Features

Rules

• Set / Append / Remove a request or response header.
• Scope: one site (registrable domain — api.example.com is covered by example.com), all granted sites (*), or another site you type. A bare public suffix (com, co.uk) is refused so a rule can't span a registry.
• URL filter: optional declarativeNetRequest urlFilter syntax.
• First-party only (default): a rule fires for navigations and for the site's own requests. A third-party page embedding the site's resources does not trigger it, so an injected credential never travels on requests you didn't initiate. Opt out per rule for cross-site API calls — the row gets an Any origin badge.
• Installed as dynamic declarativeNetRequest rules: they apply to every resource type including top-level navigations, and persist across restarts. When two rules Set the same header, the later one in the list wins.
• Chrome only allows Append on multi-value request headers (Accept, Accept-Language, Cache-Control, Cookie, User-Agent, X-Forwarded-For…); the editor explains this instead of letting Chrome reject the rule.

Pause and status

• Pause all rules from the header. Rules stay stored, nothing is applied, the stats bar shows PAUSED.
• Per-rule on/off from the row's power toggle, or in bulk.
• The toolbar badge shows how many rules are active, so a header override left on last week stays visible on every page.
• Each row's dot: green = applied on this site; red = applied and credential-like; gray = not applied (disabled, paused, other site, or no access).

Table

• Sort by header or site; search over name, value, site and URL filter.
• Filter by operation, target, status and site.
• Multi-select → enable, disable, export or delete the selection.
• Click a row to edit it inline; Save / Discard in the sticky footer.
• Duplicate a rule (the copy starts disabled) or copy its value.

Presets

One click in the Add form seeds a common header: Authorization, X-Api-Key, Accept-Language, Cache-Control, a mobile User-Agent, X-Forwarded-For, X-Requested-With, X-Debug, Remove Referer, CORS Access-Control-Allow-Origin, Remove CSP, Remove X-Frame-Options. Values are starting points you edit.

Profiles

Save the rules that apply on this site under a name ("Staging auth", "Mobile + German") and switch setups in one click. Loading a profile replaces that site's rules with the saved set; all-sites rules in a profile are added once. Export and import profiles as JSON.

Import / Export

• JSON export of all rules or of a selection.
• Import validates size (≤ 1 MB), count (≤ 500) and shape; entries targeting other sites or all sites are confirmed before anything is written, and "This site only" keeps just the rules scoped to the site you're on.
• An imported rule marked enabled: false stays off.

Credential care

• Mask values: blur credential-like values (Authorization, API keys, tokens, cookies); hover to peek.
• Exporting or copying such values asks first.
• Rules that remove or override a protective response header (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, COOP/COEP/CORP, Referrer-Policy, Permissions-Policy, Set-Cookie) carry a Weakens security badge and an editor hint.

Surfaces

• Popup — 600×600, scoped to the tab you opened it on.
• DevTools panel — scoped to the inspected tab.
• Side panel — the full app docked beside the page, following the active tab. Open it from the popup or with Alt+Shift+H (Chrome 114+).

Site access

Host access is requested per site from a click and listed in Settings → Site access, where any grant can be revoked. A revoked site's rules stay stored but stop applying.