---
title: 'TestingBot Tunnel Header Rewriting: Add, Replace and Remove HTTP Headers'
description: 'Edit request and response headers as traffic passes through TestingBot
  Tunnel with --header and --response-header: set, empty, remove or remove-by-prefix.
  Drop a Content-Security-Policy, add a staging header, and more.'
source_url:
  html: https://testingbot.com/support/tunnel/headers
  md: https://testingbot.com/support/tunnel/headers.md
---

# Edit headers on the way through

`--header` edits the headers the tunnel sends to your site. `--response-header` edits the headers your site sends back to the cloud browser. Both are repeatable, and neither needs a change to your application.

- Since v5.0 
- Plain HTTP 

## Rule grammar

Each `--header` or `--response-header` takes one rule. Repeat the option for more.

| Rule | Effect |
| --- | --- |
| name: value | Set the header, replacing whatever the peer sent. |
| name; | Set the header to an empty value. |
| -name | Remove the header. |
| -name\* | Remove every header whose name starts with `name`. |

## Request headers

Headers sent from the tunnel to your site.

```bash
# tell the backend this traffic comes from automated tests
java -jar testingbot-tunnel.jar --header 'X-Test-Run: nightly-42'

# remove every X-Forwarded-* header before it reaches your server
java -jar testingbot-tunnel.jar --header '-X-Forwarded*'
```

## Response headers

Headers sent from your site back to the cloud browser. Useful for dropping a policy that blocks a test page without changing the server.

```bash
# a strict CSP blocks a test helper script
java -jar testingbot-tunnel.jar --response-header '-Content-Security-Policy'

# stop a staging site's HSTS from sticking in the browser
java -jar testingbot-tunnel.jar --response-header '-Strict-Transport-Security'

# allow the page to be framed by a test harness
java -jar testingbot-tunnel.jar --response-header '-X-Frame-Options'
```

## --extra-headers

`--extra-headers` adds request headers from a JSON object. It predates `--header` and still works.

```bash
java -jar testingbot-tunnel.jar --extra-headers '{"X-Environment":"staging","X-Tenant":"acme"}'
```

For new setups, prefer `--header`: it can also replace and remove headers, and each rule is a separate option, which is easier to manage in a [config file](https://testingbot.com/support/tunnel/configuration) or CI variable.

## HTTPS and headers

 Plain HTTP only 

HTTPS arrives at the local tunnel as a `CONNECT` request and is relayed as opaque, encrypted bytes, so the local tunnel cannot see or change its headers. Header rules, `--extra-headers` and [`--auth`](https://testingbot.com/support/tunnel/authentication#basic-sites) apply to plain HTTP traffic.

If you need a header on an HTTPS site in a test, set it from the test itself, for example with your framework's request interception or a browser extension.

## Looking for more help?

Have questions or need more information? Reach out via email or Slack.

[Email us](https://testingbot.com/contact/new) [Join our Slack](https://join.slack.com/t/testingb0t/shared_invite/zt-3bcw9xch-jk19~6XPs_xBrsAgAedkCw)