How to change HTTP headers in Chrome
Header modification is surrounded by more confusion than almost any other browser task. The short version: a web page cannot change its own request headers, an extension can change a defined subset, and anything beyond that needs a proxy. Knowing which category your problem falls into saves hours.
Three different problems people call “changing headers”
- Changing request headers the browser sends — User-Agent,
Accept-Language, custom auth tokens. Used for testing geo behaviour, feature flags and API calls. - Changing response headers the server returns — CSP,
X-Frame-Options, cache directives. Used to reproduce a bug that only appears under a different policy. - Viewing headers, which needs no modification at all and is what most people actually want at first.
DevTools → Network → click a request → Headers shows both directions for any request, including the exact request headers a server received. Start there.
What a web page can and cannot do
JavaScript running on a page has no API to set request headers. fetch() can set some headers on its own requests, but the browser controls the ones that matter for identity: User-Agent, Origin, Referer and Cookie are forbidden header names and are silently ignored if you try to set them. This is a security boundary, not an omission.
For response headers, DevTools Local Overrides can replace a response body, but not arbitrary response headers, and it applies only to your profile.
How extensions do it under Manifest V3
MV3 replaced the old blocking webRequest API with declarativeNetRequest. You declare rules that the browser applies, rather than intercepting traffic in JavaScript. Consequences worth knowing:
- Rules are declarative. The extension cannot compute a header value per request at runtime; it works from static values and a limited set of dynamic rules.
- Host permissions are required for the sites a rule touches. An extension that asks for “all sites” to modify one header is asking for far more access than the job needs.
- Some headers remain off-limits regardless of permission, because the browser protects them.
- This is also the reason many older header extensions broke: they were built on blocking
webRequestand could not be ported cleanly.
Practical check before installing anything: open the extension's permissions and see whether it requests access to every site. A header tool that does is a privacy liability, because it can read everything you browse.
When you genuinely need a proxy
Use a proxy when you need to change protected headers, rewrite headers conditionally on response content, or capture traffic outside the browser as well. Tools like mitmproxy, Charles and Proxyman sit between browser and server and can rewrite anything. They also require installing a certificate to inspect HTTPS, which is a deliberate, invasive step — do it on a test machine, not your daily profile.
For most front-end debugging, a well-scoped extension is enough and much safer than a MITM certificate.
What we built, and why
HeaderGuard Pro is a Manifest V3 header and User-Agent modifier that requests host access per site rather than for everything, keeps rules in local storage, and imports ModHeader profile JSON. It is currently a draft in the Chrome Web Store; the ModHeader comparison explains where it differs.
HeaderGuard Pro
Per-site host access, local rules, ModHeader profile import. Draft in review.
See HeaderGuard Pro →Common questions
- Can I change my User-Agent in Chrome without an extension?
- Only by launching Chrome with the --user-agent command-line flag, which affects the whole browser session and requires restarting it. For per-site or temporary changes, an extension using declarativeNetRequest is the practical route.
- Why does my extension not modify a particular header?
- Either the header is protected by the browser, or the extension lacks host permission for that site. Under Manifest V3, rules only apply where permission was granted.
- Is it safe to install a header-editing extension?
- It depends entirely on permissions. If it requests access to all sites, it can read everything you browse. Prefer tools that ask for specific sites, store rules locally, and do not require an account.