ModHeader Chrome Extension Was Removed: What Happened and How to Modify Headers Safely

If you searched for ModHeader to install it, stop there. Microsoft pulled ModHeader from the Edge Add-ons store on July 3, 2026, and Google removed it from the Chrome Web Store on July 10. Researchers had found a hidden browsing-data collector inside the official, store-signed build. When we checked on October 16, 2026, the Chrome, Edge, and Firefox listings were all gone, even though ModHeader’s own website still shows “Add to Chrome” buttons that lead nowhere.

We first published this page in December 2024 as a ModHeader tutorial that told you to paste bearer tokens and session cookies into the extension. That advice is now wrong, so we’ve rewritten it. Below: what researchers found, how to remove ModHeader and clean up, and how to do every job you used it for (auth headers, user agents, cookies, CORS checks) without an extension that can read every page you open.

What researchers found in ModHeader 7.0.18

Stripe OLT published its analysis of the extension on July 13, 2026. It examined version 7.0.18, the release live in the Chrome Web Store on July 6, and verified the code against Google’s own store signature. This was the real extension, not a counterfeit copy.

Here’s what that report and The Hacker News coverage describe:

The dormant part matters, and it cuts both ways. Nobody has shown that ModHeader ever uploaded a single domain. But the upload code, the key, and the schedule all shipped in the signed build. A routine update could have filled the allow-list and switched collection on with no new permission prompt, because the extension already had access to every site.

The Hacker News also reported that the header-history feature stored full HTTP headers on disk. If you kept an Authorization: Bearer value or a session cookie in ModHeader, treat it as exposed. The developer had not responded publicly when the research came out.

Still have ModHeader installed? Remove it and clean up

Pulling a store listing doesn’t remove the extension from browsers that already have it. Do this on every machine and browser profile you use:

1. Open chrome://extensions (or edge://extensions in Edge).
2. Turn on Developer mode in the top-right corner so extension IDs show.
3. Find ModHeader with the ID idgpnmonknjnojddfkpgkljpfnnfcklj and click Remove. Uninstalling also clears the extension’s stored data, including its header history.
4. Check that browser sync or a company policy won’t reinstall it on next launch.
5. Rotate every secret you ever put in it: API keys, bearer tokens, and session cookies. Start with production credentials.

If you manage browsers for a team, go further. Add the ID to Chrome’s ExtensionInstallBlocklist policy so nobody can install it again:

{
  "ExtensionInstallBlocklist": ["idgpnmonknjnojddfkpgkljpfnnfcklj"]
}

Then block and log stanfordstudies.com and extensions-hub.com at your DNS resolver or proxy, and search your logs for any POST to api.stanfordstudies.com/app/log. Stripe OLT’s report includes ready-made hunting queries for Microsoft Defender and Sentinel.

What you used ModHeader for, and what to use now

ModHeader was popular because it did one simple thing: add or change HTTP headers on requests your browser sends. Most of those jobs were really API testing jobs, and an API client handles them without handing an extension your whole browsing session.

The first four are API jobs. The last two change how a web page behaves, and Chrome’s built-in tools now cover them.

Test API headers in Apidog instead of a browser extension

Apidog is a desktop client for designing, debugging, and testing APIs. Requests run from the app, so your tokens never pass through a browser extension that can see every tab.

Send an auth header without exposing the token

Store the token as a variable instead of typing it into a header:

1. Create an environment (for example, Staging) and add a variable named token.
2. Put the real value in the variable’s local value. Local values stay in your client’s cache and never sync to your team or the cloud.
3. On a request, open the Auth tab, choose Bearer Token, and enter {{token}}.
4. Click Send, then open the Actual Request tab in the response panel. It shows the exact headers that went out, with the variable resolved.

If every endpoint needs the same header, set it once as a global parameter in Environment Management. Global headers fill in wherever an endpoint doesn’t set its own value, which is the ModHeader “profile” idea done safely. Our guide to environments and secret variables covers the full dev, staging, and prod setup. Not sure which scheme your API expects? See Basic Auth vs Bearer Token.

