How to change the Referer, User-Agent or X-Forwarded-For header in Chrome

A header extension can rewrite these request headers on every request. What it changes, and what it doesn't, matters when you test redirects, geo rules or bot checks.

What we tested

We set five request headers with an extension and checked what a local test server received, once on a normal page load and once on a fetch() POST from the page:

Header	Value set	Page load	fetch()
Referer	`https://www.google.com/`	Received	Received
X-Forwarded-For	`203.0.113.7`	Received	Received
User-Agent	an iPhone string	Received	Received
Authorization	`Bearer test123`	Received	Received
Origin	`https://example.com`	Received	Received

Removing Referer worked too: with a "remove" rule, the server got no Referer header, even on a same-origin fetch(), which normally sends one.

What does NOT change

navigator.userAgent: page JavaScript still read the real browser string (HeadlessChrome/153… in our test). Sites that check the user agent in JavaScript, not only in the header, still see your real browser. For a full mobile emulation (header, JavaScript and screen size) use DevTools device mode (Ctrl+Shift+M).
Client hints: Chrome still sent Sec-CH-UA: "Chromium";v="153" and Sec-CH-UA-Platform: "Linux". A changed User-Agent that disagrees with these headers is easy to spot. Override or remove them too if your test needs them consistent.
Your IP address: X-Forwarded-For is only a claim. The server still sees your real IP on the connection. It only matters to servers that trust the header, normally only when it comes from their own proxy or load balancer. Use it to test your own app's proxy handling, not to hide or change your location. How servers should handle it: X-Forwarded-For in nginx.

How to set them

Install a header-editor extension. PlainHeaders is ours (free, no header limit).
Open it on the site you're testing and click Enable on this site (it asks for access per site).
Add a request header row, for example Referer = https://www.google.com/, and reload the page.
Check it in DevTools → Network → the request → Headers. When you're done, delete the row or press Pause: these headers stay on every request until you do.

Only need one request? Use curl instead: curl -i -H 'Referer: https://www.google.com/' -A 'MyAgent/1.0' https://example.com/ (-A sets the User-Agent). For other ways to edit headers, including response headers, see how to modify HTTP headers in Chrome and Firefox.

Frequently asked questions

Does changing the User-Agent header make a site think I'm on a phone?

Only if the site reads the header alone. In our test, page JavaScript still saw the real navigator.userAgent and Chrome still sent its Sec-CH-UA client hints. DevTools device mode changes all of these at once.

Does X-Forwarded-For change my IP address?

No. The server always sees the IP of the connection. X-Forwarded-For is only trusted by servers configured to trust it, usually from their own proxy. Use it to test how your own app handles proxies.

Can I stop Chrome from sending the Referer?

Yes. A 'remove' rule for Referer in a header extension removed it on page loads and fetch() requests in our test. Site owners can also set a Referrer-Policy header (for example no-referrer).

Can a website detect a header extension?

Not the extension itself, but it can notice mismatches, such as a User-Agent that disagrees with navigator.userAgent or the Sec-CH-UA headers.

Written with AI assistance. Every header in the table was set with PlainHeaders in Chromium 153 on 2026-10-01 and read back by a local server, on a page load and on a fetch() POST. PlainHeaders is our extension; the other methods are free.