Question: I have visualforce page that displays information from custom object. I get id from the url and do SOQL query in controller. 
Client wants to send the link to this page (hosted on Salesforce site). What is the best practices for record id? I'm not sure that is good solution to provide link like site.force.com/your\_page?id=salesforce\_id because we are sending original Salesforce id of the record.

Answer: 
For the most part, exposing an ID is completely harmless. The limited exception I'd place on that rule are 00DXXXXXXXXXXXX Id values, which can allow spammers to hit your web-to-lead or web-to-case queues if enabled. Even salesforce.com uses ID values in various places, such as Help & Training, the Developer Forums, etc. For example, here's a question (picked at random) from the Developer Forums:

<https://developer.salesforce.com/forums#!/feedtype=SINGLE_QUESTION_DETAIL&dc=Developer_Forums&criteria=ALLQUESTIONS&id=9060G000000UUKbQAO>

However, what *is* important is to make sure your code runs "with sharing", so that the user can't query or modify a record they shouldn't have access to, and make sure your security model (OWD, FLS, profiles, sharing rules, etc) are correctly configured.
If you want the URL to be in encoded form then you can have a java-script button that will encode the id and will send it to custom attribute with a random name like not a obvious name like '?Id=\*' . Then you can in constructor get the apex parameter value, decode it and run the SOQL.