Home / Guides

How to test your local JavaScript on the live site

Sometimes a bug only shows up on the real site, with real data. Instead of deploying to test a fix, you can make Chrome load your local build in place of the production file, or replace a file's contents entirely. This used to be Resource Override's job; ProperHeader does it on Manifest V3.

By RJ Macarthy · 3 November 2026

Both methods below are Pro features.

Option 1: redirect the file to your dev server

Best when you have a dev server running, because your changes show up on reload.

1. Open Full editor and click Prod JS → localhost under Quick start, or add a row under Redirects.
2. Set From to the production file, for example https://cdn.example.com/app.js.
3. Set To to your local file, for example http://localhost:8080/app.js.
4. Reload the production page. Chrome now loads your local build.

Redirect a whole folder with regex

Switch the match type to regex and use a capture group:

From: ^https://cdn\.example\.com/(.*\.js)$
To:   http://localhost:8080/$1

Every script under the CDN is now loaded from the same path on your dev server.

Option 2: replace the file's contents

Best for a quick experiment, or for mocking an API response without a server.

1. Under File overrides, click + Add.
2. Enter the file URL, for example https://example.com/static/app.js, and choose the type: JavaScript, CSS, JSON, text or HTML.
3. Paste your replacement contents.
4. Reload the page.

The Mock an API response recipe does this for a JSON endpoint, which is handy when the back end isn't built yet.

If the override doesn't load

• Content-Security-Policy. File overrides are served as data: URLs. If the page's CSP forbids that, Chrome refuses the file. Fill in Remove CSP on for that page and it works while your profile is on. See removing CSP.
• Mixed content. An https:// page loading http://localhost is usually allowed, because Chrome treats localhost as secure. Other plain-http hosts will be blocked.
• Size. Each override can be up to about 1.4 MB, and the response is always HTTP 200 with only a Content-Type header.
• Service workers. Files served from a service worker's cache never reach the network. Bypass the service worker in DevTools (Application tab) while testing.
• Integrity attributes. If the script tag has an integrity="sha384-…" hash, a changed file fails the check. Override the HTML page too, or test on a build without SRI.

Questions