title: Spring Boot Security: Why Strict-Transport-Security header is not including preload; when preload set to true
body: <p>I have a spring boot application where i have added WebSecurityConfigurerAdapter.
  I want to have the response header strict-transport-security: max-age=16000000; includeSubDomains; preload;
  I have added the below code to the SecurityConfig as:</p>
  <pre><code>@Override
    protected void configure(HttpSecurity http) throws Exception {
    
      http.headers(headers -&gt;
          headers.httpStrictTransportSecurity(hstsConfig -&gt; {
            hstsConfig.preload(true);
            hstsConfig.includeSubDomains(true);
            hstsConfig.maxAgeInSeconds(31536000);
          })
              .contentSecurityPolicy(contentSecurityPolicy -&gt;
                  contentSecurityPolicy
                      .policyDirectives(&quot;script-src 'self'&quot;)
              )
              .addHeaderWriter(new StaticHeadersWriter(&quot;X-My-Custom-Header&quot;,&quot;myvalue&quot;))
      );
  
      http.csrf().disable();
    }
  </code></pre>
  <p>The response header is not adding the &quot;preload;&quot; instead it looks like:</p>
  <p>Strict-Transport-Security: max-age=31536000; includeSubDomains</p>
  <p>Can someone please help me to understand what am I missing here?</p>
  <p>Spring Security Config: v5.4.6</p>
  <p>Thanks</p>