Change requests with request rules

Add a quick rule from the toolbar

1. Open the site, click the DevTools+ icon in the toolbar and click Request rules under Debug.
2. Under Quick rules for the site, pick one. Point at a rule to see what it does.
3. Press Reload the page to see it work.

• Turn off Content Security Policy: removes the CSP headers from this site's pages, so blocked scripts, styles and frames load.
• Allow CORS from this site: adds Access-Control-Allow-* headers to every response this site's requests get. Preflights that fail on the server still fail.
• Allow framing: removes X-Frame-Options and CSP from this site, so it loads inside an iframe.
• Never cache: sets Cache-Control: no-store on this site's responses, so every load is fresh.
• Block a URL pattern, Redirect a URL and Set a request header: these need a pattern or a value of your own, so they open in the editor in Settings, switched off until you finish them there.

The first four are on straight away. Under Your rules, every rule has a switch, with the ones that touch this site first. The pencil in the header opens the full editor.

The number on the toolbar icon

While any rules are on, the DevTools+ icon shows how many, so a rule you forgot about never quietly changes a site. On a tab that's being recorded or emulated, REC or EMU shows there instead. Switch rules off in the toolbar panel or in Settings, and the number goes away.

Edit rules in Settings

Open Settings → Request Rules. Under Add a rule, type a site in For the site and pick a ready-made rule, or press Blank rule. Each rule is a card:

• A switch to turn it on or off, a name (Name this rule), Move up, Move down and Delete this rule. A line under the name says what it does in words.
• Does: Block, Redirect or Change headers.
• URL filter: which addresses it matches. Empty matches every URL.
• Sites: the domains the requests go to. Requests made by: the pages the requests must come from. Empty means any.
• Kinds of request: Pages, Frames, Stylesheets, Scripts, Images, Fonts, Fetch and XHR, WebSockets and the rest. None picked means every kind, the page itself included.
• Redirect to: for a redirect, the full address to send matches to, such as a local build of a script.
• Headers: for header changes, a Response or Request header to Set or Remove, its name and value. Add a header adds another.

Changes save as you type. If something would stop Chrome taking the rule, such as a redirect without a full address or a header with no value, the card says so, and so does Chrome's own reason if it refuses one. The toolbar panel shows the same message under the rule.

How a URL filter matches

• ||example.com/api/ matches example.com and its subdomains, any scheme, from that path on.
• * matches anything; | at either end anchors the start or the end of the address.
• An empty filter matches every URL, so limit it with Sites.
• When two rules disagree, the one lower in the list wins.

Turn rules off for good

Rules apply in every tab until you switch them off. To delete them all, use Settings → Resets → Request rules; pages then load as their servers send them again. Your rules are included in a backup file; see Back up, restore and reset.

Related guides

Next, read Cookies, storage and site data, Console errors, HAR files and DevTools or Troubleshoot common issues.