HeaderSmith
Custom HTTP Request & Response Headers
Add, edit, and remove HTTP request and response headers on any website automatically. Set Authorization tokens, override Content-Type, adjust CORS response headers — all via URL patterns with no DevTools needed.
// screenshots
// overview
HeaderSmith uses Chrome's declarativeNetRequest API to modify HTTP headers on any matching request — automatically, on every page load. Each rule targets either the request or the response, so you can inject an Authorization header on the way out and adjust a CORS header on the way back. Define a rule with a header name, value, operation (Set/Append/Remove), a target (request or response), and a URL pattern. Rules are applied by the browser itself, not by a background listener. Toggle rules on and off without deleting them — perfect for switching between dev and production auth tokens. The free plan lets you create up to 5 rules, and importing your ModHeader rules is unlimited. Pro ($3.00/month) removes the limit entirely.
// features
declarativeNetRequest — No Content Script
Headers are injected by the Chrome browser engine itself, not a content script. This means no page-side code execution, maximum compatibility
Request AND Response Headers
Each rule targets either direction — not just requests. Inject auth headers on the way out, adjust CORS or cache headers on the way back
3 Operations: Set / Append / Remove
Set overwrites the header, Append adds alongside existing values, Remove strips the header entirely — on either direction
URL Pattern Targeting
Use wildcard patterns to target all sites (*), a domain (*://*.example.com/*), or a specific API path
Instant Toggle
Enable or disable any rule with one click. Changes apply immediately to all subsequent requests — no reload needed
Edit in Place
Click Edit on any rule to update the name, URL pattern, header, or value without recreating it from scratch
Free 5 Rules / Pro Unlimited
Start free with 5 rules you create, plus unlimited ModHeader import. Upgrade to Pro for unlimited rules and all future features
// recommended for
- Front-end developers testing APIs that require authentication headers
- QA engineers injecting debug identifiers (X-Test-User, X-Feature-Flag) into requests
- Backend developers overriding Content-Type or Accept headers during integration testing
- DevOps engineers pinning API versions via custom headers during staged rollouts
- Developers adjusting CORS or cache-control response headers while testing against a staging API
// faq
How does HeaderSmith inject headers?
It uses Chrome's declarativeNetRequest API with modifyHeaders rules. This means the browser engine handles the injection — no content script runs on the page. Rules persist across page loads and browser restarts.
Does it affect HTTPS requests?
Yes. declarativeNetRequest operates at the network layer before the request leaves the browser, regardless of protocol.
Will sites know I'm modifying headers?
The server receives the modified headers as part of the normal HTTP request. There's no indication from the browser that the headers were injected by an extension.
Is HeaderSmith free?
The free plan lets you create up to 5 header rules. Rules imported from ModHeader are not capped — you can bring your whole setup over for free. Pro ($3.00/month) removes the limit for unlimited rules.
Can I target only a specific subdomain?
Yes. Use URL patterns like *://api.example.com/* to target a specific subdomain, or *://*.example.com/* to match all subdomains of a domain.
