Anonymous
Anonymous is the status of a visitor who is not logged in to Drupal. All of them share user ID 0 and one role, so one permission set governs them.
Anonymous is the status of a visitor who is not logged in to a Drupal site. Drupal represents that visitor as user ID 0 and gives it a single role, also named anonymous. What anonymous visitors can see or do depends only on the permissions you grant to that role. They have no account of their own, so Drupal treats all of them alike.
How it works in Drupal 11
Every request in Drupal runs as some account. For a visitor without a login, that account is an AnonymousUserSession. The interface AccountInterface defines the constant ANONYMOUS_ROLE for the role ID, and its id() method returns 0 for an anonymous account. In code, isAnonymous() and isAuthenticated() answer the question for you.
The installer also creates a row for user 0 in the users table. That row is blocked and has an empty name; a blocked account cannot log in. Its counterpart is user 1, the first real account. The number 0 is covered under UID.
Access follows the role system. The Drupal User Guide describes the split: anonymous users get their permissions from the Anonymous user role, and logged-in users get theirs from the Authenticated user role, which every account receives automatically. Each permission you tick on the Anonymous user role applies to every visitor on the internet.
Example: review what the public can do
Go to People › Roles (/admin/people/roles) and open the permissions of the Anonymous user role. Read the ticked boxes as if a stranger were holding them. In code, the check looks like this:
$account = \Drupal::currentUser();
if ($account->isAnonymous()) {
// Show the sign-in prompt.
}Anonymous visitors and caching
Drupal's Internal Page Cache stores pages for anonymous users. Its documentation says it assumes a page is the same for all anonymous visitors, and that it is a poor fit for pages personalized per session. It also notes that since Drupal 8 the cache updates when content changes, using cache tags, so editors do not wait for old pages to expire. See cache for more.
The session matters here too. Drupal does not start a session for an anonymous visitor until something is stored, which keeps their pages cacheable.
Common mistakes
- Expecting to identify anonymous visitors. They share one identity. Drupal core does not give them separate accounts, so per-person features need a login or a separate tool.
- Granting too much to the role. A permission given to Anonymous user is a permission given to everyone. Review the list after installing a module.
- Personalizing pages for anonymous visitors. The page cache serves the same stored page to all of them.
- Comparing user IDs by hand. Use
isAnonymous()instead of testing for 0 yourself.
For marketing and content teams
Anonymous is your audience before they sign up: first-time readers and search visitors. To see exactly what they see, open the page in a private browser window while logged out. A page that looks right to you as an editor can look different to them, because you hold permissions they do not. When you publish a change, the cached page for anonymous visitors is refreshed by Drupal, so you do not need to clear caches by hand for normal edits.