Header Editor – Modify HTTP Response Headers to Test CSP, CORS & HSTS

Modify HTTP response headers to test Content-Security-Policy, CORS, HSTS, and security configurations directly in your browser.

Built for developers and QA engineers who need to validate how websites behave under different header policies — without touching server code, redeploying, or waiting on a pipeline.

Create unlimited named profiles for different projects or test scenarios and switch between them instantly. Use one-click presets to disable CSP, allow all CORS origins, add HSTS, or inject a standard security header set. Every profile stores its own target URL and custom header set, so your staging config and your local config never collide.

How It Works

1. Create a named profile, enter a target URL, and define the response headers you want injected.
2. The extension registers declarative rules via Chrome’s declarativeNetRequest engine.
3. When Chrome receives a response from your target URL, your headers are applied before the browser processes the page.
4. Toggle the profile on or off instantly without reloading the extension. Switching profiles replaces the active rules automatically.

Rules only apply to the specific URLs you configure in your active profile — not to your general browsing. No data is collected, no external calls are made, and all settings remain local to your device.

Key Features

• Unlimited named profiles — one per project, environment, or test scenario.
• Instant profile switching — active rules are replaced automatically, no reload required.
• One-click presets — disable CSP, allow all CORS origins, add HSTS, or inject standard security headers.
• Per-profile target URLs — each profile scopes itself to the URLs you specify.
• Custom header sets — define exactly the headers you need, not just the presets.
• declarativeNetRequest engine — headers are rewritten before the page is processed.
• Fully local — no data collection, no external calls, no account.

Who Should Use This

• Frontend developers testing CSP bypasses, frame options, or referrer policies on local or staging builds.
• Backend engineers verifying CORS and HSTS behavior without redeploying server code.
• Security researchers auditing how a site responds to strict or relaxed security headers.
• QA teams maintaining multiple test configurations across different environments.

Why Test Headers in the Browser

Changing a response header normally means changing server config, deploying, waiting, testing, and deploying again if you got it wrong. For a single-line CSP tweak, that loop can cost an hour. Multiply it across a few directives and a couple of environments, and header work becomes something people avoid rather than something they iterate on.

Rewriting headers client-side collapses the loop to seconds. Draft the policy you’re considering, apply it to your target URL, load the page, see what breaks. Get the header right before you ship it. And because each profile carries its own URL scope and header set, switching from “strict production candidate” to “relaxed local debugging” is one click instead of an environment variable hunt.

Responsible Use

Some presets here — disabling CSP, allowing all CORS origins — turn off genuine security protections. Two things keep that sane, and both are worth using deliberately:

• Scope profiles to specific target URLs, not broad patterns. The per-profile URL field exists so your rules touch your project and nothing else.
• Toggle profiles off when you’re done testing. A relaxed header profile left running is a protection you’ve quietly removed from yourself.

This is a development and testing tool. Point it at builds and environments you own or are authorized to test, and keep your everyday browsing out of scope — a separate browser profile for dev work is a good habit.

Frequently Asked Questions

What does this extension do? It lets you inject or override HTTP response headers on URLs you specify, so you can test how a site behaves under different CSP, CORS, HSTS, and security header configurations without changing server code.

Does it affect all my browsing? No. Rules apply only to the target URLs configured in your active profile. Everything outside that scope is untouched.

What are profiles? Named configurations, each with its own target URL and header set. Create as many as you need — one per project or scenario — and switch between them instantly. Switching replaces the active rules automatically.

What presets are included? One-click presets to disable CSP, allow all CORS origins, add HSTS, and inject a standard security header set. You can also define fully custom headers.

Do I need to reload anything to apply changes? No. Profiles toggle on and off instantly without reloading the extension.

How does it modify headers? It uses Chrome’s declarativeNetRequest engine to rewrite response headers before the browser processes the page — so the page renders as though the server had sent your headers.

Can I test CORS without redeploying? Yes. That’s a core use case. Apply an allow-origins header to your target URL and check the behavior immediately, then take the verified config back to your server.

Is it safe to leave a relaxed profile enabled? Not really. Presets like disabling CSP or allowing all origins remove real protections, so scope profiles tightly to your target URLs and toggle them off when you’re finished testing.