diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 211222791434..cebbd8d5f912 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -602,6 +602,7 @@ jobs:
                 libnfnetlink0 \
                 libnuma-dev \
                 libhiredis-dev \
+                libhyperscan-dev \
                 liblua5.1-dev \
                 libjansson-dev \
                 libevent-dev \
@@ -1267,6 +1268,7 @@ jobs:
                 libjansson-dev \
                 libgeoip-dev \
                 liblua5.1-dev \
+                libluajit-5.1-dev \
                 libhiredis-dev \
                 libevent-dev \
                 libtool \
@@ -1293,7 +1295,7 @@ jobs:
           cp prep/cbindgen $HOME/.cargo/bin
           chmod 755 $HOME/.cargo/bin/cbindgen
       - run: ./autogen.sh
-      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests
+      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests --enable-luajit
       - run: make -j2
       - run: make check
       - run: tar xf prep/suricata-verify.tar.gz
diff --git a/scripts/mininc.py b/scripts/mininc.py
new file mode 100644
index 000000000000..d35536487708
--- /dev/null
+++ b/scripts/mininc.py
@@ -0,0 +1,48 @@
+import sys
+import shutil
+import subprocess
+import os
+
+includes = []
+cfile = sys.argv[1]
+basename = os.path.basename(cfile)[:-2]
+f = open(cfile, "r")
+needsSuricataH = False
+for l in f.readlines():
+    if l.startswith('#include "'):
+        included = l.split('"')[1]
+        if included == "suricata-common.h":
+            continue
+        if included == basename+".h":
+            continue
+        if included[-2:] == ".c":
+            continue
+        includes.append(included)
+    if "RunmodeIsUnittests" in l:
+        needsSuricataH = True
+f.close()
+
+for i in includes:
+    if i == "suricata.h" and needsSuricataH:
+        continue
+    f = open(cfile, "r")
+    f2 = open(cfile+".test", "w")
+    for l in f.readlines():
+        if l.startswith('#include "'):
+            if l.split('"')[1] == i:
+                continue
+        f2.write(l)
+    f2.close()
+    f.close()
+    shutil.copyfile(cfile, cfile+".bak")
+    shutil.copyfile(cfile+".test", cfile)
+    try:
+        os.remove(cfile[:-2]+".o")
+    except:
+        pass
+    cp = subprocess.run(["make", "-C", "src", basename+".o"])
+    if cp.returncode != 0:
+        shutil.copyfile(cfile+".bak", cfile)
+        print("Needs", i)
+    else:
+        print("Removes", i)
diff --git a/src/alert-debuglog.c b/src/alert-debuglog.c
index 9dbb193d88bc..2507fefab80d 100644
--- a/src/alert-debuglog.c
+++ b/src/alert-debuglog.c
@@ -22,36 +22,16 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
 #include "stream.h"
-#include "app-layer-protos.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
 #include "util-print.h"
-
-#include "pkt-var.h"
-
-#include "util-unittest.h"
-
-#include "util-debug.h"
 #include "util-validate.h"
-#include "util-buffer.h"
 
 #include "output.h"
 #include "alert-debuglog.h"
-#include "util-privs.h"
 #include "flow-var.h"
 #include "flow-bit.h"
 #include "util-var-name.h"
-#include "util-optimize.h"
 #include "util-logopenfile.h"
 #include "util-time.h"
 
diff --git a/src/alert-fastlog.c b/src/alert-fastlog.c
index 2d24bd54919f..37e74f0bf1c3 100644
--- a/src/alert-fastlog.c
+++ b/src/alert-fastlog.c
@@ -25,33 +25,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "tm-threads.h"
-#include "threadvars.h"
-#include "util-debug.h"
-
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-build.h"
-#include "detect-engine-mpm.h"
-#include "detect-reference.h"
-#include "util-classification-config.h"
 
 #include "output.h"
 #include "alert-fastlog.h"
 
-#include "util-privs.h"
 #include "util-print.h"
 #include "util-proto-name.h"
-#include "util-optimize.h"
 #include "util-logopenfile.h"
 #include "util-time.h"
 
@@ -262,6 +243,12 @@ static void AlertFastLogDeInitCtx(OutputCtx *output_ctx)
 
 #ifdef UNITTESTS
 
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+#include "util-classification-config.h"
+#include "detect-parse.h"
+#include "detect-engine-build.h"
+
 static int AlertFastLogTest01(void)
 {
     uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n"
diff --git a/src/alert-syslog.c b/src/alert-syslog.c
index bba155c8edf7..9a560968b2cd 100644
--- a/src/alert-syslog.c
+++ b/src/alert-syslog.c
@@ -25,29 +25,15 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "flow.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "tm-threads.h"
-#include "threadvars.h"
-
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-reference.h"
 
 #include "output.h"
 #include "alert-syslog.h"
 
-#include "util-classification-config.h"
-#include "util-debug.h"
 #include "util-print.h"
 #include "util-proto-name.h"
 #include "util-syslog.h"
-#include "util-optimize.h"
 #include "util-logopenfile.h"
 
 #ifndef OS_WIN32
diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c
index 468cfba9048a..7306e67c468c 100644
--- a/src/app-layer-detect-proto.c
+++ b/src/app-layer-detect-proto.c
@@ -23,50 +23,25 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
-#include "detect.h"
 #include "detect-engine-port.h"
-#include "detect-engine-build.h"
-#include "detect-parse.h"
-#include "detect-engine.h"
 #include "detect-content.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "util-print.h"
-#include "util-pool.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
 #include "util-validate.h"
 
-#include "flow.h"
 #include "flow-util.h"
 #include "flow-private.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp.h"
-#include "stream.h"
 
-#include "app-layer.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-detect-proto.h"
 #include "app-layer-expectation.h"
 
-#include "conf.h"
 #include "util-memcmp.h"
-#include "util-spm.h"
-#include "util-debug.h"
 #include "util-validate.h"
 
-#include "runmodes.h"
-
 typedef struct AppLayerProtoDetectProbingParserElement_ {
     AppProto alproto;
     /* \todo don't really need it.  See if you can get rid of it */
@@ -2260,7 +2235,12 @@ void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
 
 #ifdef UNITTESTS
 
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
 #include "app-layer-htp.h"
+#include "detect-engine.h"
+#include "detect-engine-build.h"
+#include "detect-parse.h"
 
 static AppLayerProtoDetectCtx alpd_ctx_ut;
 
diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c
index 76e664f50393..b5771914e140 100644
--- a/src/app-layer-dnp3.c
+++ b/src/app-layer-dnp3.c
@@ -17,26 +17,17 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "stream.h"
-#include "util-byte.h"
 #include "util-unittest.h"
-#include "util-hashlist.h"
 
-#include "util-print.h"
-#include "util-spm-bs.h"
 #include "util-enum.h"
 
 #include "app-layer.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-detect-proto.h"
 
 #include "app-layer-dnp3.h"
 #include "app-layer-dnp3-objects.h"
 
-/* For hexdump(). */
-#include "app-layer-dcerpc-common.h"
-
 /* Default number of unreplied requests to be considered a flood. */
 #define DNP3_DEFAULT_REQ_FLOOD_COUNT 500
 
diff --git a/src/app-layer-enip-common.c b/src/app-layer-enip-common.c
index 91f06e731f88..b89727260140 100644
--- a/src/app-layer-enip-common.c
+++ b/src/app-layer-enip-common.c
@@ -25,13 +25,7 @@
  */
 
 #include "suricata-common.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "detect-parse.h"
-#include "detect-engine.h"
 #include "util-byte.h"
-#include "pkt-var.h"
-#include "util-profiling.h"
 
 #include "app-layer-enip-common.h"
 
diff --git a/src/app-layer-enip.c b/src/app-layer-enip.c
index 25322ab1a9bd..a2ea4c5f0b33 100644
--- a/src/app-layer-enip.c
+++ b/src/app-layer-enip.c
@@ -25,34 +25,20 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 
-#include "util-debug.h"
 #include "util-byte.h"
 #include "util-enum.h"
-#include "util-mem.h"
-#include "util-misc.h"
-
-#include "stream.h"
 
 #include "app-layer.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-enip.h"
 #include "app-layer-enip-common.h"
 
 #include "app-layer-detect-proto.h"
 
-#include "conf.h"
-#include "decode.h"
-
-#include "detect-parse.h"
-#include "detect-engine.h"
 #include "util-byte.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "pkt-var.h"
-#include "util-profiling.h"
-
 
 SCEnumCharMap enip_decoder_event_table[ ] = {
     { NULL,                         -1 },
@@ -599,12 +585,9 @@ void RegisterENIPTCPParsers(void)
 /* UNITTESTS */
 #ifdef UNITTESTS
 #include "app-layer-parser.h"
-#include "detect-parse.h"
-#include "detect-engine.h"
 #include "flow-util.h"
 #include "stream-tcp.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
 static uint8_t listIdentity[] = {/* List ID */    0x63, 0x00,
                                  /* Length */     0x00, 0x00,
diff --git a/src/app-layer-events.c b/src/app-layer-events.c
index 65016e2eaedb..7d715aca08c0 100644
--- a/src/app-layer-events.c
+++ b/src/app-layer-events.c
@@ -23,10 +23,7 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "flow.h"
 #include "app-layer-events.h"
-#include "app-layer-parser.h"
 #include "util-enum.h"
 
 /* events raised during protocol detection are stored in the
diff --git a/src/app-layer-expectation.c b/src/app-layer-expectation.c
index bf8b5b523d79..2aa81b0c5000 100644
--- a/src/app-layer-expectation.c
+++ b/src/app-layer-expectation.c
@@ -52,17 +52,12 @@
  * \author Eric Leblond <eric@regit.org>
  */
 
-#include "queue.h"
 #include "suricata-common.h"
-#include "debug.h"
 
 #include "ippair-storage.h"
-#include "flow-storage.h"
 
 #include "app-layer-expectation.h"
 
-#include "util-print.h"
-
 static IPPairStorageId g_ippair_expectation_id = { .id = -1 };
 static FlowStorageId g_flow_expectation_id = { .id = -1 };
 
diff --git a/src/app-layer-frames.c b/src/app-layer-frames.c
index 9a79edf50e7e..5921248d0102 100644
--- a/src/app-layer-frames.c
+++ b/src/app-layer-frames.c
@@ -23,8 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "util-print.h"
 
 #include "stream-tcp.h"
 #include "app-layer-frames.h"
diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c
index 6231ea514a81..e465e08eadc4 100644
--- a/src/app-layer-ftp.c
+++ b/src/app-layer-ftp.c
@@ -26,43 +26,17 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "threads.h"
-
-#include "util-print.h"
-#include "util-pool.h"
-
-#include "flow-util.h"
-#include "flow-storage.h"
-
-#include "detect-engine-state.h"
-
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
-#include "stream-tcp.h"
-#include "stream.h"
 
 #include "app-layer.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-ftp.h"
 #include "app-layer-expectation.h"
 #include "app-layer-detect-proto.h"
 
-#include "util-spm.h"
-#include "util-mpm.h"
-#include "util-unittest.h"
-#include "util-debug.h"
 #include "util-memcmp.h"
-#include "util-memrchr.h"
-#include "util-mem.h"
 #include "util-misc.h"
 #include "util-validate.h"
 
-#include "output-json.h"
-#include "rust.h"
-
 typedef struct FTPThreadCtx_ {
     MpmThreadCtx *ftp_mpm_thread_ctx;
     PrefilterRuleStore *pmq;
@@ -1518,6 +1492,9 @@ void FTPParserCleanup(void)
 /* UNITTESTS */
 #ifdef UNITTESTS
 
+#include "util-unittest.h"
+#include "stream-tcp.h"
+
 /** \test Send a get request in one chunk. */
 static int FTPParserTest01(void)
 {
diff --git a/src/app-layer-htp-body.c b/src/app-layer-htp-body.c
index 7e645f32fbbb..967a31470f97 100644
--- a/src/app-layer-htp-body.c
+++ b/src/app-layer-htp-body.c
@@ -26,44 +26,14 @@
  * This file provides a HTTP protocol support for the engine using HTP library.
  */
 
-#include "suricata.h"
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "threads.h"
 
 #include "util-print.h"
-#include "util-pool.h"
-#include "util-radix-tree.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
-#include "stream-tcp.h"
-#include "stream.h"
-
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
 #include "app-layer-htp.h"
 #include "app-layer-htp-body.h"
 #include "app-layer-htp-mem.h"
 
-#include "util-spm.h"
-#include "util-debug.h"
-#include "app-layer-htp-file.h"
-#include "util-time.h"
-
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "flow-util.h"
-
-#include "detect-engine.h"
-#include "detect-engine-state.h"
-#include "detect-parse.h"
-
-#include "conf.h"
-
-#include "util-memcmp.h"
-
 static StreamingBufferConfig default_cfg = { 0, 3072, HTPCalloc, HTPRealloc, HTPFree };
 
 /**
diff --git a/src/app-layer-htp-file.c b/src/app-layer-htp-file.c
index 8a79d9840cf9..e3da6d08baf7 100644
--- a/src/app-layer-htp-file.c
+++ b/src/app-layer-htp-file.c
@@ -24,45 +24,12 @@
  * using HTP library.
  */
 
-#include "suricata.h"
 #include "suricata-common.h"
-#include "debug.h"
 #include "util-validate.h"
-#include "decode.h"
-#include "threads.h"
 
-#include "util-print.h"
-#include "util-pool.h"
-#include "util-radix-tree.h"
-
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
-#include "stream-tcp.h"
-#include "stream.h"
-
-#include "app-layer.h"
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "app-layer-htp.h"
 #include "app-layer-htp-file.h"
 #include "app-layer-htp-range.h"
 
-#include "util-spm.h"
-#include "util-debug.h"
-#include "util-time.h"
-
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "flow-util.h"
-
-#include "detect-engine.h"
-#include "detect-engine-state.h"
-#include "detect-parse.h"
-
-#include "conf.h"
-
-#include "util-memcmp.h"
-
 /**
  *  \brief Open the file with "filename" and pass the first chunk
  *         of data if any.
@@ -436,6 +403,11 @@ int HTPFileClose(HtpState *s, HtpTxUserData *htud, const uint8_t *data, uint32_t
 }
 
 #ifdef UNITTESTS
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+#include "app-layer-parser.h"
+#include "stream-tcp.h"
+
 static int HTPFileParserTest01(void)
 {
     uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
diff --git a/src/app-layer-htp-libhtp.c b/src/app-layer-htp-libhtp.c
index a4ef784b0ed7..62ab3b833efb 100644
--- a/src/app-layer-htp-libhtp.c
+++ b/src/app-layer-htp-libhtp.c
@@ -39,7 +39,6 @@
  * Anoop Saldanha <anoopsaldanha@gmail.com>
  */
 
-#include "suricata.h"
 #include "suricata-common.h"
 #include "app-layer-htp-libhtp.h"
 
diff --git a/src/app-layer-htp-mem.c b/src/app-layer-htp-mem.c
index e1893f1e9008..dfa347aca56b 100644
--- a/src/app-layer-htp-mem.c
+++ b/src/app-layer-htp-mem.c
@@ -30,10 +30,7 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "conf.h"
-#include "util-mem.h"
 #include "util-misc.h"
 
 #include "app-layer-htp-mem.h"
diff --git a/src/app-layer-htp-range.c b/src/app-layer-htp-range.c
index 4826142e1670..6c09b96a1ae4 100644
--- a/src/app-layer-htp-range.c
+++ b/src/app-layer-htp-range.c
@@ -24,7 +24,6 @@
 #include "suricata-common.h"
 #include "app-layer-htp-range.h"
 #include "util-misc.h"        //ParseSizeStringU64
-#include "util-thash.h"       //HashTable
 #include "util-memcmp.h"      //SCBufferCmp
 #include "util-hash-string.h" //StringHashDjb2
 #include "util-validate.h"    //DEBUG_VALIDATE_BUG_ON
diff --git a/src/app-layer-htp-xff.c b/src/app-layer-htp-xff.c
index 1d60df363363..4f154c41a02a 100644
--- a/src/app-layer-htp-xff.c
+++ b/src/app-layer-htp-xff.c
@@ -23,15 +23,12 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 
 #include "app-layer-parser.h"
 #include "app-layer-htp.h"
 #include "app-layer-htp-xff.h"
 
-#include "util-misc.h"
 #include "util-memrchr.h"
-#include "util-unittest.h"
 
 /** XFF header value minimal length */
 #define XFF_CHAIN_MINLEN 7
@@ -256,6 +253,9 @@ void HttpXFFGetCfg(ConfNode *conf, HttpXFFCfg *result)
 
