diff --git a/addons/website_mail/__manifest__.py b/addons/website_mail/__manifest__.py
index 4097c774b6e..d0c73141faa 100644
--- a/addons/website_mail/__manifest__.py
+++ b/addons/website_mail/__manifest__.py
@@ -11,6 +11,7 @@
     'data': [
         'views/website_mail_templates.xml',
         'data/mail_channel_data.xml',
+        'security/website_mail_security.xml',
     ],
     'qweb': [
         'static/src/xml/website_mail.xml'
diff --git a/addons/website_mail/controllers/main.py b/addons/website_mail/controllers/main.py
index c0e8354610d..c10525fd5e0 100644
--- a/addons/website_mail/controllers/main.py
+++ b/addons/website_mail/controllers/main.py
@@ -144,9 +144,6 @@ class WebsiteMail(http.Controller):
         field_domain = request.env[res_model]._fields['website_message_ids'].domain
         domain += field_domain(request.env[res_model]) if callable(field_domain) else field_domain
         domain += [('res_id', '=', res_id)]
-        # None published can see only the published messages
-        if not request.env.user.has_group('website.group_website_publisher'):
-            domain += [('website_published', '=', True)]
         # Check access
         Message = request.env['mail.message']
         if kw.get('token'):
diff --git a/addons/website_mail/security/website_mail_security.xml b/addons/website_mail/security/website_mail_security.xml
new file mode 100644
index 00000000000..0144b11e5ed
--- /dev/null
+++ b/addons/website_mail/security/website_mail_security.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data noupdate="1">
+
+        <record id="mail_message_rule_public" model="ir.rule">
+            <field name="name">mail.message: portal/public: read published messages</field>
+            <field name="model_id" ref="model_mail_message"/>
+            <field name="domain_force">[('website_published', '=', True)]</field>
+            <field name="groups" eval="[(4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
+        </record>
+
+    </data>
+</odoo>