What Is Field-Level Security in Salesforce?
Field-level security (FLS) controls which fields a user can read or edit on records they already have access to. It is enforced in the UI, in reports, and in
Updated 2026-09-09
Field-level security (FLS) controls which fields a user can read or edit on records they already have access to. It is enforced in the UI, in reports, and in the API.
In more detail
FLS is set per field, per profile or permission set. It is a different layer from record access (sharing) and from page layouts.
A field hidden by FLS is invisible everywhere, including SOQL results in user-mode contexts. A field removed from a page layout is only hidden in that layout, and is still returned by the API.
Why it matters for admins
- It is the most common cause of "this field is blank for me" tickets.
- New custom fields are hidden from every profile except System Administrator by default.
- Compliance reviews normally ask for FLS evidence on sensitive fields, so having it readable quickly matters.
Frequently asked questions
- Does field-level security apply to Apex?
- Apex running in system mode ignores FLS unless it uses user-mode database operations or explicit permission checks. Apex running in user mode enforces it.
- What is the difference between FLS and page layouts?
- FLS is a security control enforced across the platform. Page layouts are a presentation control - hiding a field there does not restrict API access to it.
More from the Glossary
- What Is a Permission Set in Salesforce?A permission set is a collection of settings and permissions that extends a user's access without changing their profile. Permission sets are additive: they g
- What Is a Change Set in Salesforce?A change set is Salesforce's built-in, point-and-click mechanism for moving configuration - not data - from one connected org to another, most commonly from a
- What Is a Duplicate Rule in Salesforce?A duplicate rule defines what Salesforce does when a user is about to save a record that looks like an existing one - block it, allow it with a warning, or ju
- What Is a Record Type in Salesforce?A record type lets one object behave differently for different business processes - different page layouts, different picklist values, and different default v
- What Is a Salesforce ID in Salesforce?A Salesforce ID is the unique identifier of a record. It comes in a 15-character case-sensitive form and an 18-character case-insensitive form that is safe fo
- What Is a Sandbox in Salesforce?A sandbox is a copy of your Salesforce org used for development, testing, and training, isolated from production data and users.
Related reading
- Admin How-ToHow to Check Field-Level Security in Salesforce FastCheck field-level security in Salesforce without clicking through Setup: where FLS lives, how it interacts with profiles and permission sets, and faster ways to read it.
- Admin How-ToHow to Compare Two Profiles in SalesforceCompare two Salesforce profiles field by field: the native Setup route, the permission types worth diffing, and how to keep the result auditable.
- Admin How-ToHow to Log In as Another User in SalesforceLog in as another Salesforce user to reproduce a permission issue - the Setup route, the permissions required, and how to switch orgs without losing your place.
- Admin How-ToHow to Monitor Salesforce Logins and EventsMonitor Salesforce login history and event data: where to find failed logins, what the audit trail does and does not record, and what to review weekly.