# HeaderDesk

> A header editor for Chrome: add, change or remove HTTP request and response headers per site, in profiles, with a Check view of what was really sent.

Source: https://www.extensionshop.store/extension/headerdesk
Markdown: https://www.extensionshop.store/extension/headerdesk.md

**Modify HTTP request and response headers, per site**

HeaderDesk is a header editor for developers and testers, in a popup or a resizable side panel. Add, change or remove HTTP request headers and response headers with set, append or remove, each row with its own on/off switch and a comment, and with name suggestions and short hints for common headers such as Authorization, Accept-Language, Cache-Control and Content-Security-Policy. Group rows into profiles, several active at once, and drag to reorder: the top profile wins. Scope a profile to all sites, chosen sites or this tab only, and filter by URL pattern or regex, request domain, initiator domain, resource type and HTTP method; "Test a URL" shows which rows apply to an address and why. The Check view shows the request and response headers Chrome really sent and received, so you don't have to guess, and when a header isn't applied the row says why: a missing site permission, a header Chrome ignores, or another extension overriding it. A one-click "Allow CORS" preset adds the Access-Control response headers and is honest about what headers can't fix. Pause everything with one click or Alt+Shift+H. Every edit autosaves, deleted rows and profiles can be undone, and HeaderDesk keeps the last 10 backups locally before every import and update. Export and import profiles as JSON; it also imports profiles exported from ModHeader. Installing shows no "read and change all your data" warning: HeaderDesk asks for the sites a profile uses when you set it up, or all sites in one click if you prefer, and lists every site you allowed with a remove button. It makes no network requests of its own except a test request you click, has no content scripts and no account, and the interface is translated into 51 languages.

## Key facts

- **Category:** Developer Tools
- **Price:** Free
- **Rating:** New — no ratings yet
- **Version:** 1.0.0 (last updated Nov 2026)
- **Size:** 632 KB
- **Developer:** Iliass El Barhoumi
- **Browsers:** Google Chrome and Chromium-based browsers (Edge, Brave, Arc, Opera)
- **Install:** https://chromewebstore.google.com/detail/fdjanlgknhjdbjopjglkicdbfpalgccd
- **Support:** iliasselbarhoumi@gmail.com
- **Privacy policy:** https://www.extensionshop.store/extension/headerdesk/privacy

## Features

- Add, change or remove request and response headers with set, append or remove; each row has its own on/off switch and a comment
- Header name suggestions with a short hint for common headers: Authorization, Accept-Language, Cache-Control, Content-Security-Policy and more
- Check view: the request and response headers Chrome really sent and received, and why a header was not applied (missing site permission, a header Chrome ignores, another extension overriding it)
- Profiles, several active at once; drag to reorder, the top profile wins
- Scope a profile to all sites, chosen sites or this tab only, and filter by URL pattern or regex, request domain, initiator domain, resource type and HTTP method
- Redirect rules: send a URL to another one, or rewrite it with a regex and \1 groups, scoped by the same sites and filters as the headers
- "Test a URL" shows which rows apply to an address, where it redirects, and why
- One-click "Allow CORS" preset for the Access-Control response headers, with its limits explained (no wildcard origin with credentials, no fix for a preflight that fails with an error status)
- Problems flagged on the row as you edit; a broken row is skipped and the rest keep working
- Pause everything with one click or Alt+Shift+H; the badge shows how many headers are active
- Autosave on every edit, undo for deleted rows and profiles, and the last 10 backups kept locally before every import and update
- Cookie helpers: send chosen cookies, or add a Set-Cookie with Path, Domain, Max-Age, SameSite, Secure, HttpOnly and Partitioned, with the browser's rules checked before it is added
- Paste headers as "Name: value" lines (copies from DevTools and curl work), duplicate a profile, or copy one as text to share, with secrets masked
- Keyboard shortcuts to turn your first four profiles on or off
- Export and import profiles as JSON; imports exports from ModHeader, Requestly and Header Editor, and lists anything it could not bring over
- Sensitive values such as Authorization and Cookie are masked on screen and in exports by default
- No install warning: site access is asked per profile when you set it up, and every allowed site is listed with a remove button
- Popup or resizable side panel; interface translated into 51 languages
- No network requests of its own, no content scripts, no analytics, no account

