Modify HTTP Headers & CORS Unblock — HeaderForge

HeaderForge is a clean, privacy-first HTTP header modifier for developers, QA engineers, and anyone who tests the web. CREATE RULES IN SECONDS • Set or remove any request or response header — one popup, no signup, rule live in ten seconds • See when a rule actually fired — no more "is my rule even working?" • Pro: watch this tab's requests live and see which rule touched each one • Works on XHR, fetch and POST, not just page loads • Target all sites, only the domains you choose, or just the tab you're on • Toggle rules on and off instantly — no reload needed • Allow CORS for a site in one click, grouped into one switch (and honest about what headers can't fix: a server that rejects the preflight) • When a request on the page you are looking at is refused for CORS reasons, the popup names the server that refused it and offers that one click there and then — free, and it says so plainly when the failure is a rejected preflight that no header can fix • Block requests or redirect them, including regex rewrites • Ready-made presets: User-Agent (desktop, iPhone, Googlebot), remove CSP or X-Frame-Options, no-cache, X-Forwarded-For • Limit a rule to certain methods (GET, POST…) and search your rules BUILT FOR REAL WORKFLOWS • Test auth tokens, feature flags, and A/B variants • Simulate User-Agent, Referer, Accept-Language, and custom headers • Debug CORS, caching, and API behavior • Import/export rule sets as JSON, including ModHeader files • Profiles: named rule sets for different projects • Match URLs by glob or by regular expression — prefix a pattern with re: for the hard cases AVAILABLE IN SEVEN LANGUAGES English, Spanish, Portuguese (Brazil), German, French, Japanese and Simplified Chinese — the whole interface, not just the store page. That includes the parts other extensions leave in English: what each rule does in plain words, the CORS notice, and the report you get after importing a ModHeader file. PRIVACY IS THE PRODUCT • Local-first: rules are stored in your browser and never sent to us. Optional sync copies them to your other computers through Chrome's own Sync, only if you turn it on • The Pro live request list is held in memory only, for the tab you are looking at, and only while the popup is open. It is never saved and never leaves your computer. For each request it keeps the host and path, method, request type, status, time, and for each matching rule the header NAME and whether the change went out — never header values, cookies, query strings, bodies or page content • The free CORS notice comes from that same recording and is held the same way: per tab, in memory, only while the popup is open. Per failing server it keeps only the host name, the origin of the page that asked, whether the preflight was rejected, and the time • No analytics, no tracking, no ads, no remote code • The only network requests: a license check if you buy Pro (on activation, then at most once a day), and three test requests to httpbin.org if you click the test button on the welcome page • Full policy: https://sapirsoftware.github.io/headerforge-privacy.html FREE vs PRO Free: everything that changes a request. Unlimited request AND response rules, one-click CORS with a notice that spots the CORS failure for you, presets, block and redirect, method filters, regex URL matching, profiles, JSON import/export (including ModHeader files), global pause, tab-scoping, and 5 URL tests a month. Forever, and all of it local. Pro ($5/month, $39/year or $59 once): the diagnostics. See how many times each rule actually fired on this tab, watch the tab's requests live with the rule that touched each one and the header going out, test URLs against your rules without limits and keep a history of what matched, and use variables like {{token}} in your rules. It answers "is my rule even working?" — the question every tool in this category leaves you guessing at. HeaderForge is built by Sapir Software — small tools, done right, with nothing to hide.