_ _ _ ___ _
| | | | ___ __ _ __| | ___ _ __/ _ \ _ _ __ _ _ __| |_ ___ _ __ ___
| |_| |/ _ \/ _` |/ _` |/ _ \ '__| | | | | | |/ _` | '__| __/ _ \ '__/ __|
| _ | __/ (_| | (_| | __/ | | |_| | |_| | (_| | | | || __/ | \__ \
|_| |_|\___|\__,_|\__,_|\___|_| \__\_\\__,_|\__,_|_| \__\___|_| |___/
"Command your headers. Nothing leaves HQ."
HeaderQuarters is a privacy-focused HTTP header modification Chrome extension. Built with Manifest V3 and the declarativeNetRequest API, it offers powerful control over your HTTP requests and responses without compromising your privacy.
- Quick Add: Add headers in seconds right from the popup, with auto-detection of the current domain.
- Profiles & Rules: Organize header modifications into profiles and define specific rules (set, remove, append).
- Inline Editing: Edit any quick rule in-place — no need to delete and re-create.
- Match Conditions: Target rules precisely using domains, subdomains, wildcards, regex, and resource types.
- Global & Per-Tab Scopes: Apply rules across all tabs or restrict them to specific tabs for the current session.
- Rule Templates: 8 built-in templates (Akamai Debug, CORS, Cache Control, etc.) plus the ability to create your own.
- Profile Drag-to-Reorder: Reorder profiles and rules with drag-and-drop.
- Profile Search & Filter: Quickly find profiles when you have many.
- Keyboard Shortcuts: Open popup, toggle master switch, jump to Quick Add — all configurable.
- Dark/Light Theme: Toggle between dark, light, or system-matched themes.
- Default Tab Preference: Choose whether Profiles or Quick Add opens by default.
- Import & Export: Backup or share profiles. Sensitive data is carefully managed.
- Multi-Language: Available in English, Spanish, French, German, and Japanese.
HeaderQuarters takes your privacy seriously:
- No external network calls: The extension never communicates with any external servers.
- No analytics or telemetry: We do not track you or collect usage data.
- All data stored locally: Everything stays on your device in
chrome.storage.local. - Sensitive headers are masked by default: Values for headers like Authorization, Cookies, or API Keys are hidden in the UI.
- Clone the repository:
git clone https://github.com/thexsa/HeaderQuarters.git - Install dependencies:
pnpm install - Build the extension:
pnpm build - Open Chrome and navigate to
chrome://extensions - Enable Developer mode (top right corner).
- Click Load unpacked and select the
dist/directory.
- Local development: Run
pnpm devfor watch mode with Vite. - Testing: Run
pnpm testfor unit tests andpnpm test:e2efor end-to-end tests. - Release Build: Run
pnpm build:releaseto create an optimized production build. - Verify Release: Compare SHA-256 checksums to ensure reproducible builds.
| Permission | Reason |
|---|---|
storage |
Required for saving configuration (profiles, rules, settings). |
declarativeNetRequestWithHostAccess |
Required for header modification via the DNR API. Chrome manages host access transparently. |
activeTab |
Required for the popup to read the current tab URL to display relevant rules. |
optional_host_permissions: ["<all_urls>"] |
Allows the extension to modify headers on matching sites. Chrome handles permission grants transparently based on the DNR rules in effect — no manual per-site prompts are required. |
- Cannot universally disable CORS: Browser security restrictions prevent complete bypassing of CORS policies.
- Restricted headers: Some headers are completely restricted by Chrome and cannot be modified.
- DNR limits: Declarative Net Request rule limits vary by Chrome version.
- Per-tab rules: Tab-specific rules are temporary and disappear when the tab is closed.
- Append limitations: Appending values to request headers is restricted to 21 allowlisted headers by Chrome.
- Please see SECURITY.md for how to report vulnerabilities privately.
- See CONTRIBUTING.md for contribution guidelines.
This project is licensed under the Apache-2.0 License. See LICENSE for details.
- Firefox support
- Additional match conditions