---
schema_version: "1"
id: 838e884a09b658c285cf100dfd87c389d8a11df2e629a8980a7775813ad5c752
title: Get Started with Security for Lightning Components
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/get-started/get-started-intro.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/get-started-intro.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 555226f61191f49c2d484920ea334f3625632925cc40977fab9425f36c83dd78
products:
  - Security for Lightning Components
  - lwc
---
# Get Started with Security for Lightning Components

Lightning components, including both [Lightning web components (LWC)](/docs/platform/lwc/guide/get-started-introduction.html) and [Aura components](https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/intro_framework.htm), have a client-side security architectural layer that protects your custom components. This layer prevents components from accessing data that belongs to platform code or components from other namespaces without explicit permission. It automatically blocks or modifies any insecure behavior of APIs.

You can enable either Lightning Web Security (LWS) or Lightning Locker as the security architecture for your org.

- [Lightning Web Security (LWS)](https://developer.salesforce.com/docs/platform/lightning-components-security/lws/lws-intro.md)

  - : Lightning Web Security (LWS) is a newer security architecture that Salesforce first introduced in Spring ’22. LWS is based on the latest [TC39](https://tc39.es/) web standards and prevents unsafe code behavior by running components in virtual JavaScript sandboxes. LWS has fewer restrictions and more functionality than Lightning Locker. New orgs have Lightning Web Security (LWS) enabled by default.

- [Lightning Locker](https://developer.salesforce.com/docs/platform/lightning-components-security/locker/locker-intro.md)
  - : Lightning Locker is the predecessor to LWS. Instead of using virtual JavaScript sandboxes, Lightning Locker wraps JavaScript objects in more secure versions to prevent behavior that isn't secure.

**tip:** To evaluate whether your org is ready to move from Lightning Locker to LWS, check out these resources:

- [Compare Lightning Web Security (LWS) and Lightning Locker Features](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/get-started-compare-lws-locker.md)
- [When to Enable Lightning Web Security](https://developer.salesforce.com/docs/platform/lightning-components-security/lws/lws-when.md)
- [Lightning Web Security FAQ](https://help.salesforce.com/s/articleView?id=000392327&type=1)

Regardless of the security architecture, Lightning components use [JavaScript strict mode](https://developer.salesforce.com/docs/platform/lightning-components-security/js/js-strict-mode-intro.md) to turn on native security features in the browser and [Content Security Policy (CSP)](https://developer.salesforce.com/docs/platform/lightning-components-security/content-security-policy/content-security-policy-intro.md) rules to control the source of content that can be loaded on a page.