What you can see natively
One page at a time
Open a page, click the restrictions (padlock) control, and you see who can view and edit it, including whether the restriction came from an ancestor. This is accurate and complete for that page. It does not scale: answering “are we exposed anywhere?” by opening pages one by one is not an audit, it is a sampling exercise you will abandon.
Per space
Space settings include a restricted-pages view scoped to that space. Useful, and the closest native equivalent to what people want — but you must know which space to look in, and you must repeat it for every space on the site. On a Confluence instance with a few dozen spaces this is a morning’s work that is out of date by the afternoon.
Space permissions are a different thing
Worth separating clearly, because it is the most common confusion. Space permissions decide who can get into a space at all. Page restrictions narrow that set for individual pages. Reviewing space permissions tells you nothing about which pages inside are restricted, and vice versa. A complete access picture needs both.
The thing that surprises people: a site administrator cannot necessarily read a page restricted away from them. Restrictions are not an admin-override permission — which is exactly why the ability to at least see which pages are restricted has been requested for so long.
The requests, and what Atlassian is doing
This is not a niche complaint. Read from Atlassian’s public issue tracker in August 2026, four open requests describe it directly:
The one that is In Progress deserves a straight answer
CONFCLOUD-76815 — a REST API returning a list of restricted pages — is marked In Progress. That is worth knowing before you buy anything, so here is the honest reading of it.
It is a building block for developers, not a report for administrators. An endpoint returning restricted pages does not tell you that a restriction points at a deactivated user, does not tell you what changed since your last review, and does not produce a CSV your auditor will accept. It is the raw material.
If you are comfortable writing a script, and all you need is the raw list, that API may well be enough for you once it ships — and you should not buy an app to get something the platform is about to hand you. That is the genuine case for waiting.
If you need the interpretation rather than the data — which restrictions are broken, what changed since last quarter, an export somebody else will read — that is a different job, and the API landing makes tools that do it more accurate rather than redundant.
Why the answer drifts even when nobody edits a page
The reason a one-off audit does not stay true: restrictions name users and groups, and users and groups change underneath them. A restriction set correctly two years ago can be wrong today without anyone touching the page.
- Someone was deactivated. The restriction still names them. They cannot read the page, but they are still listed as though they can — and if they were the only person granted access, nobody can now read it.
- A group was emptied. The restriction points at a group that no longer has members. It looks like a valid restriction and grants access to nobody.
- A user or group was deleted. The restriction now names a principal that does not exist at all.
- Inheritance carried it further than intended. A restriction placed on one parent page silently applies to every page created beneath it afterwards, including pages the original author never saw.
The compounding case is the worst one: if the page that everyone inherits from ends up with no live viewer, every descendant is stranded too — content that exists, that people expect to find, and that only a site admin can now reach.
Inventorying the lot with Warden
Warden is Hullara’s access audit app for Confluence. It does one job: it inventories every view- or edit-restricted page across the whole site and flags the restrictions that have gone wrong. It is read-only — there is no write scope in its manifest at all, so it cannot change a restriction even if you asked it to.
- The inventory. Every restricted page on the site, who can view and edit it, and whether the restriction is set directly on the page or inherited — with the ancestor it came from.
- Red flags. Restrictions naming a deactivated user, an empty group, or an orphaned principal that no longer exists — plus the page-level consequence, no live viewer or no live editor, where every grantee is dead and the page is stranded.
- What changed since last time. From the second scan onwards, a banner reports how many red flags are new and how many were resolved, and each new finding carries a New marker. A quarterly review starts from the diff rather than re-reading the whole inventory.
- A daily re-scan, plus scanning on demand. Scans run in the background so large sites do not time out.
- CSV export of the inventory and of the red flags, UTF-8 with a byte-order mark so it opens cleanly in Excel and Google Sheets.
Run it from Confluence Settings → Apps → Warden — Access Audit.
What it will not do
Stated plainly, because these are the things people assume and then feel misled about.
- It is not a historical change log. A Forge app cannot reconstruct who changed a restriction before it was installed. The “since last scan” diff begins at your second scan — there is nothing to compare against before that.
- It does not fix anything. No remediation, no bulk edit, no “clean up” button. The manifest carries no write scope. You act on the evidence.
- It does not make you compliant. It produces evidence for a review that a human still performs and signs off.
- Deactivated-user detection is best-effort under the Runs on Atlassian constraints. Empty-group and orphaned-principal flags are exact.
- Very large sites hit a page cap, and the report says so with a partial badge rather than pretending it saw everything.
- Hullara is not Cloud Fortified. If your procurement process requires it, Warden does not qualify today.
What it costs
The whole report is free, at any team size — the inventory, the red flags and the daily re-scan, view-only. That is unusually broad and it is deliberate: the report is the thing you need in order to know whether you have a problem at all.
CSV export is the paid part — the deliverable you hand to somebody else. Free for sites of 10 users or fewer, and from $1.10 per user per month above that, tapering with size. An admin can start a free trial from Confluence Settings → Atlassian marketplace → Manage apps.
Warden carries Atlassian’s Runs on Atlassian badge, so it runs and stores its snapshot entirely inside your own Atlassian cloud with no external servers — worth noting for an app whose whole subject is who can see what. Keep it in proportion, though: around a third of the Marketplace carries that badge. It is hygiene, not a reason on its own to choose a tool.
Questions
Also worth reading: who can actually see this Confluence page · access review evidence for Confluence · the Warden user guide.