DevHeaderModify Chrome request & response headers, safely
A minimal, local alternative to ModHeader for scoping custom HTTP headers and URL redirects to your dev, staging, and prod domains — with minimal permissions, no remote calls, and no third-party trust.
Why DevHeader exists
ModHeader, a popular HTTP header modification extension, was flagged as malware by Google and removed from the Microsoft Edge store in early July 2026, after researchers found dormant, encrypted domain-harvesting code in a recent build. Separately from that specific incident, its broad <all_urls> host permissions had long been flagged as a general risk, the kind of access a header tool doesn't strictly need for normal development work.
DevHeader is a personal, locally-installed alternative: a minimal extension that modifies HTTP request headers and redirects URLs during local development, without broad permissions, remote calls, or third-party trust. It's available for both Chrome and Microsoft Edge, including the store ModHeader was removed from.
Security principles
No <all_urls>
Host access is scoped to approved domains only, via optional_host_permissions and runtime permission requests.
No network calls out
Rule data never leaves the local machine.
No remote code
Everything is bundled locally with no eval and nothing fetched dynamically.
Least privilege by default
Each rule supports session-only storage via chrome.storage.session for data you don't want to persist.
Self-auditable
The codebase is intentionally small enough to review end to end yourself.
Optional domain scoping
Attach headers only to approved development domains, or apply them globally like a traditional header tool.
See it in action
FAQ
What is a good alternative to ModHeader?
DevHeader is a minimal, local Chrome extension for modifying HTTP request and response headers and redirecting URLs, built as a safer alternative to ModHeader. ModHeader was removed from the Microsoft Edge store in July 2026 after researchers found dormant, encrypted domain-harvesting code in a recent build. DevHeader requests no <all_urls> permission, makes no network calls of its own, and never transmits stored configuration off your machine.
What does DevHeader offer?
DevHeader lets you set, append, or remove HTTP request and response headers; scope rules to specific domains or apply them globally; redirect request URLs via substring or regex find/replace with a live preview; organize domains and rules into named profiles with a one-click switcher; and toggle individual rules on or off without deleting them.
Is DevHeader free?
Yes, DevHeader is free.
Does DevHeader collect data or use analytics?
No. DevHeader does not use analytics, does not sell user data, and does not transmit stored rule data to any external server. All configuration is stored locally in Chrome's extension storage on your machine.
Get started
Running an app on localhost, attach headers like:
X-Tenant-ID: demo-tenant
X-Feature-Flag: new-dashboardonly when requests go to your approved development domain, or apply them globally like a traditional header tool if no domains are configured.
Or rewrite request URLs with a redirect rule, substring or regex find/replace:
Find: api.staging.example.com
Replace: api.example.comscoped the same way as header rules, with a live preview of the rewrite as you type.