 
 #ifdef UNITTESTS
+
+#include "util-unittest.h"
+
 static int XFFTest01(void) {
     char input[] = "1.2.3.4:5678";
     char output[16];
diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index cfe1302bb854..d31ad9d5281c 100644
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -33,56 +33,24 @@
  * This file provides a HTTP protocol support for the engine using HTP library.
  */
 
-#include "suricata.h"
 #include "suricata-common.h"
-#include "conf.h"
-#include "debug.h"
-#include "decode.h"
-#include "threads.h"
-#include "counters.h"
 
-#include "util-print.h"
-#include "util-pool.h"
-#include "util-radix-tree.h"
-#include "util-file.h"
 #include "util-byte.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
-#include "stream-tcp.h"
-#include "stream.h"
-
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 
 #include "app-layer.h"
 #include "app-layer-detect-proto.h"
-#include "app-layer-frames.h"
 #include "app-layer-htp.h"
 #include "app-layer-htp-body.h"
 #include "app-layer-htp-file.h"
 #include "app-layer-htp-libhtp.h"
-#include "app-layer-htp-xff.h"
 #include "app-layer-htp-range.h"
 #include "app-layer-htp-mem.h"
 
-#include "util-spm.h"
-#include "util-debug.h"
-#include "util-time.h"
 #include "util-misc.h"
 #include "util-enum.h"
 
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "flow-util.h"
-
-#include "detect-engine.h"
-#include "detect-engine-build.h"
-#include "detect-engine-state.h"
-#include "detect-parse.h"
-
-#include "decode-events.h"
-
 #include "util-memcmp.h"
 #include "util-random.h"
 #include "util-validate.h"
@@ -3227,6 +3195,18 @@ void RegisterHTPParsers(void)
 }
 
 #ifdef UNITTESTS
+
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+#include "stream-tcp.h"
+#include "conf-yaml-loader.h"
+#include "util-print.h"
+#include "flow-util.h"
+#include "detect-engine.h"
+#include "detect-engine-build.h"
+#include "detect-parse.h"
+#include "app-layer-htp-xff.h"
+
 static HTPCfgRec cfglist_backup;
 
 void HtpConfigCreateBackup(void)
@@ -3893,8 +3873,6 @@ static int HTPParserTest07(void)
     return result;
 }
 
-#include "conf-yaml-loader.h"
-
 /** \test Abort
  */
 static int HTPParserTest08(void)
diff --git a/src/app-layer-http2.c b/src/app-layer-http2.c
index ce0cdc8c2fd0..efe9519bd554 100644
--- a/src/app-layer-http2.c
+++ b/src/app-layer-http2.c
@@ -24,17 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
-
-#include "util-unittest.h"
 
 #include "app-layer-detect-proto.h"
-#include "app-layer-parser.h"
 
 #include "app-layer-htp.h"
 #include "app-layer-http2.h"
-#include "rust.h"
 
 static int HTTP2RegisterPatternsForProtocolDetection(void)
 {
diff --git a/src/app-layer-ike.c b/src/app-layer-ike.c
index 110db2bd2444..97aa344a30f4 100644
--- a/src/app-layer-ike.c
+++ b/src/app-layer-ike.c
@@ -26,16 +26,12 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
 
 #include "util-unittest.h"
 
-#include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-ike.h"
-#include "rust.h"
 
 void RegisterIKEParsers(void)
 {
@@ -47,7 +43,6 @@ void RegisterIKEParsers(void)
 
 #ifdef UNITTESTS
 #include "stream-tcp.h"
-#include "util-unittest-helper.h"
 #include "flow-util.h"
 
 static int IkeParserTest(void)
diff --git a/src/app-layer-krb5.c b/src/app-layer-krb5.c
index 7b2b63f11999..91a38403c1d7 100644
--- a/src/app-layer-krb5.c
+++ b/src/app-layer-krb5.c
@@ -24,16 +24,10 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
 
-#include "util-unittest.h"
-
-#include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-krb5.h"
-#include "rust.h"
 
 void RegisterKRB5Parsers(void)
 {
@@ -45,11 +39,6 @@ void RegisterKRB5Parsers(void)
 #endif
 }
 
-#ifdef UNITTESTS
-#endif
-
 void KRB5ParserRegisterTests(void)
 {
-#ifdef UNITTESTS
-#endif
 }
diff --git a/src/app-layer-modbus.c b/src/app-layer-modbus.c
index 0f608c9c0931..2bed87772488 100644
--- a/src/app-layer-modbus.c
+++ b/src/app-layer-modbus.c
@@ -36,8 +36,6 @@
 
 #include "suricata-common.h"
 
-#include "util-debug.h"
-
 #include "app-layer-parser.h"
 #include "app-layer-modbus.h"
 #include "detect-engine-build.h"
@@ -59,7 +57,6 @@ void RegisterModbusParsers(void)
 
 /* UNITTESTS */
 #ifdef UNITTESTS
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
 
@@ -69,9 +66,6 @@ void RegisterModbusParsers(void)
 #include "util-unittest-helper.h"
 
 #include "stream-tcp.h"
-#include "stream-tcp-private.h"
-
-#include "rust.h"
 
 /* Modbus default stream reassembly depth */
 #define MODBUS_CONFIG_DEFAULT_STREAM_DEPTH 0
diff --git a/src/app-layer-mqtt.c b/src/app-layer-mqtt.c
index 3735ce14c184..9769a2cbbc94 100644
--- a/src/app-layer-mqtt.c
+++ b/src/app-layer-mqtt.c
@@ -22,17 +22,12 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
 
 #include "util-misc.h"
-#include "util-unittest.h"
 
-#include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-mqtt.h"
-#include "rust.h"
 
 void RegisterMQTTParsers(void)
 {
@@ -59,6 +54,4 @@ void RegisterMQTTParsers(void)
 
 void MQTTParserRegisterTests(void)
 {
-#ifdef UNITTESTS
-#endif
 }
diff --git a/src/app-layer-nfs-tcp.c b/src/app-layer-nfs-tcp.c
index 657db59c7056..b2656287aa80 100644
--- a/src/app-layer-nfs-tcp.c
+++ b/src/app-layer-nfs-tcp.c
@@ -27,13 +27,8 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
-
-#include "util-unittest.h"
 
 #include "app-layer-detect-proto.h"
-#include "app-layer-parser.h"
 
 #include "app-layer-nfs-tcp.h"
 
diff --git a/src/app-layer-nfs-udp.c b/src/app-layer-nfs-udp.c
index b972803034c6..021f73698b8b 100644
--- a/src/app-layer-nfs-udp.c
+++ b/src/app-layer-nfs-udp.c
@@ -24,19 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
 
-#include "util-unittest.h"
-
-#include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-nfs-udp.h"
 #include "util-enum.h"
 
-#include "rust.h"
-
 /* Enum of app-layer events for an echo protocol. Normally you might
  * have events for errors in parsing data, like unexpected data being
  * received. For echo we'll make something up, and log an app-layer
@@ -71,11 +64,6 @@ void RegisterNFSUDPParsers(void)
 #endif
 }
 
-#ifdef UNITTESTS
-#endif
-
 void NFSUDPParserRegisterTests(void)
 {
-#ifdef UNITTESTS
-#endif
 }
diff --git a/src/app-layer-ntp.c b/src/app-layer-ntp.c
index fa7f95d71124..fcbaf32f1445 100644
--- a/src/app-layer-ntp.c
+++ b/src/app-layer-ntp.c
@@ -24,16 +24,10 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
 
-#include "util-unittest.h"
-
-#include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-ntp.h"
-#include "rust.h"
 
 void RegisterNTPParsers(void)
 {
@@ -45,11 +39,6 @@ void RegisterNTPParsers(void)
 #endif
 }
 
-#ifdef UNITTESTS
-#endif
-
 void NTPParserRegisterTests(void)
 {
-#ifdef UNITTESTS
-#endif
 }
diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index 57e19a057e6c..985b6fef27a8 100644
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -24,28 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
 #include "util-unittest.h"
-#include "decode.h"
-#include "threads.h"
-
-#include "util-print.h"
-#include "util-pool.h"
 
 #include "flow-util.h"
 #include "flow-private.h"
 
-#include "detect-engine-state.h"
-#include "detect-engine-port.h"
-
 #include "stream-tcp.h"
-#include "stream-tcp-private.h"
-#include "stream.h"
-#include "stream-tcp-reassemble.h"
 
 #include "app-layer.h"
 #include "app-layer-detect-proto.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-smb.h"
 #include "app-layer-htp.h"
@@ -58,11 +45,6 @@
 #include "app-layer-dnp3.h"
 #include "app-layer-nfs-tcp.h"
 #include "app-layer-nfs-udp.h"
-#include "app-layer-ntp.h"
-#include "app-layer-tftp.h"
-#include "app-layer-ike.h"
-#include "app-layer-krb5.h"
-#include "app-layer-snmp.h"
 #include "app-layer-sip.h"
 #include "app-layer-rfb.h"
 #include "app-layer-mqtt.h"
@@ -72,18 +54,9 @@
 #include "app-layer-rdp.h"
 #include "app-layer-http2.h"
 
-#include "conf.h"
-#include "util-spm.h"
-
-#include "util-debug.h"
-#include "decode-events.h"
 #include "util-unittest-helper.h"
 #include "util-validate.h"
 
-#include "runmodes.h"
-
-#include "rust.h"
-
 struct AppLayerParserThreadCtx_ {
     void *alproto_local_storage[FLOW_PROTO_MAX][ALPROTO_MAX];
 };
diff --git a/src/app-layer-quic.c b/src/app-layer-quic.c
index 837aa9c49632..679d8bf51549 100644
--- a/src/app-layer-quic.c
+++ b/src/app-layer-quic.c
@@ -23,13 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
-
-#include "util-unittest.h"
-
-#include "app-layer-detect-proto.h"
-#include "app-layer-parser.h"
 
 #include "app-layer-quic.h"
 #include "rust.h"
diff --git a/src/app-layer-rdp.c b/src/app-layer-rdp.c
index 2611de4237b0..cefd656edeb7 100644
--- a/src/app-layer-rdp.c
+++ b/src/app-layer-rdp.c
@@ -24,11 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
-#include "util-unittest.h"
-#include "app-layer-detect-proto.h"
-#include "app-layer-parser.h"
 #include "app-layer-rdp.h"
 #include "rust.h"
 
diff --git a/src/app-layer-register.c b/src/app-layer-register.c
index 12fd2bb31c36..838bc4cdd783 100644
--- a/src/app-layer-register.c
+++ b/src/app-layer-register.c
@@ -25,10 +25,7 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "stream.h"
-#include "conf.h"
 
-#include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-register.h"
diff --git a/src/app-layer-rfb.c b/src/app-layer-rfb.c
index c070e37fa6d4..c6c8e1d84e5a 100644
--- a/src/app-layer-rfb.c
+++ b/src/app-layer-rfb.c
@@ -32,8 +32,6 @@
 #include "app-layer-parser.h"
 #include "app-layer-rfb.h"
 
-#include "rust-bindings.h"
-
 static int RFBRegisterPatternsForProtocolDetection(void)
 {
     if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_RFB,
diff --git a/src/app-layer-smb.c b/src/app-layer-smb.c
index 776e1c2381ee..8e3de8974411 100644
--- a/src/app-layer-smb.c
+++ b/src/app-layer-smb.c
@@ -16,18 +16,12 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "app-layer-protos.h"
-#include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "util-unittest.h"
 
-#include "rust.h"
 #include "app-layer-smb.h"
-#include "util-misc.h"
-
 
 static StreamingBufferConfig sbcfg = STREAMING_BUFFER_CONFIG_INITIALIZER;
 static SuricataFileContext sfc = { &sbcfg };
diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c
index efc918df7be6..77bc275d992c 100644
--- a/src/app-layer-smtp.c
+++ b/src/app-layer-smtp.c
@@ -21,42 +21,25 @@
  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
  */
 
-#include "suricata.h"
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "threads.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp.h"
-#include "stream.h"
 
 #include "app-layer.h"
 #include "app-layer-detect-proto.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-smtp.h"
 
 #include "util-enum.h"
-#include "util-mpm.h"
-#include "util-debug.h"
-#include "util-print.h"
-#include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-memcmp.h"
 #include "flow-util.h"
 
 #include "detect-engine.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 #include "detect-parse.h"
 
-#include "decode-events.h"
-#include "conf.h"
-
-#include "util-mem.h"
 #include "util-misc.h"
 #include "util-validate.h"
 
diff --git a/src/app-layer-snmp.c b/src/app-layer-snmp.c
index 589aa451ed48..f6624165d3d6 100644
--- a/src/app-layer-snmp.c
+++ b/src/app-layer-snmp.c
@@ -25,13 +25,6 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
-
-#include "util-unittest.h"
-
-#include "app-layer-detect-proto.h"
-#include "app-layer-parser.h"
 
 #include "app-layer-snmp.h"
 #include "rust.h"
diff --git a/src/app-layer-ssh.c b/src/app-layer-ssh.c
index c573c5b55dc1..aea6672c92d7 100644
--- a/src/app-layer-ssh.c
+++ b/src/app-layer-ssh.c
@@ -26,33 +26,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "threads.h"
 
-#include "util-print.h"
-#include "util-pool.h"
-
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp.h"
-#include "stream.h"
 
 #include "app-layer-detect-proto.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-ssh.h"
-#include "rust.h"
-
-#include "conf.h"
 
-#include "util-spm.h"
 #include "util-unittest.h"
-#include "util-debug.h"
-#include "flow-private.h"
-
-#include "util-byte.h"
-#include "util-memcmp.h"
 
 /* HASSH fingerprints are disabled by default */
 #define SSH_CONFIG_DEFAULT_HASSH false
diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c
index 1cebb2bd2c16..08ae5464465b 100644
--- a/src/app-layer-ssl.c
+++ b/src/app-layer-ssl.c
@@ -25,35 +25,18 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "threads.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp.h"
-#include "stream.h"
 
 #include "app-layer.h"
 #include "app-layer-detect-proto.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-frames.h"
 #include "app-layer-ssl.h"
 
-#include "decode-events.h"
-#include "conf.h"
-
-#include "util-spm.h"
 #include "util-unittest.h"
-#include "util-debug.h"
-#include "util-print.h"
-#include "util-pool.h"
-#include "util-byte.h"
-#include "util-ja3.h"
 #include "util-enum.h"
 #include "flow-util.h"
-#include "flow-private.h"
 #include "util-validate.h"
 
 SCEnumCharMap tls_frame_table[] = {
diff --git a/src/app-layer-template-rust.c b/src/app-layer-template-rust.c
index 3ba9349f306e..c64c0a539f8a 100644
--- a/src/app-layer-template-rust.c
+++ b/src/app-layer-template-rust.c
@@ -34,16 +34,10 @@
  */
 
 #include "suricata-common.h"
-#include "stream.h"
-#include "conf.h"
 
-#include "util-unittest.h"
-
-#include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-template-rust.h"
-#include "rust.h"
 
 void RegisterTemplateRustParsers(void)
 {
@@ -61,9 +55,6 @@ void RegisterTemplateRustParsers(void)
 #endif
 }
 
-#ifdef UNITTESTS
-#endif
-
 void TemplateRustParserRegisterTests(void)
 {
 #ifdef UNITTESTS
diff --git a/src/app-layer-template.c b/src/app-layer-template.c
index d53a0e6cf786..7b4d09cdf194 100644
--- a/src/app-layer-template.c
+++ b/src/app-layer-template.c
@@ -35,14 +35,11 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "stream.h"
-#include "conf.h"
 #include "app-layer.h"
 #include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 #include "app-layer-template.h"
 
-#include "util-unittest.h"
 #include "util-validate.h"
 #include "util-enum.h"
 
@@ -544,9 +541,6 @@ void RegisterTemplateParsers(void)
 #endif
 }
 
-#ifdef UNITTESTS
-#endif
-
 void TemplateParserRegisterTests(void)
 {
 #ifdef UNITTESTS
diff --git a/src/app-layer-tftp.c b/src/app-layer-tftp.c
index 37b1846bbbb9..51d3e5d5ad6c 100644
--- a/src/app-layer-tftp.c
+++ b/src/app-layer-tftp.c
@@ -27,17 +27,12 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "stream.h"
-#include "conf.h"
-
-#include "util-unittest.h"
 
 #include "app-layer.h"
 #include "app-layer-detect-proto.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-tftp.h"
-#include "rust.h"
 
 /* The default port to probe if not provided in the configuration file. */
 #define TFTP_DEFAULT_PORT "69"
diff --git a/src/app-layer.c b/src/app-layer.c
index e7ac4d2eb3f4..33fa9da124d4 100644
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -28,26 +28,17 @@
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
-#include "app-layer-protos.h"
 #include "app-layer-expectation.h"
 #include "app-layer-ftp.h"
 #include "app-layer-detect-proto.h"
-#include "app-layer-frames.h"
-#include "stream-tcp-reassemble.h"
-#include "stream-tcp-private.h"
-#include "stream-tcp-inline.h"
 #include "stream-tcp.h"
-#include "flow.h"
 #include "flow-util.h"
 #include "flow-private.h"
 #include "ippair.h"
-#include "util-debug.h"
 #include "util-print.h"
 #include "util-profiling.h"
 #include "util-validate.h"
-#include "decode-events.h"
 #include "app-layer-htp-mem.h"
-#include "util-exception-policy.h"
 
