Headrule
Modify HTTP headers in Chrome. Nothing else.
Add, set or remove request and response headers for any URL. Rules apply instantly. No account, no analytics, no remote code. Your ModHeader profiles import in one click.
Get Headrule, it's free Pro is $9, onceManifest V3 · Built on declarativeNetRequest · Works with Chrome, Edge, Brave and Arc
The Chrome Web Store listing is in review. Until it is live you can install Headrule from the GitHub repository.
Made for the daily grind of API and frontend work
The six things people actually use a header extension for, done properly.
Set, append, remove
Any request or response header. Authorization tokens, custom feature flags, User-Agent, Referer, CORS headers during local development.
Scope rules to URLs
Leave the filter empty for everywhere, use ||api.example.com for one domain, or a regular expression when you need precision.
Instant, no reload
Rules are handed to Chrome's native request engine the moment you type. No page refresh, no background script watching your traffic.
Profiles
Staging, production, client A, CORS debugging. Switch with one click. The toolbar badge shows how many rules are live.
One switch to pause
Flip the toggle or press Alt+Shift+H and every rule is removed until you turn it back on.
Private by design
Headrule cannot read page content. It never contacts a server except the license check when you activate Pro. The source is public for audit.
Switching from ModHeader
ModHeader was removed from the Chrome and Edge stores in July 2026, after a published analysis by Stripe OLT reported hidden data-collection code in the extension. Headrule is a clean, independently built replacement with no telemetry of any kind.
- If you still have ModHeader installed, open it and export your profiles as JSON. If it is already gone, your rules are unfortunately gone with it.
- Install Headrule, open Options → Import profiles, and pick the file. Request and response headers, enabled states and comments carry over. (Import is a Pro feature; the free tier lets you recreate rules by hand.)
- Pick the profile in the popup. Done.
Help
Everything the popup does not explain by itself.
URL filter syntax
| Filter | Matches |
|---|---|
| (empty) | Every request in every tab |
example.com | Any URL containing that text |
||api.example.com | That host and its subdomains, any scheme |
||example.com/v2/* | Paths under /v2/ on that host |
|https://localhost:3000 | URLs starting with that prefix |
regex:^https://api\.(dev|staging)\.example\.com/ | Regular expression (Pro) |
Filters are case-insensitive and use Chrome's declarativeNetRequest urlFilter rules.
Why does "Append" fail on my request header?
Chrome only allows appending to a short list of request headers (Accept, Accept-Language, Cache-Control, Cookie, User-Agent, X-Forwarded-For and a few others). For everything else use Set. Response headers can be appended freely.
Two rules touch the same header
The rule higher in the list wins. Drag is not supported yet; delete and re-add to reorder.
Some headers cannot be changed
Chrome refuses to modify a few headers for security reasons (for example Host and headers set by other extensions with higher priority). Headrule shows the exact error under the rule.
Why does Headrule ask for access to all sites?
Because a header rule with an empty URL filter has to apply to every site. Chrome's permission model does not let an extension ask for "just the sites you add rules for" without a prompt on each one. Headrule uses that access only to pass your rules to Chrome; it does not read pages.
Pricing
Free covers most daily use. Pro is a single payment through Lemon Squeezy, with a 14-day refund if it does not fit.
Free
- Unlimited request and response header rules
- URL and domain filters
- One profile
- Pause switch and keyboard shortcut
- No account, no tracking
Pro
- Everything in Free
- Unlimited profiles
- Regex URL filters
- Import and export (including ModHeader files)
- Sync profiles across your Chrome devices
- Use on all your own browsers
Questions
Does Headrule collect any data?
No. There is no analytics, no crash reporting and no telemetry. The only outbound request is to the license server when you activate or re-check a Pro key, and it contains the key and a device label. Read the privacy policy.
Does it work in Edge, Brave or Arc?
Yes. Any Chromium-based browser that installs extensions from the Chrome Web Store.
What happens to my rules if I uninstall?
They are deleted with the extension, unless you exported them or have Pro sync on. Export first.
Firefox?
Not yet. Firefox's header APIs differ; it is on the list if enough people ask.
How do I get support?
Email support@headrule.com. Include the rule that misbehaves and the URL it should match.