ModHeader alternative: what to check before you switch
What happened
On 10 July 2026, Google removed ModHeader from the Chrome Web Store.
On 13 July 2026, Stripe OLT published its analysis of ModHeader 7.0.18, the version then live on the store. The report describes code able to collect browsing history and send it out, dormant in that version: an empty allow-list kept it switched off. Its authors write that they “did not observe active browsing-history exfiltration in this build”.
In 2026, ModHeader also left Microsoft Edge Add-ons: its listing there is no longer available (checked on 18 October 2026).
The report’s advice to people who used it: remove the extension, clear its browser data, and check that browser sync has not brought it back.
Source: Stripe OLT, “Hidden Exfiltration Capability Discovered in a Trusted, 900,000-User Chrome Web store Extension”, published 13 July 2026, updated 10 September 2026.
What to check before choosing a replacement
A header editor has some power over your requests. These checks show how much an extension takes, before and after you install it.
1. The install dialog
When you add an extension, your browser lists what it asks for. A line such as “Read and change all your data on all websites” means the extension can reach every site from the moment it is installed. A header editor does need site access to apply its changes, but it can ask for it later, for the sites you choose: its manifest then lists them under optional_ rather than host_.
2. The content security policy
In the manifest, content_ → extension_pages sets where the extension’s own pages and background script may connect. connect-src 'none' means nowhere; a list of addresses means only those. Without a connect-src directive, the policy does not limit which servers the extension can contact.
3. Code in the pages you visit
content_scripts in the manifest, or the scripting permission, lets an extension run its code inside web pages. Changing headers doesn’t require it: the browser can apply header rules itself (declarative).
How to read an extension’s manifest
How Wirelet answers each point
| Check | Wirelet 1.0.2 |
|---|---|
| Install dialog | No permission to list. Site access is optional: Wirelet asks for it when you switch on a profile, for that profile’s sites (“Only these sites”) or for all sites, and you can refuse. |
| Content security policy | connect-src 'none': no connection to any server. Your profiles stay in your browser’s storage. |
| Code in pages | No content_scripts, no scripting permission. Your browser applies the header rules (declarative). |
Bring your profiles
Wirelet reads ModHeader’s JSON export and says, profile by profile, what it kept, adapted, ignored or switched off: import your ModHeader profiles.
Install Wirelet
Free · Chrome or Microsoft Edge 141 or later · English and French