 /**
  * \brief This is for the app layer in general and it contains per thread
@@ -1171,10 +1162,7 @@ void AppLayerDeSetupCounters()
 /***** Unittests *****/
 
 #ifdef UNITTESTS
-#include "pkt-var.h"
 #include "stream-tcp.h"
-#include "stream-tcp-util.h"
-#include "stream.h"
 #include "util-unittest.h"
 
 #define TEST_START                                                                                 \
diff --git a/src/conf-yaml-loader.c b/src/conf-yaml-loader.c
index 99081e4e9c0b..aec8fc52d143 100644
--- a/src/conf-yaml-loader.c
+++ b/src/conf-yaml-loader.c
@@ -24,11 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 #include "conf-yaml-loader.h"
 #include <yaml.h>
-#include "util-path.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 
 #define YAML_VERSION_MAJOR 1
diff --git a/src/conf.c b/src/conf.c
index 202a25da04da..ac236f4a36b9 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -39,8 +39,6 @@
 #include "suricata-common.h"
 #include "conf.h"
 #include "util-unittest.h"
-#include "util-debug.h"
-#include "util-path.h"
 
 /** Maximum size of a complete domain name. */
 #define NODE_NAME_MAX 1024
diff --git a/src/counters.c b/src/counters.c
index 6960fe06e936..10f20bc5d03d 100644
--- a/src/counters.c
+++ b/src/counters.c
@@ -27,20 +27,12 @@
 #include "suricata-common.h"
 #include "suricata.h"
 #include "counters.h"
-#include "threadvars.h"
 #include "tm-threads.h"
-#include "conf.h"
 #include "util-time.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 #include "util-byte.h"
 #include "util-privs.h"
-#include "util-signal.h"
-#include "unix-manager.h"
-#include "runmodes.h"
 
-#include "output.h"
-#include "output-stats.h"
 #include "output-json-stats.h"
 
 /* Time interval for syncing the local counters with the global ones */
diff --git a/src/datasets-md5.c b/src/datasets-md5.c
index 3b1d8f3fc02c..c649492e49fb 100644
--- a/src/datasets-md5.c
+++ b/src/datasets-md5.c
@@ -22,12 +22,7 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "datasets.h"
 #include "datasets-md5.h"
-#include "util-thash.h"
-#include "util-print.h"
-#include "util-base64.h"    // decode base64
 
 int Md5StrSet(void *dst, void *src)
 {
diff --git a/src/datasets-sha256.c b/src/datasets-sha256.c
index 346397d6d6fa..d605a53043a9 100644
--- a/src/datasets-sha256.c
+++ b/src/datasets-sha256.c
@@ -22,12 +22,7 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "datasets.h"
 #include "datasets-sha256.h"
-#include "util-thash.h"
-#include "util-print.h"
-#include "util-base64.h"    // decode base64
 
 int Sha256StrSet(void *dst, void *src)
 {
diff --git a/src/datasets-string.c b/src/datasets-string.c
index 4a572898ceb3..3ec11223f929 100644
--- a/src/datasets-string.c
+++ b/src/datasets-string.c
@@ -22,12 +22,7 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "datasets.h"
 #include "datasets-string.h"
-#include "util-thash.h"
-#include "util-print.h"
-#include "util-base64.h"    // decode base64
 #include "rust.h"
 
 #if 0
diff --git a/src/datasets.c b/src/datasets.c
index 5ae1a9f1f314..d2d0ef244035 100644
--- a/src/datasets.c
+++ b/src/datasets.c
@@ -22,13 +22,10 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 #include "datasets.h"
 #include "datasets-string.h"
 #include "datasets-md5.h"
 #include "datasets-sha256.h"
-#include "datasets-reputation.h"
-#include "util-thash.h"
 #include "util-print.h"
 #include "util-base64.h"    // decode base64
 #include "util-byte.h"
diff --git a/src/decode-chdlc.c b/src/decode-chdlc.c
index 1306114b8d7d..2ae24b32dec6 100644
--- a/src/decode-chdlc.c
+++ b/src/decode-chdlc.c
@@ -31,13 +31,10 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-chdlc.h"
-#include "decode-events.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 int DecodeCHDLC(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
                    const uint8_t *pkt, uint32_t len)
diff --git a/src/decode-erspan.c b/src/decode-erspan.c
index b5a5a722f7ab..64cb46998614 100644
--- a/src/decode-erspan.c
+++ b/src/decode-erspan.c
@@ -31,14 +31,9 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "decode-events.h"
 #include "decode-erspan.h"
 
 #include "util-validate.h"
-#include "util-unittest.h"
-#include "util-debug.h"
 
 /**
  * \brief Functions to decode ERSPAN Type I and II packets
diff --git a/src/decode-esp.c b/src/decode-esp.c
index 1dd5b739b0d0..580eafcd8e3c 100644
--- a/src/decode-esp.c
+++ b/src/decode-esp.c
@@ -29,7 +29,6 @@
 
 #include "suricata-common.h"
 #include "decode-esp.h"
-#include "flow.h"
 
 #include "util-validate.h"
 
diff --git a/src/decode-ethernet.c b/src/decode-ethernet.c
index 62115b9fd490..c789223bde5c 100644
--- a/src/decode-ethernet.c
+++ b/src/decode-ethernet.c
@@ -31,13 +31,10 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-ethernet.h"
-#include "decode-events.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
                    const uint8_t *pkt, uint32_t len)
diff --git a/src/decode-geneve.c b/src/decode-geneve.c
index 19c8baf98f16..3cacd93769cb 100644
--- a/src/decode-geneve.c
+++ b/src/decode-geneve.c
@@ -27,21 +27,12 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-geneve.h"
-#include "decode-events.h"
 
 #include "detect-engine-port.h"
 
-#include "flow.h"
-
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
-
-#include "pkt-var.h"
-#include "util-profiling.h"
-#include "host.h"
 
 #define VALID_GENEVE_VERSIONS                                                                      \
     {                                                                                              \
diff --git a/src/decode-gre.c b/src/decode-gre.c
index 6919f0544deb..42f9628a13de 100644
--- a/src/decode-gre.c
+++ b/src/decode-gre.c
@@ -31,14 +31,10 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "decode-events.h"
 #include "decode-gre.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 /**
  * \brief Function to decode GRE packets
diff --git a/src/decode-icmpv4.c b/src/decode-icmpv4.c
index 30d2f8527243..657f5e1fa6b5 100644
--- a/src/decode-icmpv4.c
+++ b/src/decode-icmpv4.c
@@ -32,16 +32,10 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-#include "decode-events.h"
-#include "decode-ipv4.h"
 #include "decode-icmpv4.h"
 
-#include "flow.h"
-
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 #include "util-print.h"
 #include "util-validate.h"
 
diff --git a/src/decode-icmpv6.c b/src/decode-icmpv6.c
index 4325dadf53a9..fa0e4db79082 100644
--- a/src/decode-icmpv6.c
+++ b/src/decode-icmpv6.c
@@ -32,21 +32,14 @@
 
 #include "suricata-common.h"
 #include "decode-icmpv6.h"
-#include "decode.h"
-#include "decode-tcp.h"
-#include "decode-sctp.h"
-#include "decode-udp.h"
-#include "decode-events.h"
 #include "util-unittest.h"
-#include "flow.h"
-#include "util-debug.h"
-#include "util-print.h"
 #include "util-validate.h"
 
 #include "pkt-var.h"
 #include "util-profiling.h"
-#include "host.h"
-
+#ifdef DEBUG
+#include "util-print.h"
+#endif
 
 /**
  * \brief Get variables and do some checks of the embedded IPV6 packet
diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index e472ca281b59..803e854be910 100644
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -32,20 +32,17 @@
  */
 
 #include "suricata-common.h"
-#include "packet-queue.h"
-#include "decode.h"
 #include "decode-ipv4.h"
-#include "decode-events.h"
 #include "defrag.h"
 #include "pkt-var.h"
-#include "host.h"
 
 #include "util-unittest.h"
-#include "util-debug.h"
-#include "util-optimize.h"
-#include "util-print.h"
 #include "util-profiling.h"
 
+#ifdef DEBUG
+#include "util-print.h"
+#endif
+
 /* Generic validation
  *
  * [--type--][--len---]
diff --git a/src/decode-ipv6.c b/src/decode-ipv6.c
index 5872e762e3b7..ab5f9281a39d 100644
--- a/src/decode-ipv6.c
+++ b/src/decode-ipv6.c
@@ -31,19 +31,16 @@
  */
 
 #include "suricata-common.h"
-#include "packet-queue.h"
-#include "decode.h"
 #include "decode-ipv6.h"
-#include "decode-icmpv6.h"
-#include "decode-events.h"
 #include "defrag.h"
 #include "pkt-var.h"
-#include "util-debug.h"
-#include "util-print.h"
 #include "util-unittest.h"
 #include "util-profiling.h"
 #include "util-validate.h"
-#include "host.h"
+
+#ifdef DEBUG
+#include "util-print.h"
+#endif
 
 /**
  * \brief Function to decode IPv4 in IPv6 packets
diff --git a/src/decode-mpls.c b/src/decode-mpls.c
index dc724762b35c..8bfd6f9b521a 100644
--- a/src/decode-mpls.c
+++ b/src/decode-mpls.c
@@ -24,7 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
diff --git a/src/decode-nsh.c b/src/decode-nsh.c
index 64a99ca580a7..5ee7f74003c7 100644
--- a/src/decode-nsh.c
+++ b/src/decode-nsh.c
@@ -30,14 +30,10 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "decode-events.h"
 #include "decode-nsh.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 /**
  * \brief Function to decode NSH packets
diff --git a/src/decode-null.c b/src/decode-null.c
index dc7051edc3f6..9814932d6e45 100644
--- a/src/decode-null.c
+++ b/src/decode-null.c
@@ -32,17 +32,8 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "decode-raw.h"
-#include "decode-events.h"
 
 #include "util-validate.h"
-#include "util-unittest.h"
-#include "util-debug.h"
-
-#include "pkt-var.h"
-#include "util-profiling.h"
-#include "host.h"
 
 #define HDR_SIZE 4
 
diff --git a/src/decode-ppp.c b/src/decode-ppp.c
index 5bf682bd2fc6..abb1ab233de2 100644
--- a/src/decode-ppp.c
+++ b/src/decode-ppp.c
@@ -31,15 +31,10 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-ppp.h"
-#include "decode-events.h"
-
-#include "flow.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
         const uint8_t *pkt, uint32_t len)
diff --git a/src/decode-pppoe.c b/src/decode-pppoe.c
index 2b798c96f406..1faa88579ca2 100644
--- a/src/decode-pppoe.c
+++ b/src/decode-pppoe.c
@@ -32,17 +32,10 @@
 
 #include "suricata-common.h"
 
-#include "packet-queue.h"
-
-#include "decode.h"
-#include "decode-ppp.h"
 #include "decode-pppoe.h"
-#include "decode-events.h"
-#include "flow.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 /**
  * \brief Main decoding function for PPPOE Discovery packets
diff --git a/src/decode-raw.c b/src/decode-raw.c
index 2eaa700f286d..19fae80b3e76 100644
--- a/src/decode-raw.c
+++ b/src/decode-raw.c
@@ -31,18 +31,13 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-raw.h"
-#include "decode-events.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 #include "pkt-var.h"
 #include "util-profiling.h"
-#include "host.h"
-
 
 int DecodeRaw(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
         const uint8_t *pkt, uint32_t len)
@@ -79,8 +74,6 @@ int DecodeRaw(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
 }
 
 #ifdef UNITTESTS
-#include "flow.h"
-#include "flow-util.h"
 
 /** DecodeRawtest01
  *  \brief Valid Raw packet
diff --git a/src/decode-sctp.c b/src/decode-sctp.c
index 9a6c4e8ead2a..0983312f403f 100644
--- a/src/decode-sctp.c
+++ b/src/decode-sctp.c
@@ -31,15 +31,9 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-sctp.h"
-#include "decode-events.h"
 
 #include "util-validate.h"
-#include "util-unittest.h"
-#include "util-debug.h"
-#include "util-optimize.h"
-#include "flow.h"
 
 static int DecodeSCTPPacket(ThreadVars *tv, Packet *p, const uint8_t *pkt, uint16_t len)
 {
diff --git a/src/decode-sll.c b/src/decode-sll.c
index f26950fffead..35afb8107793 100644
--- a/src/decode-sll.c
+++ b/src/decode-sll.c
@@ -31,12 +31,9 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-sll.h"
-#include "decode-events.h"
 
 #include "util-validate.h"
-#include "util-debug.h"
 
 int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
         const uint8_t *pkt, uint32_t len)
diff --git a/src/decode-tcp.c b/src/decode-tcp.c
index 8fa8fd99ac92..851338741415 100644
--- a/src/decode-tcp.c
+++ b/src/decode-tcp.c
@@ -31,16 +31,10 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-tcp.h"
-#include "decode-events.h"
 #include "util-unittest.h"
-#include "util-debug.h"
-#include "util-optimize.h"
-#include "flow.h"
 #include "util-profiling.h"
 #include "pkt-var.h"
-#include "host.h"
 
 #define SET_OPTS(dst, src) \
     (dst).type = (src).type; \
diff --git a/src/decode-template.c b/src/decode-template.c
index fdaee0a77fd5..58bfe2c90a22 100644
--- a/src/decode-template.c
+++ b/src/decode-template.c
@@ -31,9 +31,6 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "decode-events.h"
 #include "decode-template.h"
 
 #include "util-validate.h"
diff --git a/src/decode-teredo.c b/src/decode-teredo.c
index 194d09a92efb..f7d9bced94ec 100644
--- a/src/decode-teredo.c
+++ b/src/decode-teredo.c
@@ -33,13 +33,9 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "decode-ipv6.h"
 #include "decode-teredo.h"
 
 #include "util-validate.h"
-#include "util-debug.h"
-#include "conf.h"
 #include "detect-engine-port.h"
 
 #define TEREDO_ORIG_INDICATION_LENGTH   8
diff --git a/src/decode-udp.c b/src/decode-udp.c
index a1477172b9a7..66c184044171 100644
--- a/src/decode-udp.c
+++ b/src/decode-udp.c
@@ -31,16 +31,11 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-geneve.h"
 #include "decode-udp.h"
 #include "decode-teredo.h"
 #include "decode-vxlan.h"
-#include "decode-events.h"
 #include "util-unittest.h"
-#include "util-debug.h"
-#include "flow.h"
-#include "app-layer.h"
 
 static int DecodeUDPPacket(ThreadVars *t, Packet *p, const uint8_t *pkt, uint16_t len)
 {
diff --git a/src/decode-vlan.c b/src/decode-vlan.c
index 351fcf9e7cf2..c37e8551579b 100644
--- a/src/decode-vlan.c
+++ b/src/decode-vlan.c
@@ -31,19 +31,13 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-vlan.h"
-#include "decode-events.h"
-
-#include "flow.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 #include "pkt-var.h"
 #include "util-profiling.h"
-#include "host.h"
 
 /**
  * \internal
diff --git a/src/decode-vntag.c b/src/decode-vntag.c
index 56f536a804c6..406d93da5ff6 100644
--- a/src/decode-vntag.c
+++ b/src/decode-vntag.c
@@ -30,19 +30,13 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-vntag.h"
-#include "decode-events.h"
-
-#include "flow.h"
 
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 #include "pkt-var.h"
 #include "util-profiling.h"
-#include "host.h"
 
 /**
  * \internal
diff --git a/src/decode-vxlan.c b/src/decode-vxlan.c
index 6a7322993ee6..e75baa48dee8 100644
--- a/src/decode-vxlan.c
+++ b/src/decode-vxlan.c
@@ -27,21 +27,12 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "decode-vxlan.h"
-#include "decode-events.h"
 
 #include "detect-engine-port.h"
 
-#include "flow.h"
-
 #include "util-validate.h"
 #include "util-unittest.h"
-#include "util-debug.h"
-
-#include "pkt-var.h"
-#include "util-profiling.h"
-#include "host.h"
 
