Header Controller

Request rules

Saved rules

Top rule wins when matching rules set the same header. Different headers combine. Scopes match the exact scheme, host and port; subdomains are separate.

Create rule

Use an origin without a path. * targets all HTTP(S) sites. Site access is requested only when you click Save & grant access.

Request headers

Each switch enables one header. Set operations only. Origin is best effort; verify the actual request in DevTools.

Permissions & boundaries

No browsing logs or telemetry. Rules apply browser-wide to matching destinations, including requests from other sites where Chrome permits. Some cross-origin requests also require access to their initiator. Header values are stored as plain local settings: never enter secrets.

Changing User-Agent does not change navigator.userAgent, Client Hints or browser capabilities. Changing Origin or Referer does not change the document security origin, create an iframe, grant authentication, or fix CORS. Host, Cookie, Authorization, transport headers, Sec-* and Proxy-* are excluded in this tool.