Org Configuration Rules

The following table shows the list of Salesforce Org Config rules that are checked by Quality Clouds.

Best Practice Description	Severity	Impact Area
Ratio of Custom Objects to Standard Objects – High	High (if ratio is over 30%)	Manageability
Ratio of Custom Objects to Standard Objects – Medium	Medium (if ratio is over between 20% 30%)	Manageability
Ratio of Custom Objects to Standard Objects – Low	Low (if ratio is between 10% and 20%)	Manageability
Too many Apex Classes (Over 50 – Does not include Test Classes or Downloaded Apps)	Medium	Manageability
Too many Roles (over 20)	Medium	Manageability
Too many branches on Role Hierarchy	Medium	Manageability
Too many Custom Reports over used objects	Medium	Manageability
Too much Views over used objects	Medium	Manageability
Too many Profiles and Permission Sets	Medium	Manageability
Avoid having more than one Apex Trigger per Object	Medium	Manageability
Too many Reports and Views without folder assigned	Medium	Manageability
The percentage of asynchronous classes is too High	Low	Manageability
The instance has more than 5.000 lines od APEX code	Warning	Manageability
Coverage of Unit Tests is less than 75%	Warning	Manageability
Cross-Site Request Forgery (CSRF) protection on GET requests on non-setup pages is disabled	Medium	Security
Cross-Site Request Forgery (CSRF) protection on POST requests on non-setup pages is disabled	Medium	Security
Clickjack protection for non-setup Salesforce pages is disabled	Medium	Security
Clickjack protection for customer Visualforce pages with standard headers turned on is disabled	Medium	Security
Clickjack protection for customer Visualforce pages with standard headers turned off is disabled	Medium	Security
Clickjack protection for setup pages is disabled	Medium	Security
The browser is not prevented from inferring the MIME type from the document content and from executing malicious files	Medium	Security
Cross-domain session information is exchanged using a GET request instead of a POST request	Medium	Security
Protection against reflected cross-site scripting attacks is disabled	Medium	Security
The IP addresses in Login IP Ranges are enforced only when a user logs in	Medium	Security
There is no sessions time out for inactive users	Medium	Security
Visualforce, Salesforce sites, or Communities must use HTTPS	Medium	Security
Prevent Unauthorized used of session ID	Medium	Security
HTTPS is not required to log in to or access Salesforce	Medium	Security
Inactivity Time Warning	Warning	Security
Session Policy – Enable Content Security Policy	Medium	Security
Password policy complexity too weak – No restrictions	High	Security
Password policy complexity too weak – Alphanumeric restriction only	High	Security
Password Policy Expiration too weak – Never	Medium	Security
Password Policy Expiration too weak – Six months	Medium	Security
Password Policy Expiration too weak – One year	Medium	Security
Password Policy Repetition is too weak	Medium	Security
Password Policy Max Login Attempts too wide	Medium	Security
Password Policy Minimum Password Length too weak	High	Security
Password Policy: Obfuscate the Secret Answer	Medium	Security
Password Policy Password Hint contains password	Medium	Security
Avoid using the Attachments Object	Medium	Manageability

What are your Feelings

Still stuck? How can we help?

Updated on March 21, 2025

Configuring ServiceNow Instances

Connecting Salesforce with QualityClouds

Connecting ServiceNow with QualityClouds

Quality Clouds For Salesforce AppExchange 2.0

Rules

What Is Quality Clouds?

Copado integration

Get Started

Live Check Quality for Salesforce - Code Builder extension

Rules for ServiceNow

Applications And Integrations For ServiceNow

Operational Scans

Operational Scans

Quality Clouds For ServiceNow

Quality Clouds For Salesforce

Quality Clouds For Office 365

Code Duplication Rules

Dynamics 365 Best Practices

PMD Rules

Salesforce Rules

Dynamics 365 Rules

By Configuration Elements

DevOps Center Integration

Live Check Quality For Salesforce - Visual Studio Code Extension

Quality Clouds Live Check For Salesforce - Chrome Extension

Quality Center for Salesforce

Vulnerabilities in Open Source Libraries Salesforce

Data Privacy and GDPR O365

Data Privacy and GDPR Salesforce

Org Configuration Rules

What are your Feelings

What are your Feelings

Share This Article :

How can we help?