HeaderForge

HeaderForge modifies HTTP request headers, response headers, and redirects, using Chrome's declarativeNetRequest API. It is built for developers who rewrite headers all day to point requests at a specific environment — a staging lane, a canary lane, a local server — and who want that capability without handing a third party a view of their browsing. WHAT IT DOES • Three rule types per row: request header, response header, and redirect. • Operations set, append, and remove, with a per-rule URL filter, a note, and an enable toggle. Rules apply in list order and can be dragged to reorder. • Presets, one per environment, each with its own colour. Only the active preset applies. Rename, duplicate, bulk enable or disable, and export any preset. • Move config between machines by exporting a local JSON file, or hand a single lane to a colleague by copying it to the clipboard as JSON. Pasting always adds a preset rather than overwriting one. • Global include and exclude domain filters that constrain every rule in every preset. • Search across header name, value, note, and URL filter. • Undo on destructive actions. There is no confirmation dialog anywhere. • Alt+Shift+H toggles every rule off and back on without opening the popup. • English and 简体中文, switchable inside the popup, independent of the language Chrome runs in. • Light and dark, with neither treated as the afterthought. • Imports ModHeader profile exports, one preset per profile. Where a scope cannot be translated exactly, the rule arrives switched off with the original filter kept in its note, so nothing is ever silently widened. WHAT IT DOES NOT DO, BY CONSTRUCTION • No network requests. There is no fetch and no XMLHttpRequest anywhere in the shipped source. The build script refuses to produce a release that contains one. • No telemetry, analytics, crash reporting, or fingerprinting. • No browsing history collection. Your rules are handed to Chrome's own network engine; the extension never sees the requests your browser makes. • No tabs opened, ever — not on install, not on update, not on uninstall. • No content scripts injected into pages. • No account, no server, no cloud sync, no share links. • No ads and no affiliate links. Two permissions, declarativeNetRequest and storage, and there will only ever be two. Adding a third is ruled out by the project's own product constraints. Chrome requires host access for any extension that rewrites headers, and it has to cover every site whose headers you might want to change. That access is used solely to apply the rules you wrote. The source is published and deliberately small enough to read in full before you trust it.