 #define VXLAN_HEADER_LEN sizeof(VXLANHeader)
 
diff --git a/src/decode.c b/src/decode.c
index df0c6ab37bbe..eb042fda0f81 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -48,27 +48,18 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "conf.h"
 #include "decode.h"
 #include "decode-teredo.h"
 #include "decode-erspan.h"
 #include "decode-geneve.h"
 #include "decode-vxlan.h"
-#include "util-debug.h"
-#include "util-mem.h"
-#include "app-layer-detect-proto.h"
 #include "app-layer.h"
-#include "tm-threads.h"
-#include "util-error.h"
 #include "util-print.h"
 #include "tmqh-packetpool.h"
 #include "util-profiling.h"
 #include "pkt-var.h"
-#include "util-mpm-ac.h"
 #include "util-hash-string.h"
 #include "output.h"
-#include "output-flow.h"
 #include "flow-storage.h"
 #include "util-validate.h"
 
diff --git a/src/defrag-config.c b/src/defrag-config.c
index f5d0f89e0bd2..a06868de191c 100644
--- a/src/defrag-config.c
+++ b/src/defrag-config.c
@@ -23,10 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "queue.h"
-#include "suricata.h"
-#include "conf.h"
-#include "util-debug.h"
 #include "util-misc.h"
 #include "defrag-config.h"
 
diff --git a/src/defrag-hash.c b/src/defrag-hash.c
index decc8fd75501..be4f0fd38538 100644
--- a/src/defrag-hash.c
+++ b/src/defrag-hash.c
@@ -16,7 +16,6 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 #include "defrag-hash.h"
 #include "defrag-queue.h"
 #include "defrag-config.h"
diff --git a/src/defrag-queue.c b/src/defrag-queue.c
index 71dcb9329e2e..c6191d65df69 100644
--- a/src/defrag-queue.c
+++ b/src/defrag-queue.c
@@ -24,12 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
 #include "defrag-queue.h"
-#include "util-error.h"
-#include "util-debug.h"
-#include "util-print.h"
 
 DefragTrackerQueue *DefragTrackerQueueInit (DefragTrackerQueue *q)
 {
diff --git a/src/defrag-timeout.c b/src/defrag-timeout.c
index f9428e0fe913..e2ef789ed299 100644
--- a/src/defrag-timeout.c
+++ b/src/defrag-timeout.c
@@ -22,7 +22,6 @@
  */
 
 #include "suricata-common.h"
-#include "defrag.h"
 #include "defrag-hash.h"
 #include "defrag-timeout.h"
 
diff --git a/src/defrag.c b/src/defrag.c
index a096ea58d881..994baa5b101c 100644
--- a/src/defrag.c
+++ b/src/defrag.c
@@ -33,31 +33,17 @@
 
 #include "suricata-common.h"
 
-#include "queue.h"
-
-#include "suricata.h"
-#include "threads.h"
-#include "conf.h"
-#include "decode-ipv6.h"
-#include "util-hashlist.h"
-#include "util-pool.h"
 #include "util-time.h"
-#include "util-print.h"
-#include "util-debug.h"
 #include "util-fix_checksum.h"
-#include "util-random.h"
-#include "stream-tcp-private.h"
 #include "stream-tcp-reassemble.h"
 #include "util-host-os-info.h"
 #include "util-validate.h"
 
 #include "defrag.h"
 #include "defrag-hash.h"
-#include "defrag-queue.h"
 #include "defrag-config.h"
 
 #include "tmqh-packetpool.h"
-#include "decode.h"
 
 #ifdef UNITTESTS
 #include "util-unittest.h"
diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c
index f189cbfd3cf9..3c28bb75914e 100644
--- a/src/detect-app-layer-event.c
+++ b/src/detect-app-layer-event.c
@@ -22,27 +22,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
 #include "app-layer.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
-#include "app-layer-smtp.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 #include "detect-app-layer-event.h"
 
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
-#include "decode-events.h"
-#include "util-byte.h"
-#include "util-debug.h"
 #include "util-enum.h"
 #include "util-profiling.h"
 #include "util-unittest.h"
@@ -428,9 +417,6 @@ int DetectAppLayerEventPrepare(DetectEngineCtx *de_ctx, Signature *s)
 /**********************************Unittests***********************************/
 
 #ifdef UNITTESTS /* UNITTESTS */
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
-#include "stream-tcp.h"
 
 #define APP_LAYER_EVENT_TEST_MAP_EVENT1 0
 #define APP_LAYER_EVENT_TEST_MAP_EVENT2 1
diff --git a/src/detect-app-layer-protocol.c b/src/detect-app-layer-protocol.c
index 0673eaac09de..9aaaad01ddf9 100644
--- a/src/detect-app-layer-protocol.c
+++ b/src/detect-app-layer-protocol.c
@@ -24,15 +24,11 @@
 #include "suricata-common.h"
 #include "detect-engine.h"
 #include "detect-engine-build.h"
-#include "detect-engine-prefilter.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-parse.h"
 #include "detect-app-layer-protocol.h"
 #include "app-layer.h"
-#include "app-layer-parser.h"
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
 #ifdef UNITTESTS
 static void DetectAppLayerProtocolRegisterTests(void);
diff --git a/src/detect-asn1.c b/src/detect-asn1.c
index 716d7bda222e..354afa000f9b 100644
--- a/src/detect-asn1.c
+++ b/src/detect-asn1.c
@@ -22,20 +22,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 #include "rust.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
-#include "flow.h"
 #include "detect-asn1.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-byte.h"
-#include "util-debug.h"
 
 static int DetectAsn1Match(DetectEngineThreadCtx *, Packet *,
                      const Signature *, const SigMatchCtx *);
diff --git a/src/detect-base64-data.c b/src/detect-base64-data.c
index b69dcdbb5b83..9ed4bf9ad6af 100644
--- a/src/detect-base64-data.c
+++ b/src/detect-base64-data.c
@@ -16,7 +16,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-parse.h"
diff --git a/src/detect-base64-decode.c b/src/detect-base64-decode.c
index 1fe49047933e..c8b2d887ed82 100644
--- a/src/detect-base64-decode.c
+++ b/src/detect-base64-decode.c
@@ -16,12 +16,10 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-base64-decode.h"
 #include "util-base64.h"
 #include "util-byte.h"
-#include "util-print.h"
 #include "detect-engine-build.h"
 
 /* Arbitrary maximum buffer size for decoded base64 data. */
@@ -267,9 +265,6 @@ static void DetectBase64DecodeFree(DetectEngineCtx *de_ctx, void *ptr)
 #include "detect-engine.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "app-layer-parser.h"
-#include "flow-util.h"
-#include "stream-tcp.h"
 
 static int g_http_header_buffer_id = 0;
 
diff --git a/src/detect-bsize.c b/src/detect-bsize.c
index 6cb63a6e00fa..71d081132d7a 100644
--- a/src/detect-bsize.c
+++ b/src/detect-bsize.c
@@ -24,19 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-content.h"
 #include "detect-engine-uint.h"
 
 #include "detect-bsize.h"
 
-#include "util-misc.h"
-
 /*prototypes*/
 static int DetectBsizeSetup (DetectEngineCtx *, Signature *, const char *);
 static void DetectBsizeFree (DetectEngineCtx *, void *);
diff --git a/src/detect-bypass.c b/src/detect-bypass.c
index 7cfad67c6f1e..5e12a6932059 100644
--- a/src/detect-bypass.c
+++ b/src/detect-bypass.c
@@ -23,33 +23,11 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-engine-sigorder.h"
 #include "detect-bypass.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "stream-tcp.h"
-
-#include "util-debug.h"
-#include "util-spm-bm.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-device.h"
-
 static int DetectBypassMatch(DetectEngineThreadCtx *, Packet *,
         const Signature *, const SigMatchCtx *);
 static int DetectBypassSetup(DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-byte-extract.c b/src/detect-byte-extract.c
index e4e07952c489..9b4123ffb08e 100644
--- a/src/detect-byte-extract.c
+++ b/src/detect-byte-extract.c
@@ -22,14 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-bytejump.h"
@@ -38,17 +32,8 @@
 #include "detect-isdataat.h"
 #include "detect-engine-build.h"
 
-#include "app-layer-protos.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
 #include "util-byte.h"
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
 
 /* the default value of endianess to be used, if none's specified */
 #define DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT DETECT_BYTE_EXTRACT_ENDIAN_BIG
diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c
index 9ca8da411f44..ca97071e9eee 100644
--- a/src/detect-bytejump.c
+++ b/src/detect-bytejump.c
@@ -24,22 +24,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "app-layer.h"
 
 #include "detect-byte.h"
-#include "detect-byte-extract.h"
 #include "detect-bytejump.h"
 #include "detect-content.h"
-#include "detect-uricontent.h"
 
 #include "util-byte.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 #include "util-validate.h"
 #include "detect-pcre.h"
 #include "detect-engine-build.h"
diff --git a/src/detect-bytemath.c b/src/detect-bytemath.c
index 649b5dc09588..8297b8eb5301 100644
--- a/src/detect-bytemath.c
+++ b/src/detect-bytemath.c
@@ -26,32 +26,19 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-byte.h"
 #include "detect-bytemath.h"
-#include "detect-isdataat.h"
 #include "detect-engine-build.h"
 
-#include "app-layer-protos.h"
-
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
 #include "util-byte.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-spm.h"
 
 /* the default value of endianess to be used, if none's specified */
 #define DETECT_BYTEMATH_ENDIAN_DEFAULT DETECT_BYTEMATH_ENDIAN_BIG
diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c
index 71506fd4eeb7..d3e986d51afd 100644
--- a/src/detect-bytetest.c
+++ b/src/detect-bytetest.c
@@ -25,24 +25,15 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-parse.h"
 #include "detect-engine-build.h"
 
 #include "detect-content.h"
-#include "detect-uricontent.h"
 #include "detect-byte.h"
 #include "detect-bytetest.h"
-#include "detect-bytejump.h"
-#include "detect-byte-extract.h"
-#include "app-layer.h"
 
 #include "util-byte.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 #include "detect-pcre.h"
 
 
@@ -674,9 +665,6 @@ static void DetectBytetestFree(DetectEngineCtx *de_ctx, void *ptr)
 
 /* UNITTESTS */
 #ifdef UNITTESTS
-#include "util-unittest-helper.h"
-#include "app-layer-parser.h"
-#include "flow-util.h"
 static int g_file_data_buffer_id = 0;
 static int g_dce_stub_data_buffer_id = 0;
 
diff --git a/src/detect-classtype.c b/src/detect-classtype.c
index ae4490c035c2..cd1f5110c42e 100644
--- a/src/detect-classtype.c
+++ b/src/detect-classtype.c
@@ -25,15 +25,11 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-classtype.h"
 #include "util-classification-config.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 
 #define PARSE_REGEX "^\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*$"
diff --git a/src/detect-config.c b/src/detect-config.c
index dfd39998ddfa..545c83ce9624 100644
--- a/src/detect-config.c
+++ b/src/detect-config.c
@@ -24,38 +24,17 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "feature.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-spm-bm.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "app-layer-htp.h"
-
-#include "stream-tcp.h"
 
 #include "detect-config.h"
 
-#include "output.h"
-
 /**
  * \brief Regex for parsing our flow options
  */
diff --git a/src/detect-content.c b/src/detect-content.c
index d3c7935e116b..c5d959af7c81 100644
--- a/src/detect-content.c
+++ b/src/detect-content.c
@@ -24,30 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
 #include "detect-content.h"
-#include "detect-uricontent.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine.h"
 #include "detect-engine-build.h"
-#include "detect-engine-state.h"
-#include "detect-parse.h"
 #include "detect-pcre.h"
-#include "util-mpm.h"
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
-#include "detect-flow.h"
-#include "app-layer.h"
 #include "util-unittest.h"
 #include "util-print.h"
-#include "util-debug.h"
-#include "util-spm.h"
-#include "threads.h"
 #include "util-unittest-helper.h"
 #include "pkt-var.h"
-#include "host.h"
 #include "util-profiling.h"
 #include "detect-dsize.h"
 
diff --git a/src/detect-csum.c b/src/detect-csum.c
index 09ae62275c07..f83ad8eed3d9 100644
--- a/src/detect-csum.c
+++ b/src/detect-csum.c
@@ -24,19 +24,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-csum.h"
 
 #include "util-unittest.h"
-#include "util-debug.h"
 
 #include "pkt-var.h"
-#include "host.h"
 #include "util-profiling.h"
 #include "detect-engine-build.h"
 
diff --git a/src/detect-datarep.c b/src/detect-datarep.c
index 171566eded81..01667175934b 100644
--- a/src/detect-datarep.c
+++ b/src/detect-datarep.c
@@ -24,20 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "threads.h"
-#include "datasets.h"
 #include "detect-datarep.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
 #include "util-byte.h"
-#include "util-debug.h"
-#include "util-print.h"
 #include "util-misc.h"
 
 #define PARSE_REGEX         "([a-z]+)(?:,\\s*([\\-_A-z0-9\\s\\.]+)){1,4}"
diff --git a/src/detect-dataset.c b/src/detect-dataset.c
index 45efc062b2ae..d43d5bad7fae 100644
--- a/src/detect-dataset.c
+++ b/src/detect-dataset.c
@@ -24,19 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "threads.h"
-#include "datasets.h"
 #include "detect-dataset.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "util-debug.h"
-#include "util-print.h"
 #include "util-misc.h"
 
 int DetectDatasetMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *,
diff --git a/src/detect-dce-iface.c b/src/detect-dce-iface.c
index 066f3806e64a..aa431d236c82 100644
--- a/src/detect-dce-iface.c
+++ b/src/detect-dce-iface.c
@@ -25,28 +25,11 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-engine-build.h"
 #include "detect-dce-iface.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "app-layer.h"
-#include "queue.h"
-#include "stream-tcp-reassemble.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "stream-tcp.h"
-
 #include "rust.h"
 
 #define PARSE_REGEX "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,\\s*(<|>|=|!)([0-9]{1,5}))?(?:\\s*,\\s*(any_frag))?\\s*$"
diff --git a/src/detect-dce-opnum.c b/src/detect-dce-opnum.c
index 6b91cefa85b4..50f58dcb6137 100644
--- a/src/detect-dce-opnum.c
+++ b/src/detect-dce-opnum.c
@@ -25,28 +25,11 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-engine-build.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "app-layer.h"
-#include "queue.h"
-#include "stream-tcp-reassemble.h"
 #include "detect-dce-opnum.h"
-#include "detect-dce-iface.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
 
diff --git a/src/detect-dce-stub-data.c b/src/detect-dce-stub-data.c
index 411009d320a7..01b4cc98800a 100644
--- a/src/detect-dce-stub-data.c
+++ b/src/detect-dce-stub-data.c
@@ -26,37 +26,25 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
 #include "detect-engine-build.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "queue.h"
-#include "stream-tcp-reassemble.h"
 
 #include "detect-dce-stub-data.h"
-#include "detect-dce-iface.h"
-
-#include "util-debug.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
 #include "stream-tcp.h"
 
-#include "rust.h"
-
 #define BUFFER_NAME "dce_stub_data"
 #define KEYWORD_NAME "dce_stub_data"
 
diff --git a/src/detect-depth.c b/src/detect-depth.c
index 1e82aa1c8245..e03f276222c2 100644
--- a/src/detect-depth.c
+++ b/src/detect-depth.c
@@ -26,21 +26,12 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
-#include "detect-uricontent.h"
 #include "detect-byte.h"
-#include "detect-byte-extract.h"
 #include "detect-depth.h"
 
-#include "flow-var.h"
-#include "app-layer.h"
-
 #include "util-byte.h"
-#include "util-debug.h"
 
 static int DetectDepthSetup (DetectEngineCtx *, Signature *, const char *);
 static int DetectStartsWithSetup (DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-detection-filter.c b/src/detect-detection-filter.c
index 61198bcbabbe..6ca0a8feb616 100644
--- a/src/detect-detection-filter.c
+++ b/src/detect-detection-filter.c
@@ -24,21 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-
-#include "host.h"
 
 #include "detect-detection-filter.h"
-#include "detect-threshold.h"
 #include "detect-parse.h"
 
 #include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 #include "detect-engine-build.h"
 
 #define TRACK_DST      1
@@ -272,10 +264,7 @@ static void DetectDetectionFilterFree(DetectEngineCtx *de_ctx, void *df_ptr)
  */
 #ifdef UNITTESTS
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-threshold.h"
 #include "util-time.h"
-#include "util-hashlist.h"
 
 /**
  * \test DetectDetectionFilterTestParse01 is a test for a valid detection_filter options
diff --git a/src/detect-distance.c b/src/detect-distance.c
index 11ea8ec30de0..91329ecf746a 100644
--- a/src/detect-distance.c
+++ b/src/detect-distance.c
@@ -26,26 +26,15 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "app-layer.h"
 
 #include "detect-content.h"
-#include "detect-uricontent.h"
 #include "detect-pcre.h"
 #include "detect-byte.h"
-#include "detect-byte-extract.h"
 #include "detect-distance.h"
 
