Secure options for IIS web.config files to require SSL in cookies and enable strict transport security.

web.config

<?xml version="1.0"?>
<configuration>
  <system.web>
    <httpCookies requireSSL="true" />
  </system.web>

  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Strict-Transport-Security" value="max-age=31536000"/>
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>