HeaderForge — rewrite request and response headers on the wire

→ Request headers

Set, remove or append on the way out — auth tokens, API keys, feature flags — each header with its own on/off toggle.

← Response headers

Same operations on the way back: add the CORS header a dev API forgot, or strip aContent-Security-Policy while you debug.

Profiles

Named sets of rules — one per environment, client or bug hunt. All enabled profiles apply at once; earlier profiles win conflicts, so the order is the policy.

URL filters

Scope each profile with "URL contains" substrings (DNR syntax like||example.com^ passes through) or RE2 regexes — validated live as you type.

Presets

Common headers one click away — Bearer token, JSON content type, CORS allow-all, strip CSP — and the name field autocompletes from well-known header names.

Counted & portable

The toolbar badge shows how many headers are live (! flags a rule error). Profiles export and import as validated JSON.

DevTools lies about modified headers

declarativeNetRequest rewrites happen outside the render process, so the Network panel often shows the original headers. The honest check is a real server: add X-Test: hello, visit httpbin.org/headers, and watch it come back in the JSON — proof it went out on the wire. HeaderForge's own test suite verifies exactly this way, against a local echo server.

Install it

Not on the Chrome Web Store (yet) — you load it straight from the source, which also means you can read every line of what runs.

Clone and build:

git clone https://github.com/pearpages/orchard
cd orchard
pnpm install
pnpm --filter @headerforge/extension build

Open chrome://extensions and enable Developer mode.
Click Load unpacked and pick theplugins/headerforge/extension/dist folder.

More plugins by the same hands

Explore the whole orchard