewall), as well as how it relates to page access downstream.

* I've seen Atlassian [documentation](https://confluence.atlassian.com/conf610/setting-up-public-access-952622951.html) that references both the terms 'site' and 'space' separately when addressing anonymous access. Are these different? How?
* If a space is setup with 'view only' anonymous access, and I want to restrict a page downstream, will the anonymous setting override the page restriction?
* Can a page be setup with anonymous (public) access, within a space that is not setup for public access?
* Does the space have to be setup first, with pages being restricted individually?
* When working within a company network, setting-up public access will only give access to those within the firewall (in most cases), correct? Not necessarily for users outside of my organization?

Server v6.10

Thanks, I know it's a mouthful, just trying to kill several birds with one stone here.


Answers:
author: Zak Laughton
body: Hi Mark!

I provided answers to your questions below, but I think this document will provide a lot of clarity in this area: [Permissions and restrictions](https://confluence.atlassian.com/doc/permissions-and-restrictions-139557.html). This article covers the different permission methods in Confluence and how the interact.

*"I've seen Atlassian [documentation](https://confluence.atlassian.com/conf610/setting-up-public-access-952622951.html) that references both the terms 'site' and 'space' separately when addressing anonymous access. Are these different? How?"*

Yes, these are different. **Site** refers to the entire site, while **space** refers to a single Confluence space. All pages in Confluence are held in Confluence spaces, which containers you can use to organize and restrict content. For more information, see [Spaces](https://confluence.atlassian.com/doc/spaces-139459.html).

*"If* a space*is* setup*with 'view only' anonymous access, and I want to restrict a page downstream, will the anonymous setting override the page restriction?"*

No. Page restrictions will further restrict the access set in the space permissions. If anonymous users have access to a space, they still will be unable to see a page if the restrictions prevent it.

*"Can a page be* setup*with anonymous (public) access, within a space that is not* setup*for public access?"*

No. In order to see a page, the user must first have permission to the space.

*"Does* the space*have to be* setup*first, with pages being restricted individually?"*

A space will have to be set up first, in the sense that all pages first need a space to be created inside of. By default, all pages will be created without restrictions, which you can then add to pages individually.

*"When working within a company network, setting-up public access will only give access to those within the firewall (in most cases), correct? Not necessarily for users outside of my organization?"*

Correct. If your network only allows internal users to access Confluence, then only users on your network will be able to see it, even if you have anonymous access enabled.

I hope this helps!  
-- Zak

comments: author: Mark
body: Great info and thanks very much for the response!