Headrule
A ModHeader alternative for Chrome
Modify HTTP headers in Chrome. Nothing else.
Set, add or remove any request or response header, for any URL. No account, no analytics, and no code running inside your pages.
- Free users send zero network requests. Pro sends one kind: the license check. See the only fetch() in the code
- No content scripts. Headers are changed by Chrome's own declarativeNetRequest engine
- Tested in a real Chromium on every commit. See the test runs
Works with Chrome, Edge, Brave and Arc.
Made for the daily grind of API and frontend work
The six jobs people actually install a header extension for, done properly.
Set, append, remove
Any request or response header. Send an Authorization token to staging, fake a User-Agent or Referer, flip a feature-flag header, add CORS headers while you develop locally.
Scope rules to URLs
Leave the filter empty for everywhere, use ||api.example.com for one domain, or a regular expression when you need precision.
Live on the next request
Rules go straight to Chrome's built-in request engine as you type. Nothing to restart, and no background script watching your traffic.
Profiles
Staging, production, client A, CORS debugging. Switch with one click. The toolbar badge shows how many rules are live.
One switch to pause
Flip the toggle or press Alt+Shift+H (Option+Shift+H on a Mac) and every rule is removed until you turn it back on.
Nothing phones home
No analytics, no crash reports, no remote code. The only request Headrule can make is the Pro license check. The source is public, so you can confirm that yourself.
Don't take our word for it. Check it.
A header extension sits next to every request you make, so it has to earn that position. Here is what Headrule does with its access, and where to verify each point.
| What Headrule does | Why, and how to check |
|---|---|
| Asks for access to all sites | Chrome shows this as "read and change all your data on all websites". It is needed because a rule with an empty URL filter has to apply everywhere. Headrule uses it only to hand your rules to Chrome. The manifest declares no content scripts and no webRequest permission, so Headrule never runs code inside the pages you visit. |
| Talks to a server only for Pro | Activating a Pro key, and re-checking it once a week, sends the key and a device label to Lemon Squeezy's license API. That is the single fetch() in the codebase. Free users send nothing. |
| Keeps your rules on your device | Rules live in Chrome's local extension storage. If you turn on Pro sync, they travel through your own Chrome account sync. Headrule has no server and no database of its own. |
| Is made by one developer | Headrule is an independent project with its source on GitHub. Mail to support@headrule.com reaches the developer who maintains it. |
Switching from ModHeader
In July 2026 Google and Microsoft removed ModHeader from their extension stores after security researchers at Stripe OLT reported a dormant browsing-history collector in it. The researchers reported that the collector was switched off in the version they examined (read the report). Headrule is an independently built replacement with no telemetry of any kind.
- If ModHeader still opens in your browser, export your profiles as JSON. If it was uninstalled or no longer opens, its rules cannot be exported, so recreate them in Headrule by hand.
- Install Headrule, open Options → Import profiles, and pick the file. Import is free. Profile names, request and response headers, enabled states, comments and URL filters carry over. A rule whose ModHeader filter cannot be converted (for example an exclude filter) is imported switched off with a note, so nothing is sent where you did not intend.
- Pick the profile in the popup. Done.
What carries over from a ModHeader file, and what to check in any replacement: the full switching guide.
Help
Everything the popup does not explain by itself.
URL filter syntax
| Filter | Matches |
|---|---|
| (empty) | Every request in every tab |
example.com | Any URL containing that text |
||api.example.com | That host and its subdomains, any scheme |
||example.com/v2/* | Paths under /v2/ on that host |
|https://localhost:3000 | URLs starting with that prefix |
regex:^https://api\.(dev|staging)\.example\.com/ | Regular expression (Pro) |
Filters are case-insensitive and use Chrome's declarativeNetRequest urlFilter rules.
Why does "Append" fail on my request header?
Chrome only allows appending to a short list of request headers (Accept, Accept-Language, Cache-Control, Cookie, User-Agent, X-Forwarded-For and a few others). For everything else use Set. Response headers can be appended freely.
Two rules touch the same header
The rule higher in the list wins. Drag is not supported yet; delete and re-add to reorder.
A rule looks right but the header does not change
Another extension is probably changing the same header. Chrome evaluates rules from the most recently installed extension first, so pause or remove the other header extension. Rules Chrome rejects outright, such as an invalid header name, show the exact error under the rule.
Why Headrule needs access to all sites is explained under Check it.
Step-by-step guides
Pricing
Free is enough if one set of rules covers your work. Pro is for people who jump between staging, production and client setups all day.
Free
- Unlimited request and response header rules
- URL and domain filters
- One profile
- Pause switch and keyboard shortcut
- Import and export, including ModHeader files
- No account, no tracking
No signup, no card.
Pro
- Everything in Free
- Unlimited profiles
- Regex URL filters
- Sync profiles through your own Chrome account
- Activate on up to 5 of your browsers
14-day refund. Secure checkout by Lemon Squeezy.
Questions
Does Headrule collect any data?
No. There is no analytics, no crash reporting and no telemetry. The only outbound request is to the license server when you activate or re-check a Pro key, and it contains the key and a device label. Read the privacy policy.
Is Pro a subscription?
No. You pay $9 once and the key does not expire. It works on up to 5 of your browsers, and you can free a slot any time with Deactivate on this browser in Options.
Does it work in Edge, Brave or Arc?
Yes. Any Chromium-based browser that installs extensions from the Chrome Web Store.
What happens to my rules if I uninstall?
They are deleted with the extension. Export them to a JSON file first, or turn on Pro sync to keep a copy in your Chrome account.
Firefox?
Not yet. Firefox's header APIs differ; it is on the list if enough people ask.
How do I get support?
Email support@headrule.com. Include the rule that misbehaves and the URL it should match.