---
title: Org Configuration Rules
description: "The following table shows the list of Salesforce Org Config rules that are checked by Quality Clouds. | Best Practice Description | Severity | Impact Area | | --- | --- | --- | | [Ratio of Custom Objects to…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/org-configuration-rules/"
updated: "2025-03-21"
category: By Configuration Elements
---

# Org Configuration Rules

The following table shows the list of Salesforce Org Config rules that are checked by Quality Clouds.

| Best Practice Description | Severity | Impact Area |
| --- | --- | --- |
| [Ratio of Custom Objects to Standard Objects - High](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/ratio-of-custom-objects-to-standard-objects-high/) | High (if ratio is over 30%) | Manageability |
| [Ratio of Custom Objects to Standard Objects - Medium](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/ratio-of-custom-objects-to-standard-objects-medium/) | Medium (if ratio is over between 20% 30%) | Manageability |
| [Ratio of Custom Objects to Standard Objects - Low](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/ratio-of-custom-objects-to-standard-objects-low/) | Low (if ratio is between 10% and 20%) | Manageability |
| [Too many Apex Classes (Over 50 - Does not include Test Classes or Downloaded Apps)](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/too-many-apex-classes-over-50-does-not-include-test-classes-or-downloaded-apps/) | Medium | Manageability |
| [Too many Roles (over 20)](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/too-many-roles-over-20/) | Medium | Manageability |
| [Too many branches on Role Hierarchy](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/too-many-branches-on-role-hierarchy/) | Medium | Manageability |
| [Too many Custom Reports over used objects](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/too-many-custom-reports-over-used-objects/) | Medium | Manageability |
| [Too much Views over used objects](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/too-much-views-over-used-objects/) | Medium | Manageability |
| [Too many Profiles and Permission Sets](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/too-many-profiles-and-permission-sets/) | Medium | Manageability |
| [Avoid having more than one Apex Trigger per Object](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/avoid-having-more-than-one-apex-trigger-per-object/) | Medium | Manageability |
| [Too many Reports and Views without folder assigned](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/too-many-reports-and-views-without-folder-assigned/) | Medium | Manageability |
| [The percentage of asynchronous classes is too High](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/the-percentage-of-asynchronous-classes-is-too-high/) | Low | Manageability |
| [The instance has more than 5.000 lines od APEX code](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/the-instance-has-more-than-5-000-lines-of-apex-code/) | Warning | Manageability |
| [Coverage of Unit Tests is less than 75%](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/coverage-of-unit-tests-is-less-than-75/) | Warning | Manageability |
| [Cross-Site Request Forgery (CSRF) protection on GET requests on non-setup pages is disabled](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/cross-site-request-forgery-csrf-protection-on-get-requests-on-non-setup-pages-is-disabled/) | Medium | Security |
| [Cross-Site Request Forgery (CSRF) protection on POST requests on non-setup pages is disabled](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/cross-site-request-forgery-csrf-protection-on-post-requests-on-non-setup-pages-is-disabled/) | Medium | Security |
| [Clickjack protection for non-setup Salesforce pages is disabled](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/clickjack-protection-for-non-setup-salesforce-pages-is-disabled/) | Medium | Security |
| [Clickjack protection for customer Visualforce pages with standard headers turned on is disabled](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/clickjack-protection-for-customer-visualforce-pages-with-standard-headers-turned-on-is-disabled/) | Medium | Security |
| [Clickjack protection for customer Visualforce pages with standard headers turned off is disabled](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/clickjack-protection-for-customer-visualforce-pages-with-standard-headers-turned-off-is-disabled/) | Medium | Security |
| [Clickjack protection for setup pages is disabled](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/clickjack-protection-for-setup-pages-is-disabled/) | Medium | Security |
| [The browser is not prevented from inferring the MIME type from the document content and from executing malicious files](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/the-browser-is-not-prevented-from-inferring-the-mime-type-from-the-document-content-and-from-executing-malicious-files/) | Medium | Security |
| [Cross-domain session information is exchanged using a GET request instead of a POST request](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/cross-domain-session-information-is-exchanged-using-a-get-request-instead-of-a-post-request/) | Medium | Security |
| [Protection against reflected cross-site scripting attacks is disabled](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/protection-against-reflected-cross-site-scripting-attacks-is-disabled/) | Medium | Security |
| [The IP addresses in Login IP Ranges are enforced only when a user logs in](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/the-ip-addresses-in-login-ip-ranges-are-enforced-only-when-a-user-logs-in/) | Medium | Security |
| [There is no sessions time out for inactive users](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/there-is-no-sessions-time-out-for-inactive-users/) | Medium | Security |
| [Visualforce, Salesforce sites, or Communities must use HTTPS](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/visualforce-salesforce-sites-or-communities-must-use-https/) | Medium | Security |
| [Prevent Unauthorized used of session ID](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/prevent-unauthorized-used-of-session-id/) | Medium | Security |
| [HTTPS is not required to log in to or access Salesforce](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/https-is-not-required-to-log-in-to-or-access-salesforce/) | Medium | Security |
| [Inactivity Time Warning](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/inactivity-time-warning/) | Warning | Security |
| [Session Policy - Enable Content Security Policy](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/session-policy-enable-content-security-policy/) | Medium | Security |
| [Password policy complexity too weak - No restrictions](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-complexity-too-weak-no-restrictions/) | High | Security |
| [Password policy complexity too weak - Alphanumeric restriction only](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-complexity-too-weak-alphanumeric-restriction-only/) | High | Security |
| [Password Policy Expiration too weak - Never](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-expiration-too-weak-never/) | Medium | Security |
| [Password Policy Expiration too weak - Six months](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-expiration-too-weak-six-months/) | Medium | Security |
| [Password Policy Expiration too weak - One year](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-expiration-too-weak-one-year/) | Medium | Security |
| [Password Policy Repetition is too weak](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-repetition-too-weak/) | Medium | Security |
| [Password Policy Max Login Attempts too wide](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-max-login-attempts-too-wide/) | Medium | Security |
| [Password Policy Minimum Password Length too weak](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-minimum-password-length-too-weak/) | High | Security |
| [Password Policy: Obfuscate the Secret Answer](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-obfuscate-the-secret-answer/) | Medium | Security |
| [Password Policy Password Hint contains password](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/password-policy-password-hint-contains-password/) | Medium | Security |
| [Avoid using the Attachments Object](https://qualityclouds.com/documentation/docs/qc/salesforce-rules/avoid-using-the-attachments-object/) | Medium | Manageability |