Experience Cloud Page is blank

An Unauthenticated Experience Cloud landing page which hosts a flow is blank. 

No errors are displayed, no debug logs are produced

Chrome Developer Tools shows very little but has got "ERR_HTTP_RESPONSE_CODE_FAILURE"

I recently produced a Salesforce Experience Cloud site built on Lightning Web Runtime which allows unauthenticated access to a Flow.  The flow does a very lightweight identify verification process, executes few simple queries to display the results to the visitor and logs details of what records are viewed.

Version 1 was developed in a Developer Sandbox, promoted through the test and verification process into UAT and finally production.  Everything was great.

The users liked it and asked for more, so I released V1.1.  Again, developed in a Developer Sandbox and promoted into UAT.  In the Developer Sandbox it worked fine. 

In UAT, you could preview it in the Experience Cloud builder both as an Authenticated User or a Guest User and it behaved exactly as it was supposed to, however, if you visited the site outside preview mode as an unauthenticated user, the page was completely blank. 

We compared the configurations of the two sandboxes line by line and everything was identical

• Experience Cloud settings were the same

• Both LWR sites have the setting "Allow guest users to access public APIs" enabled (see this article for more details)

• Both sandboxes are on the same Salesforce release and patch version 

• The Flow hosted in the sites are the same and both run in System mode giving full data access

• All APEX Code versions are the same (the flow calls a couple of invocable APEX methods)

• The two site guest profiles are identical - same APEX Class Access rights, same object access rights, same Flow access rights

• Inspecting the assigned Guest user showed exactly the same permission sets were added to them both

• Enabling debug mode for the guest user in the UAT sandbox and refreshing the page generated no debug logs

• The UAT site was blank in Chrome, Chrome Incognito, Brave, Safari, and even from an old Windows PC running IE11 or Edge

• Chrome Developer tools showed nothing until you did CRTL-Refresh (or CMD-Refresh) at which point an errror of 404 : ERR_HTTP_RESPONSE_CODE_FAILURE was displayed in the console tab.  The network waterfall showed Salesforce responding to the browser but still no debug logs were generated

Mr Google (or any other search engine) was no help as it gave no results for the error message combined with any of my scenarios. ChatGPT just hallucinated!

So then began the process of elimination:

1. I swapped out the flow for a Screen flow that had just one screen element which displayed a message saying "Hello". 

2. I modified the guest profile to be able to access this flow and republished the Site

3. On visiting the site, the flow ran, it said "Hello" and we got a debug log. At least we were getting somewhere

4. Back in the original flow, I added a "Hello" screen element as the first step in the flow, reconfigured the site to use this flow and tried again. Blank Page again

5. I disconnected every element after the "Hello" screen element, activated the flow and published the site again. It said Hello

6. I then sequentially reconnected each element in the flow, activated the flow and published the site until the blank page returned

7. The step that resulted in a blank page was the execution of an invocable APEX Class

It seems that despite running in System Mode, the flow still runs as the Guest User. Granting the Site's Guest User profile explicit access to the APEX Class fixed the issue in the UAT environment. Now when you inspect the APEX Class's security settings, both the System Administrator profile and the Site Guest Profile have access to the class.

What is really strange is that in the Developer Sandbox, only the System Administrator profile has access to the class, so the line by line comparison would never have answered the question.

I had assumed that if you are using Salesforce and your instances are on the same release, that they would behave the same.

Perhaps not?