Salesforce Health Check: How to Read Your Score, and Actually Act on It
Your Salesforce Health Check score is not a compliance stamp. Here is what each dimension really means, what to fix first, and how to close it from "yellow" to green in 30 days.
Most Salesforce admins have opened Health Check, seen a number, and closed it. That is exactly the wrong reaction. The Health Check score is Salesforce's own honest audit of your security posture, and yet it is one of the most-ignored dashboards on the platform. This guide walks through what each dimension means, what the "yellow" and "red" items actually risk, and how to close them in a 30-day sprint that stops feeling like busywork and starts protecting you from a real incident.
What Salesforce Health Check Actually Measures
Health Check compares your org's Session, Password, Certificate and other security settings to Salesforce's Standard Baseline (there is also a stricter High-Assurance Baseline available). It flags every deviation with a severity, High, Medium, Low, Informational, and outputs a score from 0 to 100.
Under 70 is red. 70–89 is yellow. 90+ is green. Below 70 is not just a bad audit result, it usually means your org is one credential leak or a misconfigured Connected App away from a real incident.
The 5 Dimensions That Move the Score Most
- Session settings. Session timeout, IP restrictions, high-assurance session for sensitive operations.
- Password policies. Length, expiration, history, lockout thresholds. Most orgs still run pre-2020 defaults.
- Certificate and key management. Expired certificates and self-signed keys are silent tickets to failure.
- Login access and MFA. MFA is now mandatory, check no exemptions are still lingering.
- Sharing settings and public groups. Not scored directly, but the audit that follows Health Check almost always finds over-permissioned groups.
What to Fix in Week 1
- Remove any MFA exemption on interactive users.
- Set session timeout to 2 hours max (30 minutes for regulated industries).
- Force logout on session timeout and lock sessions to IP.
- Rotate any expiring certificates in the next 60 days.
- Review admin profiles, every "View All Data" and "Modify All Data" needs a justification.
These five changes typically move a 62 to an 82 in a week. The scoring rewards concrete fixes, not projects.
The Yellow Items That Actually Matter
Not all yellow items deserve the same attention. Prioritize:
- Any setting related to Login IP ranges, the fastest way to reduce credential-stuffing risk.
- Password complexity, history and expiration, cheap to fix, real security value.
- Clickjack protection on Visualforce pages, often overlooked, easy to turn on.
Beyond the Score: What Health Check Does Not See
Health Check is a compliance snapshot, not a threat model. It does not catch:
- Over-permissive Connected Apps and their expired refresh tokens.
- Public Sites with broad object exposure.
- Weak sharing rules that leak data across BUs.
- Un-audited AI features (Einstein, Agentforce) reading sensitive data.
A full Salesforce security audit catches all of the above. See our list of Agentforce readiness checks for the AI angle.
How to Sustain the Score
Health Check drifts. Every new feature, every new admin, every acquired subsidiary changes settings. Best practice: run Health Check weekly, treat any score drop > 2 points as a ticket, and re-baseline after every major release (three times a year). Automate the export using Salesforce APIs or a tool like Salesforce Shield.
Regional Notes
- Europe (France, Germany, Belgium, Luxembourg, Switzerland): a Health Check score below 80 is increasingly flagged in DPO audits under GDPR. See our GDPR guide.
- US & Canada: SOC 2, HIPAA and Law 25 audits often require documented remediation of Health Check items. See US, Canada.
Frequently Asked Questions
What is a good Salesforce Health Check score?
90+ is the target. Regulated industries should aim for 95+ using the High-Assurance Baseline.
How often should I run Health Check?
Weekly at minimum, with a full re-baseline after every Salesforce major release (three per year).
Does a green score mean my org is secure?
No. Health Check is one input. Connected Apps, sharing rules and profile permissions are separate audits.
Can Health Check be automated?
Yes, via the Tooling API, many teams pipe the score into Slack and trigger alerts on any drop.
Get a 30-Day Health Check Sprint
Our Salesforce audit includes a Health Check remediation plan and typically moves an org from red to green in 30 days. Book a 30-minute call.
If this sounds like your CRM, let's look at it together.
Thirty minutes, no deck, no pitch. You leave with a diagnosis either way.