Move a request out of the browser

Most ModHeader sessions started with a request the browser was already making. You can lift that request straight into Apidog:

1. In Chrome DevTools, open the Network panel and reload the page.
2. Right-click the request and choose Copy > Copy as cURL.
3. In Apidog, open Import cURL from the menu next to the search box (or use the Ctrl+I shortcut), paste, and click OK.

You now have the request with every header the browser sent, and you can edit any of them. Here’s the kind of request people built in ModHeader, written as cURL:

curl "https://api.example.com/v1/profile" \
  -H "Authorization: Bearer $STAGING_TOKEN" \
  -H "User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X)" \
  -H "Origin: https://untrusted.example" \
  -i

The -i flag prints the response headers, so you can see right away whether Access-Control-Allow-Origin came back for that origin. If CORS is the real problem, our guide to fixing CORS errors walks through the server side.

Turn header checks into tests

ModHeader made you flip toggles and eyeball the result. In Apidog, you save those checks as a test scenario and let them run without you. A typical header suite has three cases:

Add each check under Post Processors as an assertion. Our API assertions guide covers the condition types.

Once the scenario passes in the app, run it from the terminal or CI with the Apidog CLI:

apidog run --access-token $APIDOG_ACCESS_TOKEN \
  -t <scenario_id> -e <env_id> \
  --env-var "token=$STAGING_TOKEN" \
  -r cli

-t picks the scenario, -e picks the environment, and --env-var injects the token from your CI secret store at runtime, so it never sits in a file. The Apidog CLI CI/CD guide has copy-paste pipelines for GitHub Actions, GitLab CI, Jenkins, CircleCI, and Azure Pipelines.

Change headers inside a web page with Chrome DevTools

Some jobs really do happen inside the page: checking how a site renders for a phone, or trying a stricter Content Security Policy before you ship it. Chrome DevTools covers the common cases with no extension at all.

Response headers. Use Local Overrides. Set up an overrides folder, then in the Network panel right-click a request and choose Override headers. Edit or add a header such as Content-Security-Policy or Access-Control-Allow-Origin, and reload. DevTools serves your version until you turn overrides off.

User agent. Open the Command Menu (Ctrl+Shift+P, or Cmd+Shift+P on macOS), run Show Network conditions, clear Use browser default under User agent, and pick a preset or type your own string.

Request headers. DevTools has no request-header editor. Right-click the request, choose Copy > Copy as fetch, edit the headers in the Console, and run it again. Browsers won’t let scripts set forbidden request headers such as Cookie, Origin, and Host, so send those from Apidog or cURL instead.

If you still need an in-page header extension, vet it like a dependency; our breakdown of the axios supply chain attack shows how a trusted package can turn. Before you install one:

• Check that the publisher is named and the source code is public.
• Read the permissions. Header tools usually need broad host access, so treat them as high-risk.
• Ask how it makes money. ModHeader’s free tier was ad-sponsored, and its plan page said that tier wouldn’t collect user data.
• Watch for lookalikes borrowing the ModHeader name.
• Run it in a separate Chrome profile with no logged-in sessions and test credentials only.

FAQ

Is ModHeader still available?

No. As of October 16, 2026, the Chrome Web Store, Edge Add-ons, and Firefox Add-ons listings are all unavailable. A copy offered anywhere else hasn’t passed store review, so don’t install it.

Did ModHeader steal my data?

There’s no public evidence that it uploaded browsing data: the domain collector was switched off in the version researchers examined. The extension did log request metadata and keep full headers locally, so rotate any token or cookie you put in it.

Does uninstalling ModHeader delete its stored data?

Yes. Removing the extension clears its local storage, including its header history. Rotate credentials anyway, because you can’t prove what left the machine earlier.

What replaces ModHeader for API testing?

An API client. Apidog sends any headers you set, keeps secrets in local variables, shows the exact request it sent, and turns header checks into CI tests. For changes inside a live page, use Chrome DevTools.

Wrap-up

A header tool sits in the most sensitive spot in your browser, between you and every site you’re logged in to. Remove it, rotate what it touched, and move your header testing somewhere built for it. Download Apidog for free, import one request from DevTools, and you’ll have your old ModHeader setup back in a few minutes, without the extension.