Network Metadata Type for Experience Cloud Sites

Why the Network Metadata Type Is the Security Backbone of Experience Cloud#

Every Experience Cloud site in Salesforce is powered by three interconnected metadata types:

1. CustomSite: Defines the low-level URL path prefix, Guest User Profile, and HTTP domain routing.
2. ExperienceBundle / DigitalExperienceBundle: Stores the Experience Builder pages, components, and branding.
3. Network (networks/<SiteName>.network-meta.xml): Controls Workspaces Administration—who can log into the portal (networkMemberGroups), self-registration rules, password reset emails, Chatter/Topic settings, and whether the site is Live, DownForMaintenance, or UnderConstruction.

Key Metadata Fields on Network#

Real-World XML Example (networks/Partner Portal.network-meta.xml)#

<?xml version="1.0" encoding="UTF-8"?>
<Network xmlns="http://soap.sforce.com/2006/04/metadata">
    <allowInternalUserLogin>true</allowInternalUserLogin>
    <allowMembersToFlag>false</allowMembersToFlag>
    <changePasswordTemplate>unfiled$public/CommunityChangePasswordEmailTemplate</changePasswordTemplate>
    <disablePvtPagesForPwdResetInLWR>true</disablePvtPagesForPwdResetInLWR>
    <emailDomainSubstitutionEnabled>true</emailDomainSubstitutionEnabled>
    <emailSenderAddress>support@acme-partners.example.com</emailSenderAddress>
    <emailSenderName>Acme Partner Support</emailSenderName>
    <enableCustomVFErrorPageOverrides>false</enableCustomVFErrorPageOverrides>
    <enableGuestChatter>false</enableGuestChatter>
    <enableTalkingAboutStats>false</enableTalkingAboutStats>
    <enableTopicAssignmentRules>true</enableTopicAssignmentRules>
    <forgotPasswordTemplate>unfiled$public/CommunityForgotPasswordEmailTemplate</forgotPasswordTemplate>
    <gatherCustomerSentimentData>false</gatherCustomerSentimentData>
    <networkMemberGroups>
        <permissionSet>Partner_Portal_Member_Access</permissionSet>
        <profile>admin</profile>
    </networkMemberGroups>
    <picassoSite>Partner_Portal1</picassoSite>
    <selfRegistration>false</selfRegistration>
    <sendWelcomeEmail>false</sendWelcomeEmail>
    <site>Partner_Portal</site>
    <status>Live</status>
    <tabs>
        <defaultTab>home</defaultTab>
        <standardTab>Chatter</standardTab>
    </tabs>
    <urlPathPrefix>partners</urlPathPrefix>
    <welcomeTemplate>unfiled$public/CommunityWelcomeEmailTemplate</welcomeTemplate>
</Network>

Querying Network and NetworkMember via SOQL#

Both Network and its user membership junction object NetworkMember are standard SOQL objects.

1. Audit All Experience Cloud Sites and Their Status#

SELECT Id, Name, Status, UrlPathPrefix, EmailSenderAddress,
       OptionsSelfRegistrationEnabled, OptionsSendWelcomeEmail,
       LastModifiedDate
FROM Network
ORDER BY Name ASC

2. Count Active Members per Experience Cloud Site#

SELECT Network.Name, COUNT(Id) totalMembers
FROM NetworkMember
WHERE Member.IsActive = true
GROUP BY Network.Name

Senior Architect Best Practices#

• Use Permission Sets Instead of Profiles in networkMemberGroups: Listing Profiles in networkMemberGroups tightly couples site membership to user profiles and forces every profile into your deployment package. Instead, list only admin under <profile> and manage all customer/partner membership via dedicated <permissionSet> entries.
• Environment-Specific emailSenderAddress: Use SFDX string replacements (sfdx-project.json replacements) for <emailSenderAddress> across Sandboxes and Production, and remember that changing emailSenderAddress on an existing site requires clicking the verification link sent to that inbox.

Frequently asked questions

How does the Network metadata type differ from CustomSite and ExperienceBundle?

Network controls Experience Cloud workspace administration (member profiles, permission sets, self-registration, and moderation). CustomSite configures domain/URL routing and the Guest User profile, while ExperienceBundle or DigitalExperienceBundle stores the actual UI pages and theme.

Why does Network deployment fail when updating emailSenderAddress in Production?

When you modify emailSenderAddress on an existing Network, Salesforce sends a verification email to the new address. The metadata value does not commit until that verification link is clicked, whereas first-time Network creation accepts the address immediately.

How do you control which users can log into an Experience Cloud site via metadata?

Inside the Network metadata file, the networkMemberGroups element lists the allowed profile and permissionSet names. Only users assigned one of those profiles or permission sets become members of the Network.

What new LWR and email security fields were added to Network in recent releases?

API version 67.0 added disablePvtPagesForPwdResetInLWR to block authenticated page access while a user resets their password in LWR sites, and API version 68.0 added emailDomainSubstitutionEnabled for sender domain substitution.

Can you query Experience Cloud Networks and their members using SOQL?

Yes. You can query the Network standard object for Status, UrlPathPrefix, and OptionsSelfRegistrationEnabled, and query NetworkMember to find which users belong to each Experience Cloud site.