Salesforce Health Check score: how it works and how to raise it

Open Setup → Health Check in most orgs that have been running for a few years and you will see a grade of Poor or worse. It is often the first number an auditor, a security team or a new admin asks about. The good news is that a few settings carry most of the weight, and many can be fixed in an afternoon. The bad news is that a perfect score still leaves most of your real risk unchecked.

This post explains how the score works, what to fix first, how to do it without locking anyone out, and what Health Check does not look at.

How the Health Check score is calculated

Health Check compares your org's security settings with a baseline: the Salesforce Baseline Standard by default, or a custom baseline you upload. Settings that meet or exceed the baseline raise your score, and settings below it lower your score. Salesforce describes the exact formula as proprietary, but it publishes how the pieces are weighted.

Every setting falls into one of four risk categories:

• High-Risk settings count the most.
• Medium-Risk settings count less.
• Low-Risk settings count the least.
• Informational settings are shown but do not affect the score.

If every setting meets the baseline, the score is 100%. Your grade follows from the score:

Salesforce's own guidance by score: 0–33%, fix high risks immediately; 34–66%, fix high risks soon and medium risks over time; 67–100%, review periodically.

Two things that surprise people. New orgs start below 100%, so a low score does not mean someone weakened your settings. And your score can drop without anyone changing anything, because Salesforce occasionally adds new settings to the calculation.

Health Check is available in Professional, Enterprise, Performance, Unlimited and Developer editions. To view it you need View Health Check (or a Security Center permission). Importing a custom baseline needs Manage Health Check.

The high-risk settings to fix first

Because high-risk settings count the most, start here. In the Salesforce Baseline Standard they are:

• Session security: Lock sessions to the domain in which they were first used, and Require HttpOnly attribute.
• Clickjack protection: for Setup pages, for non-Setup Salesforce pages, and for Visualforce pages with standard headers and with headers disabled.
• CSRF protection: on GET and on POST requests on non-Setup pages.
• Login lockout: Maximum invalid login attempts should be 3. 5 or 10 is a warning, and No Limit is critical.
• Device activation: Enable the SMS method of device activation.
• Hybrid file behaviour: no security-risk file types should have hybrid behaviour enabled.
• Expired certificates: none should be expired.
• External access: no object should have its default external access set to Public.

Most of these are checkboxes with no visible effect on users. The ones to test first are clickjack protection on Visualforce pages (a page embedded in another site can stop working) and public external access (an Experience Cloud site may depend on it).

Then the medium-risk settings

These are mostly password and login policies:

• Password policies: minimum length of 8, complexity mixing letters, numbers and special characters, at least 3 passwords remembered, a minimum 1-day lifetime, and passwords that expire in 90 days or less.
• Login controls: Force relogin after Login-As-User, Enforce login IP ranges on every request, and turning off Administrators Can Log In As Any User.
• Browser protections: Content Security Policy protection for email templates, and Content Sniffing protection.

If your users log in through single sign-on, password policies matter less in practice, but they still count towards the score and still apply to anyone who logs in directly (often admins and integration users).

Using Fix Risks without locking people out

On the Health Check page, Fix Risks changes the selected settings to your baseline's recommended values in one step. Salesforce notes that not every setting can be changed with Fix Risks. Anything missing from the Fix Risks screen has to be changed through the Edit link next to that setting.

It is fast, so a few precautions are worth taking:

1. Try it in a full or partial sandbox first, especially clickjack, CSRF and session-locking settings that can affect Visualforce pages, embedded pages and integrations.
2. Warn users before password changes. A shorter expiry period or a stronger complexity rule can send a wave of "change your password" prompts and help desk tickets. Tell people before you save.
3. Check integration users before enforcing login IP ranges on every request. An integration calling from a new IP will start failing.
4. Change in small batches and note what you changed and when, so you can undo one setting rather than guessing.
5. Turn on score notifications. Salesforce can send a weekly notification if your score decreases, so a later change does not go unnoticed.

Custom baselines: when 100% means something else

You can upload up to five custom baselines and pick one in the baseline dropdown. Regulated organisations use this to measure against their own standard, such as FINRA requirements in financial services, instead of Salesforce's.

Be careful with this. A custom baseline that lowers the bar will raise your score without making the org any safer. If your org uses one, ask who approved it and when, and keep that record next to the baseline file.

What a high score does not tell you

Health Check checks org-wide settings. That is useful, but most real Salesforce security problems are about who can do and see what, and Health Check does not look at that. A 100% score can still sit on top of:

• Too many users with Modify All Data, View All Data or Author Apex.
• Profiles and permission sets granting far more object and field access than people need.
• Guest users with read access to sensitive objects (Health Check only counts objects, as an informational item).
• Integration users that never expire, have broad permissions and log in from anywhere.
• Apex classes running without sharing, or flows running in system context.
• Inactive users still holding licences and access.

That is why Health Check is a starting point for a security audit, not the whole audit. Our Salesforce security review checklist covers the rest.

Going beyond the score with orgadmin.ai

Security Review in orgadmin.ai starts where Health Check stops. Its first module reads your Health Check data: it flags a score below 60, lists each high-risk setting with your org's value next to the standard value, and groups the medium-risk ones. Then thirteen more modules check the things Health Check does not, including privileged access, permissions hygiene, object and field-level security, the sharing model, guest and external access, Apex security, automation and flows, and integrations.

• Every finding has evidence. Each one carries a severity, the setting, profile or record behind it, and a recommendation.
• The review only reads. It inspects settings and never changes them, so it is safe to run in production.
• Judgement calls stay with you. A manual-review guide lists the checks a tool should not make alone, including confirming who approved a custom Health Check baseline.
• Track it over time. Triage findings as resolved, accepted or false positive, and re-run each quarter to see what changed.

To clean up the "who can see what" problems it finds, the Permissions Workbench puts profiles and permission sets side by side in one grid of object and field access, so you can stage the fixes and review them before anything is written.

Checklist

• Open Setup → Health Check and note your score, grade and baseline
• Fix every high-risk setting first, testing Visualforce and Experience Cloud pages in a sandbox
• Work through the medium-risk password and login settings, warning users first
• Use Fix Risks for supported settings and Edit for the rest, in small batches
• Turn on weekly notifications for score decreases
• If you use a custom baseline, record who approved it
• Audit privileged access, permissions and guest access, which the score does not cover

Last checked 22 October 2026 against Salesforce Help: Security Health Check and How Is the Health Check Score Calculated? Salesforce adds new settings to the calculation from time to time, so check the current list before an audit.