Modify Headers & Fix CORS — PureHeaders

Modify request & response headers and fix CORS with cookies — only on sites you choose. Profiles, ModHeader import. 100% local.

PureHeaders changes HTTP request and response headers and fixes CORS for the sites you work on — and nothing else. Built for frontend and API developers and QA testers who want a header tool they can trust. FREE • Set, add or remove request headers (Authorization, Accept-Language, User-Agent, Cookie, X-Forwarded-For…) and response headers — up to 6 at a time • Fix CORS with the exact page address instead of "*", with credentials, so requests with cookies and logins work. Methods and your custom headers are allowed automatically • Only the sites you add: rules apply to those sites alone, and CORS is opened only for the pages you list • "Applied here": see which of your rules worked on the open page • Two profiles (for example Dev and Staging), switch in one click • Master switch, auto-off timer (1 or 8 hours) and a counter on the icon, so nothing stays on by accident • URL filters (contains / regex), excluded URLs and request types • Import ModHeader JSON exports (old and new formats) with a clear report of anything that didn't carry over; export and import your own profiles, with or without the values PRO — one-time payment, no subscription • Unlimited headers and profiles, with colors • Redirects: swap a production script or API for your local build (e.g. a CDN file → localhost:3000) • This tab only: test in one tab while the rest of the browser stays normal PRIVATE BY DESIGN • No access to any website at install. Your browser asks once for each site you add; removing a site gives the access back • Rules run in the browser's own engine (declarativeNetRequest). PureHeaders can't read pages, request bodies, your cookie store or your history — it has no content scripts and no "tabs" permission • Profiles and tokens stay in your browser and are never synced to a cloud. Values that look like secrets are masked • No account, no analytics, no remote code or remote configuration. The only network request is a license check with Gumroad when you activate a Pro key • Plain, unminified code; you can see the exact browser rules in Settings GOOD TO KNOW If a server answers the browser's OPTIONS (preflight) check with an error such as 404 or 405, no extension can fix that — the server has to allow OPTIONS. Everything else about CORS, PureHeaders handles.