Firebase security rules that actually restrict

Put a default-deny rule at the top and open up only what you need beneath it. Rules are evaluated per path and an allow anywhere is enough — so a broad rule left in place silently overrides the careful ones.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false;
    }
    match /users/{userId} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

A separate rules file with separate syntax. .read and .write default to false at the root, then scope per user:

{
  "rules": {
    ".read": false,
    ".write": false,
    "users": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid"
      }
    }
  }
}

The Firebase console has a rules playground — run an unauthenticated read against each collection and confirm it is denied.

Then press "I fixed it — re-check" here. We make the same unauthenticated request and tell you what happened.