DevHeader - Header Injector & HTTP Header Editor

Add & edit HTTP request and response headers per site. Fix CORS, set profiles, paste-to-add. No sign-up, no paywall.

DevHeader adds and edits HTTP request and response headers on the sites you choose. Built for testing APIs, staging, feature flags, and A/B tests. Free, open source, no account, no paid tiers. Request and response headers Set request headers (Authorization, User-Agent, custom x- headers) and response headers. Response headers let you bypass CORS while developing locally by adding Access-Control-Allow-Origin, or change Content-Security-Policy and Cache-Control without touching the server. Adding headers Type or paste "x-env: staging" and it applies immediately. Paste several lines at once and each becomes its own row. Profiles Group headers into profiles and switch between them. One is active at a time. Search by name when the list grows, and duplicate, rename, or delete in one click. Export and import Save your profiles to a JSON file to back them up, move them between machines, or share a setup with your team. Import loads them straight back. No account needed. Targeting Apply headers to a specific domain (subdomains included), to localhost, or to every site with *. New profiles default to *. Control and privacy A master switch turns all injection on or off. No sign-in, no tracking, no remote code. Your settings stay in your browser's local storage, and the source is open for inspection. How it works DevHeader uses Chrome's declarativeNetRequest API to modify page navigation, fetch and XHR, asset, and WebSocket requests. It runs no content scripts and makes no network calls of its own. Note: requests your SSR server makes on the backend are not browser requests, so your server must forward those headers itself.