Salesforce Health Check: The Complete 2026 Guide

A Salesforce health check is a review of your org that finds risks before they cost you. The native Health Check in Setup scores only your security settings. A full org health check also covers data, flows, integrations, performance and licenses.

Clientell AI, the AI Salesforce admin, runs the full check for you. The free, read-only Salesforce health check covers all six areas and returns a ranked fix list within a day.

What is the Salesforce Health Check tool?

Health Check is a free page in Setup. It compares your security settings to a baseline and gives the org a score from 0 to 100 (Salesforce Help: Health Check). The default baseline is the Salesforce Baseline Standard. You can also import your own baseline as an XML file.

Health Check sorts each setting into one of four groups:

Health Check reads password policies, session settings, network access and similar Setup values. It does not read your records, flows or code. A perfect score can sit on top of a broken org.

How do I run the Salesforce Security Health Check?

The native check takes a few minutes. You need the View Health Check permission to see it, and Manage Health Check to import a baseline.

1. Open Setup. Type "Health Check" in the Quick Find box, then click Health Check.
2. Pick the baseline. Keep the Salesforce Baseline Standard unless your security team has its own.
3. Read the score at the top. Note it with the date, so you can track drift.
4. Open the High Risk group first. Each row shows your value next to the baseline value.
5. Click Fix Risks for the simple items, like password and session settings. Review the list before you confirm.
6. Change network access and other sensitive settings one at a time. Test login from your office and from a VPN after each change.
7. Log each change with the old value, the new value and the date. Your auditors will ask for this.
8. Rerun Health Check next month. Settings drift when someone relaxes one for a demo.

A custom baseline can also move a setting to Informational, which takes it out of the score (Software Insights, 04-10-2026). That helps when your policy differs on purpose. It can also hide a real gap, so review who changed the baseline.

What does a full Salesforce org health check cover?

A full org health check is a review of six areas. Each area answers one plain question.

Run the native Health Check as the first half of area one. Then work through the rest with the checklist below.

What should I check in each area?

Security and access

• List every profile and permission set that grants Modify All Data or View All Data. Each one needs a named owner and a reason.
• Check the guest user profile on every Experience Cloud site. Guest users should see only public records.
• Review Organization-Wide Defaults (OWD, the base sharing level for each object) in Setup > Security > Sharing Settings. Public Read/Write on Opportunity is a common surprise.
• Read Setup > Security > View Setup Audit Trail for the last six months. Look for changes made by people who have left.

For a deeper walk-through, see the Salesforce permissions audit.

Data quality

• For each key object, count blank values in the fields your reports depend on, such as Opportunity.CloseDate or Account.Industry.
• Group Contact and Lead records by email to find duplicates.
• Find records with no owner activity in the last year. Decide to archive them or keep them.
• Check picklists for values that mean the same thing, such as "USA" and "United States".

The Salesforce data quality audit runs these checks per object.

Flows and automation

• In Setup, search Quick Find for Paused And Failed Flow Interviews. Every failed run is a record that did not update.
• Set who gets flow error emails in Setup > Process Automation > Process Automation Settings. If nobody gets them, failures go unseen.
• Count the record-triggered flows on each object. Two flows that update the same field on save can fight.
• List any Workflow Rules and Process Builder processes left. Their end of support was 31-12-2025 (Salesforce Help: Past product retirements). Move them to Flow.

The Salesforce flow audit maps overlap and race conditions across flows.

Integrations

• List Connected Apps and their OAuth scopes (the access each app was granted) in Setup > Apps > Connected Apps > Manage Connected Apps. Remove apps nobody owns.
• Check API use in Setup > Company Information. The API Requests line shows how close you are to the daily cap.
• Find integration users that log in as a real person. Give each integration its own user.
• Look for sync errors in the tools that connect, such as your marketing or billing system.

Performance and tech debt

• Read Setup > Storage Usage. Note which objects use the most data storage and file storage.
• Count custom fields per object. Find fields that are blank on nearly every record.
• Run all Apex tests and note any that fail. A failing test can block your next deployment.
• Scan Apex and Lightning code with Salesforce Code Analyzer, a free command line tool from Salesforce.

Licenses

• Compare used and total seats in Setup > Company Information > User Licenses.
• Report on active users where User.LastLoginDate is more than three months old. Each one is a seat to reclaim or a person to retrain.
• Check permission set licenses and feature licenses that are assigned but unused.

The Salesforce license audit lists unused seats by license type.

What happened to Salesforce Optimizer?

Salesforce retired the Optimizer app. Orgs created after 04-08-2025 cannot use it, and Hyperforce orgs lost it with the Winter '26 release (Salesforce Help: Optimizer retirement). Salesforce points admins to Org Check, a free Salesforce Labs app (Salesforce Admins: Optimizer is sunsetting).

If an older checklist tells you to run Optimizer, run Org Check instead.

Which tools help with a Salesforce health check?

Clientell AI makes one of the tools here. The native tools do each slice well and cost nothing. Use them if you have the admin time.

When should I run a Salesforce health check?

Run the native Health Check every month. Run a full org health check at these moments:

1. Before your Salesforce renewal, so you buy the right number of seats.
2. After an admin leaves, so you learn what they built.
3. Before a new project or an AI rollout, so the agent works on clean data.
4. After a data migration or a merger of two orgs.
5. Before a security or compliance audit.

Is it safe to let a tool run a health check on my org?

Clientell AI starts with a read-only scan, so the check itself changes nothing. When you want a fix, it builds it in a sandbox first. You approve each change, and it asks before it changes anything in production. Clientell Platform deployments support rollback. Read how Clientell AI keeps your org safe.

Try it in Clientell AI: "Run a full health check on my org and rank the top ten risks by impact."

Start the 14-day trial, no card needed, or get the free health check first. Want ongoing help after the check? See Salesforce managed services.

Sources

Salesforce documentation

• Health Check
• Salesforce Optimizer app retirement
• Past product and feature retirements
• Optimizer is sunsetting: learn how to use Org Check

Industry research

• Salesforce security audit tools compared

Last reviewed October 2026

Last updated: October 22, 2026