---
schema_version: "1"
id: 68928f28d1e7a1ea1e390e1814dd634d19f146b4942754f91264850e2e931d68
title: StrictTransportSecurity object
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwr-node/lwr/references/packages-reference/lwrjs-security/stricttransportsecurity.md
canonical_url: https://developer.salesforce.com/docs/platform/lwr/references/packages-reference/stricttransportsecurity.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 3cef7e942525ffe041ff4ed500bc2e8c6eca9c290f4b0a7b116127347b9e1f98
products:
  - Lightning Web Runtime
---
# StrictTransportSecurity object

Use `StrictTransportSecurity` to configure the [`Strict-Transport-Security`](https://developer.salesforce.com/docs/platform/guides/lwr-security.md#strict-transport-security) header.

## Syntax

```
interface StrictTransportSecurity {
   maxAge: number;
   includeSubDomains: boolean;
   preload: boolean;
}
```

## Directives

You can customize these directives for a `Strict-Transport-Security` header. Set values for them in a `StrictTransportSecurity` object.

- `max-age` (number)
- `includeSubDomains` (boolean)
- `preload`
  - Add this directive to request your site to join [Google Chrome's HTTP Strict Transport Security (HSTS) preload list](https://hstspreload.org/). To be eligible, your app has to adhere to all of the submission requirements listed on the HSTS site.

For information about each directive, see [MDN Web Docs: Strict-Transport-Security Directives](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#directives)

## Example

```
"strictTransportSecurity":
  {
    "maxAge": 15552000;
    "includeSubDomains": true;
    "preload": true;
  }
```

**See Also**

- [Guide: @lwrjs/security](https://developer.salesforce.com/docs/platform/guides/lwr-security.md)