OpenHeader — Modify HTTP Request & Response Headers

Edit the HTTP request and response headers of the sites you choose. No account, no telemetry, no debugger permission.

Your header rules should never stop working without telling you. OpenHeader is a header editor for developers and QA engineers. It adds, replaces and removes HTTP request and response headers on the sites you choose, and every rule shows whether it is being applied right now or exactly why it is not. What you can do: • Modify request and response headers from the same rule: set, append or remove. • Add an Authorization header to a staging API. Change the User-Agent to test a mobile path. Set CORS headers so a local dev server can talk to a remote API. Strip a header you don't want sent. • Match by domain, URL prefix, URL substring, exact URL, or regular expression. Exceptions can use any of those too, including regex. • Rules apply to page loads and to fetch/XHR alike, on every request method including POST. Background requests are covered by default, since a header editor that quietly skips them just looks broken. • Group rules into profiles and switch in one click. More than one profile can be active at a time. • Import an existing header-rule export and get a line-by-line report of what came across. • Export your rules to a file to back them up or share with a colleague. • A snapshot is taken automatically before every import, restore and extension update, with one click to go back. • Alt+Shift+E opens the popup. Everything works from the keyboard. Every rule says whether it is working. A rule is active, off, waiting for site access, or unable to apply. When it can't apply, the reason is written on the rule itself in one sentence: an invalid header name, a regular expression Chrome can't compile, a condition that doesn't say which sites the rule may touch. If Chrome refuses a rule set, or keeps something different from what was installed, you see that too. A rule that cannot work never looks like one that can. What this does not do: • No account. Nothing to sign up for, nothing to log in to. • No telemetry, analytics, crash reporting, advertising, or identifiers of any kind. • No network requests. There is no server behind this extension. Its pages are locked to connect-src 'none', so they cannot open a connection to anywhere at all. • No browser sync. Rules are stored with chrome.storage.local only, because sync storage would copy them, along with any tokens in them, off your device. • No site access at install. The extension starts with access to no website at all. You grant access one site at a time, from a button, when a rule needs it, and you can take it back from the same screen. • No debugger permission, now or optionally. That permission is behind Chrome's most severe install warning and the persistent "started debugging this browser" banner. The only feature that needs it is rewriting response bodies, which this extension does not do. • No redirects, no request blocking, no cookie editing. This edits headers. That is the whole product. Header rules often hold bearer tokens and session cookies. Yours stay on your machine. The only way one leaves is if you export it yourself.