Modify HTTP Headers & CORS Unblock — HeaderForge

Modify request & response headers, unblock CORS, block or redirect requests, and see which rule fired. Local-only, no tracking.

HeaderForge is a clean, privacy-first HTTP header modifier for developers, QA engineers, and anyone who tests the web. CREATE RULES IN SECONDS • Set or remove any request or response header — one popup, no signup, rule live in ten seconds • See when a rule actually fired — no more "is my rule even working?" • Pro: watch this tab's requests live and see which rule touched each one • Works on XHR, fetch and POST, not just page loads • Target all sites, only the domains you choose, or just the tab you're on • Toggle rules on and off instantly — no reload needed • Allow CORS for a site in one click, grouped into one switch (and honest about what headers can't fix: a server that rejects the preflight) • Block requests or redirect them, including regex rewrites • Ready-made presets: User-Agent (desktop, iPhone, Googlebot), remove CSP or X-Frame-Options, no-cache, X-Forwarded-For • Limit a rule to certain methods (GET, POST…) and search your rules BUILT FOR REAL WORKFLOWS • Test auth tokens, feature flags, and A/B variants • Simulate User-Agent, Referer, Accept-Language, and custom headers • Debug CORS, caching, and API behavior • Import/export rule sets as JSON, including ModHeader files • Profiles: named rule sets for different projects • Match URLs by glob or by regular expression — prefix a pattern with re: for the hard cases PRIVACY IS THE PRODUCT • Local-first: rules are stored in your browser and never sent to us. Optional sync copies them to your other computers through Chrome's own Sync, only if you turn it on • The Pro live request list is held in memory only, for the tab you are looking at, and only while the popup is open. It is never saved and never leaves your computer. For each request it keeps the host and path, method, request type, status, time, and for each matching rule the header NAME and whether the change went out — never header values, cookies, query strings, bodies or page content • No analytics, no tracking, no ads, no remote code • The only network requests: a license check if you buy Pro (on activation, then at most once a day), and three test requests to httpbin.org if you click the test button on the welcome page • Full policy: https://sapirsoftware.github.io/headerforge-privacy.html FREE vs PRO Free: everything that changes a request. Unlimited request AND response rules, one-click CORS, presets, block and redirect, method filters, regex URL matching, profiles, JSON import/export (including ModHeader files), global pause, tab-scoping, and 5 URL tests a month. Forever, and all of it local. Pro ($5/month, $39/year or $59 once): the diagnostics. See how many times each rule actually fired on this tab, watch the tab's requests live with the rule that touched each one and the header going out, test URLs against your rules without limits and keep a history of what matched, and use variables like {{token}} in your rules. It answers "is my rule even working?" — the question every tool in this category leaves you guessing at. HeaderForge is built by Sapir Software — small tools, done right, with nothing to hide.