## Permissions and why they are needed

| Permission | Why it is needed |
| --- | --- |
| Modify headers (declarativeNetRequestWithHostAccess) | The core of the extension: applies your header rules through Chrome's declarativeNetRequest API, and only on the sites you allowed. It has no install warning of its own. |
| Site access, only for the sites you allow (optional) | Nothing is granted at install. When you scope a profile, Chrome asks for the sites it targets and the site that makes the requests (Chrome needs both for fetch and XHR), or for all sites if you choose "All sites". Every allowed site is listed in HeaderDesk with a remove button. |
| Active tab | Reads the address of the current tab after you click the toolbar button, so HeaderDesk can offer "this site" as the scope of a new profile. It gives no access to the page itself. |
| Read request headers (webRequest) | Observation only, for the Check view: shows the request and response headers Chrome actually sent and received for requests that match your rules. It listens only while the Check view is open, never blocks or changes a request, and adds no install warning. |
| Storage | Keeps your profiles, header rows, settings, up to 10 automatic backups and a few local usage counts on your device. |
| Side panel | Lets you open HeaderDesk in Chrome's side panel as well as the popup. |

## Privacy

**Data collected:**

- **Profiles and settings (stored locally)** — Your profiles, header rows and settings, and up to 10 automatic backups of them. Header values are stored as you typed them, because they are the rules. Kept in Chrome's extension storage on your device and never sent anywhere.
- **Usage counts (stored locally)** — When HeaderDesk was installed, how many successful changes it has seen, on how many days, and your answers to the optional support and rating cards. Numbers and times only, with no site names and no header data. They stay on your device.
- **Check-view request logs (memory only)** (optional) — The headers of requests that match your active rules, captured only while the Check view is open, with sensitive values masked. Kept in that view's memory, never written to disk, and gone when you close it.

**Never collected:**

- Header values and tokens you type — they stay on your device, and exports mask sensitive values unless you choose to include them
- Page contents — HeaderDesk has no content scripts
- Browsing history — HeaderDesk keeps no list of pages
- Your Google account, name, email or any personal identifiers — there is no account
- Analytics, telemetry or crash reports of any kind
- Data sent to any server — there is no HeaderDesk server, and the only request it makes is the test request you click

**Third-party sharing:** None. HeaderDesk makes no network requests of its own and uses no analytics, SDKs or servers. The one exception is "Send test request", which sends one request to the address you typed, only when you click it. Two links open a normal browser tab only when you click them: the heart or tip button opens the developer's Ko-fi page, and the rating button opens HeaderDesk's Chrome Web Store page. HeaderDesk sends nothing to these sites. Exports are files you ask for, and are never uploaded.

**Data retention:** Profiles, settings, backups and usage counts stay in your browser's extension storage until you change them or remove the extension, which deletes them automatically, and Chrome removes HeaderDesk's header rules with it. Check-view logs are gone when you close the Check view. Allowed sites are kept by Chrome as the extension's site permissions; remove them in HeaderDesk or at chrome://extensions.

## Frequently asked questions

### Why doesn't HeaderDesk ask for access to all sites at install?

Because it doesn't need it. When you scope a profile, Chrome asks for the sites that profile uses. "All sites" is one click if you prefer it, and every allowed site can be removed in HeaderDesk.

### How do I know a header was really sent?

Open the Check view. While it is open it lists the requests on the current tab that match your rules, with the headers as Chrome sent and received them. If a rule matched nothing, it says why: no matching request yet, a scope mismatch, a missing site permission, a header Chrome ignores, or another extension overriding it.

### Why does my header change nothing on an API call?

For fetch and XHR, Chrome applies header rules only when the extension may access both the API's site and the site of the page making the call. HeaderDesk asks for both when you scope a profile and flags the profile when one is missing.

### Can it fix CORS errors?

Often. The "Allow CORS" preset adds the Access-Control response headers your browser checks. It can't fix a preflight that the server answers with an error status, can't use a wildcard origin with credentials, and changes only what your browser sees, not what the server allows. HeaderDesk says so in the preset.

### Can I bring my profiles from ModHeader?

Yes. Import a profile file exported from ModHeader, or HeaderDesk's own JSON. HeaderDesk saves a local backup before every import, so you can restore the previous state. HeaderDesk is not affiliated with ModHeader.

### Does HeaderDesk collect any data?

No. It makes no network requests of its own except a test request you click, has no account and no analytics, and keeps your profiles on your device. Check-view logs live only in memory while that view is open.

## Changelog

- **1.0.0** (Nov 2026) — Initial release. Request and response headers with set, append and remove; redirects (URL or regex); profiles with site, tab and URL filters; Check view of the headers actually sent and received; "Test a URL"; "Allow CORS" preset; pause with Alt+Shift+H; autosave, undo and local backups; JSON export and import, including exports from ModHeader, Requestly and Header Editor; cookie helpers; paste headers, duplicate and share a profile as text; profile shortcuts; per-site access; popup and side panel; 51 languages.