HeaderHermit — Header Editor & API Mock

HeaderHermit changes HTTP headers and fakes API responses on the sites you choose — and nothing else. It makes no network requests of its own. SWITCH ENVIRONMENTS IN ONE CLICK • Keep a profile for each environment — Local Dev, Staging, Production — and switch between them from the toolbar. • The toolbar badge shows which profile is on, so a forgotten header never costs you an afternoon. ONE-CLICK PRESETS • Start a profile with a preset: Allow CORS (the CORS response headers), Bearer token (an Authorization: Bearer header), Disable cache, Custom User-Agent, or Mock a JSON API — then edit it like any rule. EDIT REQUEST AND RESPONSE HEADERS • Set, append or remove any request or response header: Authorization, Cookie, CORS, Content-Security-Policy, feature flags and more — with suggestions for common header names and values. • Every mistake is shown right at the field that has it; an empty, unfinished row is simply ignored. • Scope each profile by URL filter or regex, excluded URLs, resource type, method, request domain or initiator domain. • Rules apply in list order and the top rule wins. Mistakes are flagged next to the rule before they reach the browser. • Header rules run on Chrome's built-in rule engine (declarativeNetRequest), inside the browser. MOCK APIS THAT AREN'T READY YET • Answer a URL with the JSON (or other text) body, status code and delay you choose. • Works for the page's own fetch() and XMLHttpRequest calls. The first matching mock wins, and a profile's excluded URLs are never mocked. • Honest limits: these are not mocked — requests a page makes before its first script runs, synchronous XMLHttpRequest, requests from service workers and web workers, image/script/stylesheet/iframe loads, sendBeacon and WebSockets. Pages that were already open need a reload after you turn mocks on. Mocked calls do not appear in DevTools' Network panel, because they never reach the network. BRING YOUR PROFILES WITH YOU • Export and import all profiles as a JSON file. • Also imports ModHeader profile exports, with a clear report of anything that works differently. HeaderHermit is an independent project and is not affiliated with its makers. PRIVATE BY DESIGN • Runs only on sites you allow. Turning a profile on asks Chrome for the site you are on; "Allow on all sites" is there if you want it. Remove access any time in the settings. • No network requests of its own, no account, no analytics, no remote code. Your profiles stay on this device. • The code in the package is readable, not minified. Made by Forgeline.