-#include "flow-var.h"
-
 #include "util-byte.h"
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "detect-bytejump.h"
 #include "util-unittest-helper.h"
 
 static int DetectDistanceSetup(DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-dnp3.c b/src/detect-dnp3.c
index f3d64c3b326e..c38ad9eb8911 100644
--- a/src/detect-dnp3.c
+++ b/src/detect-dnp3.c
@@ -17,15 +17,11 @@
 
 #include "suricata-common.h"
 
-#include "stream.h"
-
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-dnp3.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
 
 #include "app-layer-dnp3.h"
 #include "util-byte.h"
@@ -601,11 +597,7 @@ void DetectDNP3Register(void)
 #ifdef UNITTESTS
 
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "app-layer-parser.h"
 #include "detect-engine.h"
-#include "flow-util.h"
-#include "stream-tcp.h"
 
 static int DetectDNP3FuncParseFunctionCodeTest(void)
 {
diff --git a/src/detect-dns-query.c b/src/detect-dns-query.c
index 559d6f735fca..3f0286639419 100644
--- a/src/detect-dns-query.c
+++ b/src/detect-dns-query.c
@@ -29,37 +29,24 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-build.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "detect-dns-query.h"
 
 #include "util-unittest-helper.h"
-#include "rust.h"
 
 static int DetectDnsQuerySetup (DetectEngineCtx *, Signature *, const char *);
 #ifdef UNITTESTS
diff --git a/src/detect-dsize.c b/src/detect-dsize.c
index 8702f9949314..5b1a11ea6a41 100644
--- a/src/detect-dsize.c
+++ b/src/detect-dsize.c
@@ -24,24 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine-prefilter-common.h"
 #include "detect-engine-build.h"
 
-#include "flow-var.h"
-
 #include "detect-content.h"
 #include "detect-dsize.h"
 
 #include "util-unittest.h"
-#include "util-debug.h"
-#include "util-byte.h"
 
 #include "pkt-var.h"
-#include "host.h"
 #include "util-profiling.h"
 
 static int DetectDsizeMatch (DetectEngineThreadCtx *, Packet *,
diff --git a/src/detect-engine-address-ipv4.c b/src/detect-engine-address-ipv4.c
index 80d29012988f..425f859391a0 100644
--- a/src/detect-engine-address-ipv4.c
+++ b/src/detect-engine-address-ipv4.c
@@ -25,20 +25,10 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-#include "detect.h"
-#include "flow-var.h"
-
-#include "util-cidr.h"
 #include "util-unittest.h"
 
 #include "detect-engine-address.h"
 #include "detect-engine-address-ipv4.h"
-#include "detect-engine-siggroup.h"
-#include "detect-engine-port.h"
-
-#include "util-error.h"
-#include "util-debug.h"
 
 /**
  * \brief Compares 2 addresses(address ranges) and returns the relationship
diff --git a/src/detect-engine-address-ipv6.c b/src/detect-engine-address-ipv6.c
index 3179628c6d55..7fb6769c4bbc 100644
--- a/src/detect-engine-address-ipv6.c
+++ b/src/detect-engine-address-ipv6.c
@@ -25,19 +25,10 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-#include "detect.h"
-#include "flow-var.h"
-
-#include "util-cidr.h"
 #include "util-unittest.h"
 
 #include "detect-engine-address.h"
 #include "detect-engine-address-ipv6.h"
-#include "detect-engine-siggroup.h"
-#include "detect-engine-port.h"
-
-#include "util-debug.h"
 
 /**
  * \brief Compares 2 ipv6 addresses and returns if the first address(a) is less
diff --git a/src/detect-engine-address.c b/src/detect-engine-address.c
index 4d5bc434f0b5..315410a3bf9e 100644
--- a/src/detect-engine-address.c
+++ b/src/detect-engine-address.c
@@ -24,26 +24,19 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "flow-var.h"
 
 #include "util-cidr.h"
 #include "util-unittest.h"
 #include "util-rule-vars.h"
-#include "conf.h"
 #include "conf-yaml-loader.h"
 
-#include "detect-engine-siggroup.h"
 #include "detect-engine-address.h"
 #include "detect-engine-address-ipv4.h"
 #include "detect-engine-address-ipv6.h"
 #include "detect-engine-port.h"
 
-#include "util-debug.h"
 #include "util-byte.h"
 #include "util-print.h"
-#include "util-var.h"
 
 /* prototypes */
 #ifdef DEBUG
diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 5ba5ae630ddf..a56d0552f85a 100644
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -17,16 +17,10 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine-alert.h"
 #include "detect-engine-threshold.h"
 #include "detect-engine-tag.h"
 
-#include "decode.h"
-
-#include "flow.h"
-#include "flow-private.h"
-
 #ifdef DEBUG
 #include "util-exception-policy.h"
 #endif
diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index 8376286612a5..5b08e950bfd9 100644
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -25,14 +25,11 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 #include "rust.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-analyzer.h"
 #include "detect-engine-mpm.h"
-#include "conf.h"
 #include "detect-content.h"
 #include "detect-flow.h"
 #include "detect-tcp-flags.h"
diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index 5458ec4a26bb..77221b33425f 100644
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -16,20 +16,17 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
 #include "detect-engine-build.h"
-#include "detect-engine-address.h"
 #include "detect-engine-analyzer.h"
 #include "detect-engine-iponly.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-siggroup.h"
 #include "detect-engine-port.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-proto.h"
 #include "detect-engine-threshold.h"
 
 #include "detect-dsize.h"
@@ -38,10 +35,13 @@
 #include "detect-config.h"
 #include "detect-flowbits.h"
 
-#include "util-profiling.h"
 #include "util-validate.h"
 #include "util-var-name.h"
 
+#ifdef PROFILING
+#include "util-profiling.h"
+#endif
+
 void SigCleanSignatures(DetectEngineCtx *de_ctx)
 {
     if (de_ctx == NULL)
diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
index 94d3f5f7760f..02b6d49f11e6 100644
--- a/src/detect-engine-content-inspection.c
+++ b/src/detect-engine-content-inspection.c
@@ -24,14 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "decode.h"
-
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-parse.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-isdataat.h"
 #include "detect-bytetest.h"
@@ -40,26 +34,20 @@
 #include "detect-byte-extract.h"
 #include "detect-replace.h"
 #include "detect-engine-content-inspection.h"
-#include "detect-uricontent.h"
-#include "detect-urilen.h"
 #include "detect-engine-uint.h"
 #include "detect-bsize.h"
-#include "detect-lua.h"
 #include "detect-base64-decode.h"
 #include "detect-base64-data.h"
 #include "detect-dataset.h"
 #include "detect-datarep.h"
 
-#include "util-spm.h"
-#include "util-debug.h"
-#include "util-print.h"
 #include "util-validate.h"
 
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 #include "util-profiling.h"
 
 #ifdef HAVE_LUA
+#include "detect-lua.h"
 #include "util-lua.h"
 #endif
 
diff --git a/src/detect-engine-dcepayload.c b/src/detect-engine-dcepayload.c
index 1e865ced25f2..484e64cbdbd5 100644
--- a/src/detect-engine-dcepayload.c
+++ b/src/detect-engine-dcepayload.c
@@ -22,35 +22,24 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "decode.h"
-
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-parse.h"
 #include "detect-pcre.h"
 #include "detect-isdataat.h"
 #include "detect-bytetest.h"
 #include "detect-bytejump.h"
-#include "detect-byte-extract.h"
 #include "detect-content.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-engine-dcepayload.h"
 #include "detect-engine-build.h"
 #include "app-layer-parser.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "flow-util.h"
-#include "util-debug.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "detect-dce-iface.h"
-
 static int g_dce_stub_data_buffer_id = 0;
 
 
diff --git a/src/detect-engine-enip.c b/src/detect-engine-enip.c
index 245b68cfb35d..13dbc3cc56a0 100644
--- a/src/detect-engine-enip.c
+++ b/src/detect-engine-enip.c
@@ -24,17 +24,11 @@
 
 #include "suricata-common.h"
 
-#include "app-layer.h"
 #include "app-layer-enip-common.h"
 
-#include "detect.h"
 #include "detect-cipservice.h"
 #include "detect-engine-enip.h"
 
-#include "flow.h"
-
-#include "util-debug.h"
-
 #if 0
 /**
  * \brief Print fields from ENIP Packet
diff --git a/src/detect-engine-event.c b/src/detect-engine-event.c
index fb9e98b59e52..0fb6b1630bc1 100644
--- a/src/detect-engine-event.c
+++ b/src/detect-engine-event.c
@@ -24,16 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "detect.h"
 #include "detect-parse.h"
 
-#include "flow-var.h"
-#include "decode-events.h"
-
-#include "util-debug.h"
-
 #include "stream-tcp.h"
 
 
diff --git a/src/detect-engine-file.c b/src/detect-engine-file.c
index 84a1809e9183..42e41719ca61 100644
--- a/src/detect-engine-file.c
+++ b/src/detect-engine-file.c
@@ -23,30 +23,12 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-
-#include "detect.h"
-#include "detect-engine.h"
-#include "detect-parse.h"
-#include "detect-engine-state.h"
-
 #include "detect-filestore.h"
 
-#include "detect-engine-dcepayload.h"
 #include "detect-engine-file.h"
 
-#include "stream-tcp.h"
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
-
 #include "app-layer-parser.h"
-#include "app-layer-protos.h"
-#include "app-layer-htp.h"
-#include "app-layer-dcerpc-common.h"
-#include "app-layer-smtp.h"
 
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
 #include "util-profiling.h"
 #include "util-validate.h"
 
diff --git a/src/detect-engine-frame.c b/src/detect-engine-frame.c
index 647456e2709e..bbd2a537f338 100644
--- a/src/detect-engine-frame.c
+++ b/src/detect-engine-frame.c
@@ -23,22 +23,20 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-
-#include "app-layer-parser.h"
-#include "app-layer-frames.h"
 
 #include "detect-engine.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-frame.h"
 
 #include "stream-tcp.h"
 
 #include "util-profiling.h"
 #include "util-validate.h"
-#include "util-print.h"
+
+#ifdef DEBUG
+#include "app-layer-parser.h"
+#endif
 
 void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,
         const Frames *frames, const Frame *frame, const AppProto alproto, const uint32_t idx)
diff --git a/src/detect-engine-iponly.c b/src/detect-engine-iponly.c
index e6bbbca36576..a65251b071a9 100644
--- a/src/detect-engine-iponly.c
+++ b/src/detect-engine-iponly.c
@@ -28,29 +28,17 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "decode.h"
-#include "flow.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
 
-#include "detect-engine-siggroup.h"
-#include "detect-engine-address.h"
-#include "detect-engine-proto.h"
 #include "detect-engine-port.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-build.h"
 
-#include "detect-engine-threshold.h"
 #include "detect-engine-iponly.h"
-#include "detect-threshold.h"
-#include "util-classification-config.h"
 #include "util-rule-vars.h"
 
 #include "flow-util.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-print.h"
diff --git a/src/detect-engine-loader.c b/src/detect-engine-loader.c
index 1ae1a5e28cd8..c75703af9e0e 100644
--- a/src/detect-engine-loader.c
+++ b/src/detect-engine-loader.c
@@ -23,17 +23,9 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "conf.h"
-#include "debug.h"
-#include "detect.h"
 #include "detect-parse.h"
 
-#include "runmodes.h"
-#include "threads.h"
-#include "threadvars.h"
 #include "tm-threads.h"
-#include "queue.h"
-#include "util-signal.h"
 
 #include "detect-engine-loader.h"
 #include "detect-engine-build.h"
diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c
index 9d4783827440..8e61e56f6281 100644
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@@ -24,45 +24,26 @@
  * Multi pattern matcher
  */
 
-#include "suricata.h"
 #include "suricata-common.h"
 
-#include "app-layer-protos.h"
-
-#include "decode.h"
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-siggroup.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-iponly.h"
-#include "detect-parse.h"
 #include "detect-engine-prefilter.h"
-#include "util-mpm.h"
 #include "util-memcmp.h"
-#include "util-memcpy.h"
-#include "conf.h"
 #include "detect-fast-pattern.h"
 
-#include "detect-tcphdr.h"
-#include "detect-udphdr.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "detect-flow.h"
-
 #include "detect-content.h"
 
 #include "detect-engine-payload.h"
 
-#include "stream.h"
-
 #include "util-misc.h"
-#include "util-enum.h"
-#include "util-debug.h"
-#include "util-print.h"
 #include "util-validate.h"
 #include "util-hash-string.h"
 
+#ifdef DEBUG
+#include "detect-parse.h"
+#endif
+
 const char *builtin_mpms[] = {
     "toserver TCP packet",
     "toclient TCP packet",
diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c
index a0d4aea98108..0522c1da66dd 100644
--- a/src/detect-engine-payload.c
+++ b/src/detect-engine-payload.c
@@ -24,31 +24,19 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 #include "rust.h"
 
-#include "decode.h"
-
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-state.h"
 #include "detect-engine-payload.h"
 #include "detect-engine-build.h"
 
-#include "stream.h"
 #include "stream-tcp.h"
 
-#include "util-debug.h"
-#include "util-print.h"
-
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-validate.h"
-
-#include "util-mpm-ac.h"
 
 struct StreamMpmData {
     DetectEngineThreadCtx *det_ctx;
diff --git a/src/detect-engine-port.c b/src/detect-engine-port.c
index 29d649b8f157..303553123969 100644
--- a/src/detect-engine-port.c
+++ b/src/detect-engine-port.c
@@ -27,30 +27,18 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "flow-var.h"
 
-#include "util-cidr.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-rule-vars.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 
 #include "detect-engine-siggroup.h"
 #include "detect-engine-port.h"
 
-#include "conf.h"
-#include "util-debug.h"
-#include "util-error.h"
-
 #include "pkt-var.h"
-#include "host.h"
 #include "util-profiling.h"
-#include "util-var.h"
 #include "util-byte.h"
 
 static int DetectPortCutNot(DetectPort *, DetectPort **);
diff --git a/src/detect-engine-prefilter.c b/src/detect-engine-prefilter.c
index 54e2a241f850..1c85119c74da 100644
--- a/src/detect-engine-prefilter.c
+++ b/src/detect-engine-prefilter.c
@@ -45,15 +45,9 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "detect-engine.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-frame.h"
-
-#include "app-layer-parser.h"
-#include "app-layer-htp.h"
 
 #include "util-profiling.h"
 #include "util-validate.h"
@@ -701,8 +695,6 @@ const char *PrefilterStoreGetName(const uint32_t id)
 }
 #endif
 
-#include "util-print.h"
-
 typedef struct PrefilterMpmCtx {
     int list_id;
     InspectionBufferGetDataPtr GetData;
diff --git a/src/detect-engine-profile.c b/src/detect-engine-profile.c
index 3fcc2a6b32f6..f0ed3f70d7b2 100644
--- a/src/detect-engine-profile.c
+++ b/src/detect-engine-profile.c
@@ -23,16 +23,12 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "detect.h"
-#include "detect-parse.h"
-#include "detect-content.h"
-#include "output-json.h"
-#include "util-buffer.h"
-#include "util-print.h"
 #include "detect-engine-profile.h"
 
 #ifdef PROFILING
+#include "rust.h"
+#include "output-json.h"
+
 SCMutex g_rule_dump_write_m = SCMUTEX_INITIALIZER;
 
 void RulesDumpTxMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh,
diff --git a/src/detect-engine-proto.c b/src/detect-engine-proto.c
index d864e7270f1e..f867c06d9b92 100644
--- a/src/detect-engine-proto.c
+++ b/src/detect-engine-proto.c
@@ -27,22 +27,7 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-#include "detect.h"
-
-#include "app-layer-parser.h"
-
-#include "flow-util.h"
-#include "flow-var.h"
-
-#include "detect-engine-siggroup.h"
-#include "detect-engine-state.h"
-
-#include "util-cidr.h"
-#include "util-byte.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-debug.h"
 
 /**
  * \brief Parses a protocol sent as a string.
@@ -148,7 +133,6 @@ int DetectProtoContainsProto(const DetectProto *dp, int proto)
 #ifdef UNITTESTS
 #include "detect-engine.h"
 #include "detect-parse.h"
-#include "detect-engine-mpm.h"
 /**
  * \brief this function is used to initialize the detection engine context and
  *        setup the signature with passed values.
diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c
index e0d8eefa6173..e11fafa86882 100644
--- a/src/detect-engine-register.c
+++ b/src/detect-engine-register.c
@@ -22,29 +22,9 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "flow-private.h"
-#include "flow-bit.h"
-
-#include "detect-parse.h"
+
 #include "detect-engine.h"
-#include "detect-engine-profile.h"
-
-#include "detect-engine-alert.h"
-#include "detect-engine-siggroup.h"
-#include "detect-engine-address.h"
-#include "detect-engine-proto.h"
-#include "detect-engine-port.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-iponly.h"
-#include "detect-engine-threshold.h"
-#include "detect-engine-prefilter.h"
-
-#include "detect-engine-payload.h"
-#include "detect-engine-dcepayload.h"
+
 #include "detect-dns-opcode.h"
 #include "detect-dns-query.h"
 #include "detect-tls-sni.h"
@@ -57,8 +37,6 @@
 #include "detect-tls-ja3-string.h"
 #include "detect-tls-ja3s-hash.h"
 #include "detect-tls-ja3s-string.h"
-#include "detect-engine-state.h"
-#include "detect-engine-analyzer.h"
 
