CORS Unblock — HeaderForge by Sapir

Stuck on a CORS error while you build something? Turn it off for that one site, in one click.

HeaderForge adds the Access-Control headers a browser needs, grouped under a single switch you can
flick on and off. It applies to the site you choose — not to everything you browse.

And when headers cannot help, it says so. If the server rejects the preflight (the OPTIONS request
your browser sends first), no extension can fix that from the browser side, and HeaderForge tells
you that plainly instead of leaving you toggling switches. That one sentence is the difference
between ten seconds and an afternoon.

WHAT ELSE IT DOES, ALL FREE
• Set or remove any request or response header — one popup, no signup, rule live in ten seconds
• Each rule says in plain words what it does, so you can read your own rules back
• Block requests, or redirect them, including regex rewriting
• Ready-made presets: User-Agent (desktop, iPhone, Googlebot), remove CSP or X-Frame-Options,
no-cache, X-Forwarded-For
• Limit a rule to certain methods (GET, POST…), to one tab, or to sites you pick
• Profiles: named rule sets, one per project
• Import your ModHeader file as it is
• Works on XHR, fetch and POST, not just page loads

PRIVACY IS THE PRODUCT
• Local-first: rules stay in your browser and are never sent to us
• No analytics, no tracking, no ads, no remote code
• This add-on collects no data, and says so in Firefox's own install prompt
• The only network request: a licence check if you buy Pro, and three test requests to httpbin.org
if you press the test button on the welcome page
• Full policy: https://sapirsoftware.github.io/headerforge-privacy.html

IN SEVEN LANGUAGES
English, Spanish, Portuguese (Brazil), German, French, Japanese and Simplified Chinese — the whole
interface, including what each rule does in plain words and the CORS notice.

FREE vs PRO
Free: everything that changes a request. Unlimited request and response rules, one-click CORS,
presets, block and redirect, method filters, regex matching, profiles, JSON and ModHeader import,
global pause, tab-scoping — and five URL tests a month. Forever, and all of it local.
Pro ($5/month, $39/year or $59 once): test any address against your rules as often as you like,
keep a history of what matched, and use variables like {{token}} in your rules.

HeaderForge is built by Sapir Software — small tools, done right, with nothing to hide.