 #include "detect-http-cookie.h"
 #include "detect-http-method.h"
@@ -70,7 +48,6 @@
 #include "detect-nfs-version.h"
 
 #include "detect-engine-event.h"
-#include "decode.h"
 
 #include "detect-config.h"
 
@@ -85,7 +62,6 @@
 #include "detect-gid.h"
 #include "detect-tcp-ack.h"
 #include "detect-tcp-seq.h"
-#include "detect-content.h"
 #include "detect-uricontent.h"
 #include "detect-pcre.h"
 #include "detect-depth.h"
@@ -104,10 +80,7 @@
 #include "detect-prefilter.h"
 #include "detect-priority.h"
 #include "detect-classtype.h"
-#include "detect-reference.h"
 #include "detect-tag.h"
-#include "detect-threshold.h"
-#include "detect-metadata.h"
 #include "detect-msg.h"
 #include "detect-rev.h"
 #include "detect-flow.h"
@@ -134,10 +107,8 @@
 #include "detect-noalert.h"
 #include "detect-flowbits.h"
 #include "detect-hostbits.h"
-#include "detect-xbits.h"
 #include "detect-csum.h"
 #include "detect-stream_size.h"
-#include "detect-engine-sigorder.h"
 #include "detect-ttl.h"
 #include "detect-fast-pattern.h"
 #include "detect-itype.h"
@@ -156,7 +127,6 @@
 #include "detect-http-header.h"
 #include "detect-http-header-names.h"
 #include "detect-http-headers.h"
-#include "detect-http-raw-header.h"
 #include "detect-http-uri.h"
 #include "detect-http-protocol.h"
 #include "detect-http-start.h"
@@ -228,7 +198,6 @@
 #include "detect-template-buffer.h"
 #include "detect-bypass.h"
 #include "detect-ftpdata.h"
-#include "detect-engine-content-inspection.h"
 
 #include "detect-transform-compress-whitespace.h"
 #include "detect-transform-strip-whitespace.h"
@@ -240,13 +209,6 @@
 #include "detect-transform-urldecode.h"
 #include "detect-transform-xor.h"
 
-#include "util-rule-vars.h"
-
-#include "app-layer.h"
-#include "app-layer-protos.h"
-#include "app-layer-htp.h"
-#include "app-layer-smtp.h"
-#include "app-layer-template.h"
 #include "detect-frame.h"
 #include "detect-tls.h"
 #include "detect-tls-cert-validity.h"
@@ -274,34 +236,6 @@
 #include "detect-ike-nonce-payload.h"
 #include "detect-ike-key-exchange-payload.h"
 
-#include "action-globals.h"
-#include "tm-threads.h"
-
-#include "pkt-var.h"
-
-#include "conf.h"
-#include "conf-yaml-loader.h"
-
-#include "stream-tcp.h"
-#include "stream-tcp-inline.h"
-
-#include "util-lua.h"
-#include "util-var-name.h"
-#include "util-classification-config.h"
-#include "util-threshold-config.h"
-#include "util-print.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-debug.h"
-#include "util-hashlist.h"
-#include "util-privs.h"
-#include "util-profiling.h"
-#include "util-validate.h"
-#include "util-optimize.h"
-#include "util-path.h"
-#include "util-mpm-ac.h"
-#include "runmodes.h"
-
 static void PrintFeatureList(const SigTableElmt *e, char sep)
 {
     const uint16_t flags = e->flags;
diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c
index 7a895104f276..610e62fca7eb 100644
--- a/src/detect-engine-siggroup.c
+++ b/src/detect-engine-siggroup.c
@@ -24,31 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 
-#include "flow-var.h"
-
-#include "app-layer-protos.h"
-
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-build.h"
-#include "detect-engine-address.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-siggroup.h"
 #include "detect-engine-prefilter.h"
 
-#include "detect-content.h"
-#include "detect-uricontent.h"
 #include "detect-tcp-flags.h"
 
-#include "util-hash.h"
-#include "util-hashlist.h"
-
-#include "util-error.h"
-#include "util-debug.h"
-#include "util-cidr.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-memcmp.h"
diff --git a/src/detect-engine-sigorder.c b/src/detect-engine-sigorder.c
index 02a38f7a5cc0..19a0cb94a1f3 100644
--- a/src/detect-engine-sigorder.c
+++ b/src/detect-engine-sigorder.c
@@ -24,20 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-xbits.h"
 #include "detect-flowbits.h"
 #include "detect-flowint.h"
-#include "detect-parse.h"
 #include "detect-engine-sigorder.h"
 #include "detect-pcre.h"
 #include "detect-engine-build.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 #include "util-action.h"
-#include "action-globals.h"
 #include "flow-util.h"
 
 #define DETECT_FLOWVAR_NOT_USED      1
diff --git a/src/detect-engine-state.c b/src/detect-engine-state.c
index 9d55d8abfaa8..6e1bc8d54284 100644
--- a/src/detect-engine-state.c
+++ b/src/detect-engine-state.c
@@ -38,30 +38,18 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
 #include "detect-engine-state.h"
-#include "detect-engine-dcepayload.h"
 #include "detect-engine-build.h"
 
-#include "detect-flowvar.h"
-
 #include "stream-tcp.h"
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "app-layer-protos.h"
 #include "app-layer-htp.h"
-#include "app-layer-dcerpc-common.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-profiling.h"
 
 #include "flow-util.h"
 
diff --git a/src/detect-engine-tag.c b/src/detect-engine-tag.c
index d445560f3914..2a41147ad057 100644
--- a/src/detect-engine-tag.c
+++ b/src/detect-engine-tag.c
@@ -27,21 +27,15 @@
 
 #include "suricata-common.h"
 #include "detect-engine.h"
-#include "util-hash.h"
-#include "util-atomic.h"
 #include "util-time.h"
-#include "util-hashlist.h"
 #include "detect-engine-tag.h"
 #include "detect-engine-build.h"
-#include "detect-tag.h"
-#include "host.h"
 #include "host-storage.h"
 #include "flow-storage.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "flow-util.h"
-#include "stream-tcp-private.h"
 
 SC_ATOMIC_DECLARE(unsigned int, num_tags);  /**< Atomic counter, to know if we
                                                  have tagged hosts/sessions,
diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c
index d7d0ce50bb18..d90495eb69d6 100644
--- a/src/detect-engine-threshold.c
+++ b/src/detect-engine-threshold.c
@@ -36,38 +36,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
 
-#include "host.h"
-#include "host-storage.h"
-
-#include "ippair.h"
 #include "ippair-storage.h"
 
-#include "detect-parse.h"
-#include "detect-engine-sigorder.h"
-
-#include "detect-engine-siggroup.h"
 #include "detect-engine-address.h"
-#include "detect-engine-port.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-iponly.h"
 
-#include "detect-engine.h"
 #include "detect-engine-threshold.h"
 
-#include "detect-content.h"
-#include "detect-uricontent.h"
-
-#include "util-hash.h"
 #include "util-time.h"
-#include "util-error.h"
-#include "util-debug.h"
-
-#include "util-var-name.h"
-#include "tm-threads.h"
 
 static HostStorageId host_threshold_id = { .id = -1 };     /**< host storage id for thresholds */
 static IPPairStorageId ippair_threshold_id = { .id = -1 }; /**< ip pair storage id for thresholds */
diff --git a/src/detect-engine-uint.c b/src/detect-engine-uint.c
index a02552bcd9de..d147d217af34 100644
--- a/src/detect-engine-uint.c
+++ b/src/detect-engine-uint.c
@@ -24,8 +24,6 @@
 
 #include "suricata-common.h"
 
-#include "util-byte.h"
-#include "detect-parse.h"
 #include "detect-engine-uint.h"
 
 int DetectU32Match(const uint32_t parg, const DetectUintData_u32 *du32)
diff --git a/src/detect-engine.c b/src/detect-engine.c
index 201e40558e48..21c25f6005eb 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -23,18 +23,11 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "flow-private.h"
-#include "flow-util.h"
 #include "flow-worker.h"
-#include "conf.h"
 #include "conf-yaml-loader.h"
 #include "datasets.h"
 
 #include "app-layer-parser.h"
-#include "app-layer-htp.h"
 
 #include "detect-parse.h"
 #include "detect-engine-sigorder.h"
@@ -46,19 +39,11 @@
 #include "detect-engine-prefilter.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-iponly.h"
-#include "detect-engine-tag.h"
 #include "detect-engine-frame.h"
 
-#include "detect-engine-file.h"
-
 #include "detect-engine.h"
-#include "detect-engine-state.h"
 #include "detect-engine-payload.h"
 #include "detect-fast-pattern.h"
-#include "detect-byte-extract.h"
-#include "detect-content.h"
-#include "detect-uricontent.h"
-#include "detect-tcphdr.h"
 #include "detect-engine-threshold.h"
 #include "detect-engine-content-inspection.h"
 
@@ -66,16 +51,9 @@
 
 #include "util-classification-config.h"
 #include "util-reference-config.h"
-#include "util-threshold-config.h"
-#include "util-error.h"
-#include "util-hash.h"
 #include "util-byte.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-action.h"
-#include "util-magic.h"
-#include "util-signal.h"
-#include "util-spm.h"
 #include "util-device.h"
 #include "util-var-name.h"
 #include "util-profiling.h"
@@ -84,9 +62,6 @@
 #include "util-enum.h"
 
 #include "tm-threads.h"
-#include "runmodes.h"
-
-#include "reputation.h"
 
 #define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000
 
diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c
index 373682bf0028..876b2cc4438f 100644
--- a/src/detect-fast-pattern.c
+++ b/src/detect-fast-pattern.c
@@ -24,18 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
-#include "flow.h"
 #include "detect-content.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-build.h"
 #include "detect-fast-pattern.h"
 
-#include "util-error.h"
 #include "util-byte.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index 0904b7c527a0..66f2243d811a 100644
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -23,16 +23,11 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-file-data.h"
@@ -41,14 +36,7 @@
 #include "app-layer-htp.h"
 #include "app-layer-smtp.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-spm-bm.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 #include "util-file-decompression.h"
 
 static int DetectFiledataSetup (DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-file-hash-common.c b/src/detect-file-hash-common.c
index 5e217b915a44..10c39ebe4845 100644
--- a/src/detect-file-hash-common.c
+++ b/src/detect-file-hash-common.c
@@ -25,13 +25,10 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-file-hash-common.h"
 
-#include "app-layer-htp.h"
-
 /**
  * \brief Read the bytes of a hash from an hexadecimal string
  *
diff --git a/src/detect-fileext.c b/src/detect-fileext.c
index f87a230e7eb9..10fa5999f076 100644
--- a/src/detect-fileext.c
+++ b/src/detect-fileext.c
@@ -24,32 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm-bm.h"
-#include "util-print.h"
 #include "util-memcmp.h"
 
-#include "app-layer.h"
-
-#include "stream-tcp.h"
 #include "detect-fileext.h"
 
 typedef struct DetectFileextData_ {
diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 5409263ca1cb..79938acc612f 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -23,11 +23,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
@@ -36,27 +32,15 @@
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
 #include "util-spm-bm.h"
 #include "util-magic.h"
-#include "util-print.h"
 
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "stream-tcp.h"
-
 #include "detect-filemagic.h"
 
-#include "conf.h"
-
 #ifndef HAVE_MAGIC
 
 static int DetectFilemagicSetupNoSupport (DetectEngineCtx *de_ctx, Signature *s, const char *str)
diff --git a/src/detect-filemd5.c b/src/detect-filemd5.c
index 12c1d190814e..17f351cc2138 100644
--- a/src/detect-filemd5.c
+++ b/src/detect-filemd5.c
@@ -27,7 +27,6 @@
 #include "detect-engine.h"
 #include "detect-file-hash-common.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
 #include "detect-filemd5.h"
 
diff --git a/src/detect-filename.c b/src/detect-filename.c
index 7aa39ccdb59c..cafdc01cda94 100644
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -24,34 +24,20 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-file.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
 #include "util-spm-bm.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "app-layer.h"
-
-#include "stream-tcp.h"
-
 #include "detect-filename.h"
 #include "app-layer-parser.h"
 
diff --git a/src/detect-filesha1.c b/src/detect-filesha1.c
index 6eef33c60824..cb85c037fc31 100644
--- a/src/detect-filesha1.c
+++ b/src/detect-filesha1.c
@@ -28,7 +28,6 @@
 #include "detect-engine.h"
 #include "detect-file-hash-common.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
 #include "detect-filesha1.h"
 
diff --git a/src/detect-filesha256.c b/src/detect-filesha256.c
index e5656a314979..99dfa58e6652 100644
--- a/src/detect-filesha256.c
+++ b/src/detect-filesha256.c
@@ -28,7 +28,6 @@
 #include "detect-engine.h"
 #include "detect-file-hash-common.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
 #include "detect-filesha256.h"
 
diff --git a/src/detect-filesize.c b/src/detect-filesize.c
index 50e84671fe62..6e3e61e15baf 100644
--- a/src/detect-filesize.c
+++ b/src/detect-filesize.c
@@ -24,25 +24,14 @@
  */
 
 #include "suricata-common.h"
-#include "app-layer-protos.h"
-#include "app-layer-htp.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-misc.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-state.h"
 #include "detect-engine-uint.h"
 #include "detect-engine-build.h"
 
 #include "detect-filesize.h"
-#include "util-debug.h"
-#include "util-byte.h"
-#include "flow-util.h"
-#include "stream-tcp.h"
-
 
 /*prototypes*/
 static int DetectFilesizeMatch (DetectEngineThreadCtx *det_ctx, Flow *f,
@@ -160,12 +149,7 @@ static void DetectFilesizeFree(DetectEngineCtx *de_ctx, void *ptr)
 }
 
 #ifdef UNITTESTS
-#include "stream.h"
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "app-layer-parser.h"
 
 /** \test   Test the Filesize keyword setup */
 static int DetectFilesizeParseTest01(void)
diff --git a/src/detect-filestore.c b/src/detect-filestore.c
index d7077c59c917..26bca1dcfc92 100644
--- a/src/detect-filestore.c
+++ b/src/detect-filestore.c
@@ -24,29 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
 #include "feature.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-spm-bm.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer-htp.h"
 
diff --git a/src/detect-flow.c b/src/detect-flow.c
index e6bcab26addf..21c932862ffb 100644
--- a/src/detect-flow.c
+++ b/src/detect-flow.c
@@ -24,23 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-engine-build.h"
 
-#include "flow.h"
-#include "flow-var.h"
-
 #include "detect-flow.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 
 /**
  * \brief Regex for parsing our flow options
diff --git a/src/detect-flowbits.c b/src/detect-flowbits.c
index c7516f765261..701fca80710c 100644
--- a/src/detect-flowbits.c
+++ b/src/detect-flowbits.c
@@ -25,26 +25,18 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "threads.h"
-#include "flow.h"
 #include "flow-bit.h"
 #include "flow-util.h"
 #include "detect-flowbits.h"
-#include "util-spm.h"
 
 #include "app-layer-parser.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 
 #include "util-var-name.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 #define PARSE_REGEX         "^([a-z]+)(?:,\\s*(.*))?"
 static DetectParseRegex parse_regex;
diff --git a/src/detect-flowint.c b/src/detect-flowint.c
index 631fafc10618..955fe735a9d6 100644
--- a/src/detect-flowint.c
+++ b/src/detect-flowint.c
@@ -25,28 +25,17 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "threads.h"
-#include "flow.h"
 #include "flow-var.h"
 #include "detect-flowint.h"
-#include "util-spm.h"
 #include "util-var-name.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-sigorder.h"
 #include "detect-engine-build.h"
 
-#include "pkt-var.h"
-#include "host.h"
-#include "util-profiling.h"
-
 /*                         name             modifiers          value      */
 #define PARSE_REGEX "^\\s*([a-zA-Z][\\w\\d_./]+)\\s*,\\s*([+=-]{1}|==|!=|<|<=|>|>=|isset|notset)\\s*,?\\s*([a-zA-Z][\\w\\d]+|[\\d]{1,10})?\\s*$"
 /* Varnames must begin with a letter */
diff --git a/src/detect-flowvar.c b/src/detect-flowvar.c
index c997276beafd..66a23d8d2635 100644
--- a/src/detect-flowvar.c
+++ b/src/detect-flowvar.c
@@ -24,23 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-content.h"
-#include "threads.h"
-#include "flow.h"
 #include "flow-var.h"
 #include "pkt-var.h"
 #include "detect-flowvar.h"
 
-#include "util-spm.h"
 #include "util-var-name.h"
-#include "util-debug.h"
-#include "util-print.h"
-#include "util-spm.h"
 
 #define PARSE_REGEX         "(.*),(.*)"
 static DetectParseRegex parse_regex;
diff --git a/src/detect-fragbits.c b/src/detect-fragbits.c
index 302f94e63194..20c906363587 100644
--- a/src/detect-fragbits.c
+++ b/src/detect-fragbits.c
@@ -25,25 +25,16 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine-prefilter.h"
 #include "detect-engine-prefilter-common.h"
 
-#include "flow-var.h"
-#include "decode-events.h"
 #include "app-layer.h"
-#include "app-layer-detect-proto.h"
 
 #include "detect-fragbits.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 #include "pkt-var.h"
-#include "host.h"
 #include "util-profiling.h"
 
 /**
diff --git a/src/detect-fragoffset.c b/src/detect-fragoffset.c
index c3e4268bf8b7..7d397ea83036 100644
--- a/src/detect-fragoffset.c
+++ b/src/detect-fragoffset.c
@@ -24,12 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "decode-ipv4.h"
-#include "decode-ipv6.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-engine-build.h"
@@ -38,7 +33,6 @@
 
 #include "util-byte.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 #define PARSE_REGEX "^\\s*(?:(<|>))?\\s*([0-9]+)"
 
@@ -329,7 +323,6 @@ static bool PrefilterFragOffsetIsPrefilterable(const Signature *s)
 
 #ifdef UNITTESTS
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 
 /**
  * \test DetectFragOffsetParseTest01 is a test for setting a valid fragoffset value
diff --git a/src/detect-frame.c b/src/detect-frame.c
index 54121178cec5..aa785d35b44b 100644
--- a/src/detect-frame.c
+++ b/src/detect-frame.c
@@ -20,32 +20,14 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "app-layer-parser.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-content.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-frame.h"
 
-#include "flow.h"
-#include "flow-util.h"
-#include "flow-var.h"
-
-#include "conf.h"
-#include "conf-yaml-loader.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 static int DetectFrameSetup(DetectEngineCtx *, Signature *, const char *);
 
diff --git a/src/detect-ftpbounce.c b/src/detect-ftpbounce.c
index 427e1f6800fb..e62e19cd6c6c 100644
--- a/src/detect-ftpbounce.c
+++ b/src/detect-ftpbounce.c
@@ -24,26 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-content.h"
 #include "detect-engine-build.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer-ftp.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
-#include "threads.h"
 #include "detect-ftpbounce.h"
 #include "stream-tcp.h"
 #include "util-byte.h"
@@ -261,8 +250,6 @@ static int DetectFtpbounceTestSetup01(void)
     PASS;
 }
 
-#include "stream-tcp-reassemble.h"
-
 /**
  * \test Check the ftpbounce match, send a get request in three chunks
  * + more data.
diff --git a/src/detect-ftpdata.c b/src/detect-ftpdata.c
index d914071ca17d..156455cbbeeb 100644
--- a/src/detect-ftpdata.c
+++ b/src/detect-ftpdata.c
@@ -28,9 +28,6 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-state.h"
-
-#include "app-layer-ftp.h"
 
 #include "detect-ftpdata.h"
 
diff --git a/src/detect-geoip.c b/src/detect-geoip.c
index b72b87cdba64..9f5c049daef6 100644
--- a/src/detect-geoip.c
+++ b/src/detect-geoip.c
@@ -26,20 +26,10 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
+#include "suricata.h"
 
 #include "detect-geoip.h"
 
-#include "util-mem.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
 #ifndef HAVE_GEOIP
 
 static int DetectGeoipSetupNoSupport (DetectEngineCtx *a, Signature *b, const char *c)
@@ -63,6 +53,9 @@ void DetectGeoipRegister(void)
 
 #else /* HAVE_GEOIP */
 
+#include "detect-engine.h"
+#include "detect-parse.h"
+
 #include <maxminddb.h>
 
 static int DetectGeoipMatch(DetectEngineThreadCtx *, Packet *,
@@ -454,6 +447,7 @@ static void DetectGeoipDataFree(DetectEngineCtx *de_ctx, void *ptr)
 }
 
 #ifdef UNITTESTS
+#include "util-unittest.h"
 
 static int GeoipParseTest(const char *rule, int ncountries, const char **countries, uint32_t flags)
 {
@@ -551,4 +545,4 @@ static void DetectGeoipRegisterTests(void)
     UtRegisterTest("GeoipParseTest07", GeoipParseTest07);
 }
 #endif /* UNITTESTS */
-#endif /* HAVE_GEOIP */
\ No newline at end of file
+#endif /* HAVE_GEOIP */
diff --git a/src/detect-gid.c b/src/detect-gid.c
index 6a37c1ad3e5d..86eca0adda80 100644
--- a/src/detect-gid.c
+++ b/src/detect-gid.c
@@ -24,17 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
-#include "flow-var.h"
-#include "decode-events.h"
 
 #include "detect-gid.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 static int DetectGidSetup (DetectEngineCtx *, Signature *, const char *);
 #ifdef UNITTESTS
diff --git a/src/detect-hostbits.c b/src/detect-hostbits.c
index cb3747aeb893..28d04cc304b3 100644
--- a/src/detect-hostbits.c
+++ b/src/detect-hostbits.c
@@ -24,29 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "threads.h"
-#include "flow.h"
-#include "flow-util.h"
 #include "detect-hostbits.h"
-#include "util-spm.h"
-
-#include "detect-engine-sigorder.h"
-
-#include "app-layer-parser.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 
-#include "flow-bit.h"
 #include "host-bit.h"
 #include "util-var-name.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 /*
     hostbits:isset,bitname;
diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c
index f4511957634e..adb33ba07795 100644
--- a/src/detect-http-client-body.c
+++ b/src/detect-http-client-body.c
@@ -31,33 +31,17 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer-htp.h"
 #include "detect-http-client-body.h"
-#include "stream-tcp.h"
 
 static int DetectHttpClientBodySetup(DetectEngineCtx *, Signature *, const char *);
 static int DetectHttpClientBodySetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str);
diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c
index c4d3583e33ed..ea3c99bec575 100644
--- a/src/detect-http-cookie.c
+++ b/src/detect-http-cookie.c
@@ -31,32 +31,12 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-error.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "app-layer-htp.h"
 #include "detect-http-cookie.h"
 #include "stream-tcp.h"
diff --git a/src/detect-http-header-common.c b/src/detect-http-header-common.c
index 3a8fe08c05ac..677aa6a5b09f 100644
--- a/src/detect-http-header-common.c
+++ b/src/detect-http-header-common.c
@@ -22,37 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
-#include "detect-pcre.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
-#include "app-layer-htp.h"
-#include "detect-http-header.h"
-#include "stream-tcp.h"
-
-#include "util-print.h"
 
 #include "detect-http-header-common.h"
 
diff --git a/src/detect-http-header-names.c b/src/detect-http-header-names.c
index 717178e94869..879952ecdfe8 100644
--- a/src/detect-http-header-names.c
+++ b/src/detect-http-header-names.c
@@ -31,40 +31,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-http-header-common.h"
 #include "detect-http-header-names.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-htp.h"
-#include "detect-http-header.h"
-#include "stream-tcp.h"
-
-#include "util-print.h"
-
 #define KEYWORD_NAME "http.header_names"
 #define KEYWORD_NAME_LEGACY "http_header_names"
 #define KEYWORD_DOC "http-keywords.html#http-header-names"
diff --git a/src/detect-http-header.c b/src/detect-http-header.c
index ea692c604e2a..75d6237ec20b 100644
--- a/src/detect-http-header.c
+++ b/src/detect-http-header.c
@@ -31,24 +31,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "util-debug.h"
-#include "util-print.h"
 #include "util-memcmp.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-htp.h"
diff --git a/src/detect-http-host.c b/src/detect-http-host.c
index 94ef91b47a3e..16a6e5f57cdc 100644
--- a/src/detect-http-host.c
+++ b/src/detect-http-host.c
@@ -31,29 +31,13 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "app-layer-htp.h"
 #include "stream-tcp.h"
 #include "detect-http-host.h"
diff --git a/src/detect-http-method.c b/src/detect-http-method.c
index b2e4b93a2cad..11ea44ba036a 100644
--- a/src/detect-http-method.c
+++ b/src/detect-http-method.c
@@ -31,30 +31,13 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "app-layer-htp.h"
 #include "detect-http-method.h"
 #include "stream-tcp.h"
diff --git a/src/detect-http-protocol.c b/src/detect-http-protocol.c
index 0f32154ddd2a..0f40c8c2fc58 100644
--- a/src/detect-http-protocol.c
+++ b/src/detect-http-protocol.c
@@ -31,39 +31,14 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
-#include "detect-http-header-common.h"
 #include "detect-http-protocol.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "app-layer-htp.h"
-#include "detect-http-header.h"
-#include "stream-tcp.h"
-
-#include "util-print.h"
 
 #define KEYWORD_NAME "http.protocol"
 #define KEYWORD_NAME_LEGACY "http_protocol"
diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c
index 61604f0685a1..16b89ee6a0dd 100644
--- a/src/detect-http-raw-header.c
+++ b/src/detect-http-raw-header.c
@@ -31,24 +31,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
 
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
-#include "util-debug.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 #include "app-layer-htp.h"
 #include "detect-http-raw-header.h"
 
diff --git a/src/detect-http-request-line.c b/src/detect-http-request-line.c
index 106374dac88a..c4c79f86734e 100644
--- a/src/detect-http-request-line.c
+++ b/src/detect-http-request-line.c
@@ -31,33 +31,14 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
-#include "app-layer-htp.h"
-#include "stream-tcp.h"
 #include "detect-http-request-line.h"
 
 static int DetectHttpRequestLineSetup(DetectEngineCtx *, Signature *, const char *);
@@ -146,8 +127,6 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
 
 #ifdef UNITTESTS
 
-#include "stream-tcp-reassemble.h"
-
 /**
  * \test Test that a signature containting a http_request_line is correctly parsed
  *       and the keyword is registered.
diff --git a/src/detect-http-response-line.c b/src/detect-http-response-line.c
index 4c297ad97769..f764d4657916 100644
--- a/src/detect-http-response-line.c
+++ b/src/detect-http-response-line.c
@@ -31,33 +31,14 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
-#include "app-layer-htp.h"
-#include "stream-tcp.h"
 #include "detect-http-response-line.h"
 
 static int DetectHttpResponseLineSetup(DetectEngineCtx *, Signature *, const char *);
@@ -145,8 +126,6 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
 
 #ifdef UNITTESTS
 
-#include "stream-tcp-reassemble.h"
-
 /**
  * \test Test that a signature containting a http_response_line is correctly parsed
  *       and the keyword is registered.
diff --git a/src/detect-http-server-body.c b/src/detect-http-server-body.c
index 1b6aff7c4da4..068ca03b5739 100644
--- a/src/detect-http-server-body.c
+++ b/src/detect-http-server-body.c
@@ -32,27 +32,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-spm.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-htp.h"
diff --git a/src/detect-http-start.c b/src/detect-http-start.c
index 3341d775b1c9..62cde93a8b7a 100644
--- a/src/detect-http-start.c
+++ b/src/detect-http-start.c
@@ -30,40 +30,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-http-header-common.h"
 #include "detect-http-start.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-htp.h"
-#include "detect-http-header.h"
-#include "stream-tcp.h"
-
-#include "util-print.h"
-
 #define KEYWORD_NAME "http.start"
 #define KEYWORD_NAME_LEGACY "http_start"
 #define KEYWORD_DOC "http-keywords.html#http-start"
diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c
index 51117eaf9435..ecfeb4cf1c9c 100644
--- a/src/detect-http-stat-code.c
+++ b/src/detect-http-stat-code.c
@@ -32,35 +32,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-error.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "app-layer-htp.h"
 #include "detect-http-stat-code.h"
-#include "stream-tcp-private.h"
 #include "stream-tcp.h"
 
 static int DetectHttpStatCodeSetup(DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c
index 44952331e786..2c04224e92d0 100644
--- a/src/detect-http-stat-msg.c
+++ b/src/detect-http-stat-msg.c
@@ -32,35 +32,14 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-error.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
-#include "app-layer-htp.h"
 #include "detect-http-stat-msg.h"
-#include "stream-tcp-private.h"
 #include "stream-tcp.h"
 
 static int DetectHttpStatMsgSetup(DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c
index b954018f1942..8c878c0c00d9 100644
--- a/src/detect-http-ua.c
+++ b/src/detect-http-ua.c
@@ -31,30 +31,13 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "app-layer-htp.h"
 #include "stream-tcp.h"
 #include "detect-http-ua.h"
diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c
index dbbbb653d584..498bf0d7f04d 100644
--- a/src/detect-http-uri.c
+++ b/src/detect-http-uri.c
@@ -30,12 +30,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
@@ -43,19 +38,8 @@
 #include "detect-pcre.h"
 #include "detect-urilen.h"
 
-#include "flow.h"
-#include "flow-var.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
-
-#include "app-layer.h"
-
 #include "app-layer-htp.h"
 #include "detect-http-uri.h"
-#include "detect-uricontent.h"
 #include "stream-tcp.h"
 
 #ifdef UNITTESTS
diff --git a/src/detect-http2.c b/src/detect-http2.c
index 09657fa461a1..fcdde5b3bb15 100644
--- a/src/detect-http2.c
+++ b/src/detect-http2.c
@@ -24,7 +24,6 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
@@ -36,7 +35,6 @@
 
 #include "detect-http2.h"
 #include "util-byte.h"
-#include "rust.h"
 
 #ifdef UNITTESTS
 void DetectHTTP2frameTypeRegisterTests (void);
diff --git a/src/detect-icmp-id.c b/src/detect-icmp-id.c
index 31cd636a94f8..276c9768a3a8 100644
--- a/src/detect-icmp-id.c
+++ b/src/detect-icmp-id.c
@@ -24,10 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-engine-build.h"
@@ -37,7 +34,6 @@
 #include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 
 #define PARSE_REGEX "^\\s*(\"\\s*)?([0-9]+)(\\s*\")?\\s*$"
 
@@ -325,7 +321,6 @@ static bool PrefilterIcmpIdIsPrefilterable(const Signature *s)
 
 #ifdef UNITTESTS
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 
 /**
  * \test DetectIcmpIdParseTest01 is a test for setting a valid icmp_id value
diff --git a/src/detect-icmp-seq.c b/src/detect-icmp-seq.c
index 69814b43a9dc..2050d1946578 100644
--- a/src/detect-icmp-seq.c
+++ b/src/detect-icmp-seq.c
@@ -24,10 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-engine-build.h"
@@ -37,7 +34,6 @@
 #include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 
 #define PARSE_REGEX "^\\s*(\"\\s*)?([0-9]+)(\\s*\")?\\s*$"
 
@@ -329,7 +325,6 @@ static bool PrefilterIcmpSeqIsPrefilterable(const Signature *s)
 
 #ifdef UNITTESTS
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 
 /**
  * \test DetectIcmpSeqParseTest01 is a test for setting a valid icmp_seq value
diff --git a/src/detect-icmpv4hdr.c b/src/detect-icmpv4hdr.c
index 42a6b4922278..515e57d38e59 100644
--- a/src/detect-icmpv4hdr.c
+++ b/src/detect-icmpv4hdr.c
@@ -24,7 +24,6 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-icmpv4hdr.h"
diff --git a/src/detect-icmpv6-mtu.c b/src/detect-icmpv6-mtu.c
index ecb87343d1a5..af887006fc99 100644
--- a/src/detect-icmpv6-mtu.c
+++ b/src/detect-icmpv6-mtu.c
@@ -24,7 +24,6 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-icmpv6-mtu.h"
diff --git a/src/detect-icmpv6hdr.c b/src/detect-icmpv6hdr.c
index 7de83dc5f199..2546e167bc86 100644
--- a/src/detect-icmpv6hdr.c
+++ b/src/detect-icmpv6hdr.c
@@ -24,15 +24,9 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-fast-pattern.h"
 #include "detect-icmpv6hdr.h"
-#include "util-validate.h"
 
 /* prototypes */
 static int DetectICMPv6hdrSetup (DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-icode.c b/src/detect-icode.c
index 1bf6cf07bd4e..f1695b78adb2 100644
--- a/src/detect-icode.c
+++ b/src/detect-icode.c
@@ -24,21 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine-prefilter-common.h"
 #include "detect-engine-uint.h"
 #include "detect-engine-build.h"
 
 #include "detect-icode.h"
 
-#include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 
 /**
  *\brief Regex for parsing our icode options
@@ -198,7 +192,6 @@ static bool PrefilterICodeIsPrefilterable(const Signature *s)
 
 #ifdef UNITTESTS
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 
 /**
  * \test DetectICodeParseTest01 is a test for setting a valid icode value
diff --git a/src/detect-id.c b/src/detect-id.c
index bdf0ef5a692b..11153bd5a26a 100644
--- a/src/detect-id.c
+++ b/src/detect-id.c
@@ -24,20 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-prefilter-common.h"
 
 #include "detect-id.h"
-#include "flow.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
diff --git a/src/detect-ike-chosen-sa.c b/src/detect-ike-chosen-sa.c
index 3b7e224e4e82..5b639f9ea13c 100644
--- a/src/detect-ike-chosen-sa.c
+++ b/src/detect-ike-chosen-sa.c
@@ -21,18 +21,13 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-ike-chosen-sa.h"
 #include "app-layer-parser.h"
 #include "util-byte.h"
 #include "util-unittest.h"
 
-#include "rust-bindings.h"
-
 /**
  *   [ike.chosen_sa_attribute]:<sa_attribute>=<type>;
  */
diff --git a/src/detect-ike-exch-type.c b/src/detect-ike-exch-type.c
index 3beb2c3a2519..c5ea738959fb 100644
--- a/src/detect-ike-exch-type.c
+++ b/src/detect-ike-exch-type.c
@@ -21,18 +21,11 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-ike-exch-type.h"
-#include "app-layer-parser.h"
-#include "util-byte.h"
 #include "detect-engine-uint.h"
 
-#include "rust-bindings.h"
-
 /**
  *   [ike.exchtype]:[<|>|<=|>=]<type>;
  */
diff --git a/src/detect-ike-key-exchange-payload-length.c b/src/detect-ike-key-exchange-payload-length.c
index 998948f4827c..31cf73a3fda0 100644
--- a/src/detect-ike-key-exchange-payload-length.c
+++ b/src/detect-ike-key-exchange-payload-length.c
@@ -21,18 +21,11 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-ike-key-exchange-payload-length.h"
-#include "app-layer-parser.h"
-#include "util-byte.h"
 #include "detect-engine-uint.h"
 
-#include "rust-bindings.h"
-
 /**
  *   [ike.key_exchange_payload_length]:[=|<|>|<=|>=]<length>;
  */
diff --git a/src/detect-ike-key-exchange-payload.c b/src/detect-ike-key-exchange-payload.c
index a11227ecda4b..bc7f8c5c96c5 100644
--- a/src/detect-ike-key-exchange-payload.c
+++ b/src/detect-ike-key-exchange-payload.c
@@ -21,35 +21,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-urilen.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
 #include "detect-ike-key-exchange-payload.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-ike.h"
-#include "rust-bindings.h"
 
 #define KEYWORD_NAME_KEY_EXCHANGE "ike.key_exchange_payload"
 #define KEYWORD_DOC_KEY_EXCHANGE  "ike-keywords.html#ike-key_exchange_payload";
diff --git a/src/detect-ike-nonce-payload-length.c b/src/detect-ike-nonce-payload-length.c
index 91bc6c200cac..b5f1aa708bd9 100644
--- a/src/detect-ike-nonce-payload-length.c
+++ b/src/detect-ike-nonce-payload-length.c
@@ -21,18 +21,11 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-ike-nonce-payload-length.h"
-#include "app-layer-parser.h"
-#include "util-byte.h"
 #include "detect-engine-uint.h"
 
-#include "rust-bindings.h"
-
 /**
  *   [ike.nonce_payload_length]:[=|<|>|<=|>=]<length>;
  */
diff --git a/src/detect-ike-nonce-payload.c b/src/detect-ike-nonce-payload.c
index 168613cba1e6..965dd736295d 100644
--- a/src/detect-ike-nonce-payload.c
+++ b/src/detect-ike-nonce-payload.c
@@ -21,35 +21,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-urilen.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
 #include "detect-ike-nonce-payload.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-ike.h"
-#include "rust-bindings.h"
 
 #define KEYWORD_NAME_NONCE "ike.nonce_payload"
 #define KEYWORD_DOC_NONCE  "ike-keywords.html#ike-nonce_payload";
diff --git a/src/detect-ike-spi.c b/src/detect-ike-spi.c
index 7699f9c67c1b..800ce3c93f0c 100644
--- a/src/detect-ike-spi.c
+++ b/src/detect-ike-spi.c
@@ -21,35 +21,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-urilen.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
 #include "detect-ike-spi.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-ike.h"
-#include "rust-bindings.h"
 
 #define KEYWORD_NAME_INITIATOR "ike.init_spi"
 #define KEYWORD_DOC_INITIATOR  "ike-keywords.html#ike-init_spi";
diff --git a/src/detect-ike-vendor.c b/src/detect-ike-vendor.c
index 73c2c0a7bf7b..ef6651a8c980 100644
--- a/src/detect-ike-vendor.c
+++ b/src/detect-ike-vendor.c
@@ -21,8 +21,6 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-prefilter.h"
@@ -30,9 +28,6 @@
 #include "detect-engine-mpm.h"
 #include "detect-ike-vendor.h"
 #include "app-layer-parser.h"
-#include "util-byte.h"
-
-#include "rust-bindings.h"
 
 static int DetectIkeVendorSetup(DetectEngineCtx *, Signature *, const char *);
 
diff --git a/src/detect-ipopts.c b/src/detect-ipopts.c
index dac1d24e1552..8c39c68c6dfe 100644
--- a/src/detect-ipopts.c
+++ b/src/detect-ipopts.c
@@ -24,17 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
-#include "flow-var.h"
-#include "decode-events.h"
-
-#include "util-debug.h"
-
 #include "detect-ipopts.h"
 #include "util-unittest.h"
 
diff --git a/src/detect-ipproto.c b/src/detect-ipproto.c
index 33f7a82ea661..15152a637c84 100644
--- a/src/detect-ipproto.c
+++ b/src/detect-ipproto.c
@@ -24,27 +24,18 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-ipproto.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-build.h"
 
-#include "detect-engine-siggroup.h"
-#include "detect-engine-address.h"
-
 #include "util-byte.h"
 #include "util-proto-name.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "util-debug.h"
-
 /**
  * \brief Regex for parsing our options
  */
diff --git a/src/detect-iprep.c b/src/detect-iprep.c
index 59c3d1aec39d..063846ab28c0 100644
--- a/src/detect-iprep.c
+++ b/src/detect-iprep.c
@@ -24,34 +24,18 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "threads.h"
-#include "flow.h"
-#include "flow-bit.h"
-#include "flow-util.h"
 #include "detect-iprep.h"
-#include "util-spm.h"
-
-#include "app-layer-parser.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-uint.h"
 #include "detect-engine-build.h"
 
-#include "util-debug.h"
-#include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-fmemopen.h"
 #include "util-validate.h"
 
-#include "reputation.h"
-#include "host.h"
-
 static int DetectIPRepMatch (DetectEngineThreadCtx *, Packet *,
         const Signature *, const SigMatchCtx *);
 static int DetectIPRepSetup (DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-ipv4hdr.c b/src/detect-ipv4hdr.c
index e39dddea0568..322dde6b47e2 100644
--- a/src/detect-ipv4hdr.c
+++ b/src/detect-ipv4hdr.c
@@ -24,13 +24,8 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-fast-pattern.h"
 #include "detect-ipv4hdr.h"
 
 /* prototypes */
diff --git a/src/detect-ipv6hdr.c b/src/detect-ipv6hdr.c
index e7221a9f9ea2..f6893aaad9c9 100644
--- a/src/detect-ipv6hdr.c
+++ b/src/detect-ipv6hdr.c
@@ -24,13 +24,8 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-fast-pattern.h"
 #include "detect-ipv6hdr.h"
 
 /* prototypes */
diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c
index 91d50e1a0f75..9638a5e3db67 100644
--- a/src/detect-isdataat.c
+++ b/src/detect-isdataat.c
@@ -24,25 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-parse.h"
-#include "app-layer.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
 #include "detect-isdataat.h"
 #include "detect-content.h"
-#include "detect-uricontent.h"
 #include "detect-engine-build.h"
 
-#include "flow.h"
-#include "flow-var.h"
-
-#include "util-debug.h"
 #include "util-byte.h"
 #include "detect-pcre.h"
 #include "detect-byte.h"
diff --git a/src/detect-itype.c b/src/detect-itype.c
index 03fa5462aa7b..8a262a044f5c 100644
--- a/src/detect-itype.c
+++ b/src/detect-itype.c
@@ -24,22 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine-prefilter-common.h"
 #include "detect-engine-build.h"
 
 #include "detect-itype.h"
 #include "detect-engine-uint.h"
 
-#include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
-
 
 static int DetectITypeMatch(DetectEngineThreadCtx *, Packet *,
         const Signature *, const SigMatchCtx *);
@@ -214,7 +207,6 @@ static bool PrefilterITypeIsPrefilterable(const Signature *s)
 #ifdef UNITTESTS
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 
 /**
  * \test DetectITypeParseTest01 is a test for setting a valid itype value
diff --git a/src/detect-krb5-cname.c b/src/detect-krb5-cname.c
index a7a2710178eb..d8168e8f4bf2 100644
--- a/src/detect-krb5-cname.c
+++ b/src/detect-krb5-cname.c
@@ -22,19 +22,16 @@
  */
 
 #include "suricata-common.h"
-#include "util-unittest.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 
 #include "detect-krb5-cname.h"
 
 #include "rust.h"
-#include "app-layer-krb5.h"
 
 static int g_krb5_cname_buffer_id = 0;
 
diff --git a/src/detect-krb5-errcode.c b/src/detect-krb5-errcode.c
index 62d498bf1b41..e027e25a8101 100644
--- a/src/detect-krb5-errcode.c
+++ b/src/detect-krb5-errcode.c
@@ -30,7 +30,6 @@
 
 #include "detect-krb5-errcode.h"
 
-#include "app-layer-krb5.h"
 #include "rust.h"
 
 /**
diff --git a/src/detect-krb5-msgtype.c b/src/detect-krb5-msgtype.c
index 7850d344a343..f0d6d8bae224 100644
--- a/src/detect-krb5-msgtype.c
+++ b/src/detect-krb5-msgtype.c
@@ -30,7 +30,6 @@
 
 #include "detect-krb5-msgtype.h"
 
-#include "app-layer-krb5.h"
 #include "rust.h"
 
 /**
diff --git a/src/detect-krb5-sname.c b/src/detect-krb5-sname.c
index 318484b08618..1f9746bfe9a5 100644
--- a/src/detect-krb5-sname.c
+++ b/src/detect-krb5-sname.c
@@ -22,19 +22,16 @@
  */
 
 #include "suricata-common.h"
-#include "util-unittest.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 
 #include "detect-krb5-sname.h"
 
 #include "rust.h"
-#include "app-layer-krb5.h"
 
 static int g_krb5_sname_buffer_id = 0;
 
diff --git a/src/detect-l3proto.c b/src/detect-l3proto.c
index 78e7c07e8c20..b98c57e1c563 100644
--- a/src/detect-l3proto.c
+++ b/src/detect-l3proto.c
@@ -25,27 +25,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-
-#include "detect-ipproto.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-build.h"
 
-#include "detect-engine-siggroup.h"
-#include "detect-engine-address.h"
-
 #include "detect-l3proto.h"
 
-#include "util-byte.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "util-debug.h"
 
 static int DetectL3ProtoSetup(DetectEngineCtx *, Signature *, const char *);
 #ifdef UNITTESTS
diff --git a/src/detect-lua-extensions.c b/src/detect-lua-extensions.c
index d03c022b705a..c2da5eb80885 100644
--- a/src/detect-lua-extensions.c
+++ b/src/detect-lua-extensions.c
@@ -24,44 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-
-#include "detect.h"
-#include "detect-parse.h"
-#include "detect-flowvar.h"
-
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-spm-bm.h"
-#include "util-print.h"
-
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "app-layer.h"
-
-#include "stream-tcp.h"
 
+#ifdef HAVE_LUA
 #include "detect-lua.h"
-
-#include "queue.h"
-#include "util-cpu.h"
-
+#include "flow-var.h"
 #include "app-layer-parser.h"
 
-#ifdef HAVE_LUA
-
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-http.h"
@@ -72,6 +40,7 @@
 #include "util-lua-hassh.h"
 #include "util-lua-smtp.h"
 #include "util-lua-dnp3.h"
+
 #include "detect-lua-extensions.h"
 
 static const char luaext_key_ld[] = "suricata:luadata";
diff --git a/src/detect-lua.c b/src/detect-lua.c
index e4765d0a5f49..7936c64ee3fa 100644
--- a/src/detect-lua.c
+++ b/src/detect-lua.c
@@ -23,44 +23,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-
-#include "detect.h"
-#include "detect-parse.h"
-
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-engine-build.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-spm-bm.h"
-#include "util-print.h"
-#include "util-byte.h"
-
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-htp.h"
-
-#include "stream-tcp.h"
 
 #include "detect-lua.h"
-#include "detect-lua-extensions.h"
-
-#include "queue.h"
-#include "util-cpu.h"
-#include "util-var-name.h"
 
 #ifndef HAVE_LUA
 
@@ -89,7 +53,15 @@ void DetectLuaRegister(void)
 
 #else /* HAVE_LUA */
 
+#include "detect-engine.h"
 #include "util-lua.h"
+#include "detect-lua-extensions.h"
+#include "util-byte.h"
+#include "app-layer.h"
+#include "app-layer-parser.h"
+#include "app-layer-htp.h"
+#include "util-var-name.h"
+#include "detect-parse.h"
 
 static int DetectLuaMatch (DetectEngineThreadCtx *,
         Packet *, const Signature *, const SigMatchCtx *);
@@ -1133,6 +1105,14 @@ static void DetectLuaFree(DetectEngineCtx *de_ctx, void *ptr)
 }
 
 #ifdef UNITTESTS
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+#include "flow-var.h"
+#include "flow-util.h"
+#include "stream-tcp.h"
+#include "detect-engine-build.h"
+#include "util-print.h"
+
 /** \test http buffer */
 static int LuaMatchTest01(void)
 {
diff --git a/src/detect-mark.c b/src/detect-mark.c
index 553a1eb70e9a..d5d284355bb8 100644
--- a/src/detect-mark.c
+++ b/src/detect-mark.c
@@ -25,18 +25,10 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "detect.h"
-#include "flow-var.h"
-#include "decode-events.h"
 
 #include "detect-mark.h"
 #include "detect-parse.h"
 
-#include "util-unittest.h"
-#include "util-debug.h"
-
 #define PARSE_REGEX "([0x]*[0-9a-f]+)/([0x]*[0-9a-f]+)"
 
 static DetectParseRegex parse_regex;
diff --git a/src/detect-metadata.c b/src/detect-metadata.c
index c311c1a15517..caed8f6b72fd 100644
--- a/src/detect-metadata.c
+++ b/src/detect-metadata.c
@@ -27,7 +27,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-metadata.h"
diff --git a/src/detect-modbus.c b/src/detect-modbus.c
index 964defd6dcd1..eb67509986cb 100644
--- a/src/detect-modbus.c
+++ b/src/detect-modbus.c
@@ -43,16 +43,11 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 
 #include "detect-modbus.h"
 
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "stream-tcp.h"
 #include "rust.h"
 
 static int g_modbus_buffer_id = 0;
diff --git a/src/detect-mqtt-connack-sessionpresent.c b/src/detect-mqtt-connack-sessionpresent.c
index 271d2a9ac49a..798f2afcdca9 100644
--- a/src/detect-mqtt-connack-sessionpresent.c
+++ b/src/detect-mqtt-connack-sessionpresent.c
@@ -22,11 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-mqtt-connack-sessionpresent.h"
 #include "util-unittest.h"
 
diff --git a/src/detect-mqtt-connect-clientid.c b/src/detect-mqtt-connect-clientid.c
index 421b486d1e87..f0fdfeb9f897 100644
--- a/src/detect-mqtt-connect-clientid.c
+++ b/src/detect-mqtt-connect-clientid.c
@@ -23,7 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-mqtt-connect-flags.c b/src/detect-mqtt-connect-flags.c
index c5ff4261f392..8816175b43b1 100644
--- a/src/detect-mqtt-connect-flags.c
+++ b/src/detect-mqtt-connect-flags.c
@@ -22,11 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-mqtt-connect-flags.h"
 #include "util-unittest.h"
 
diff --git a/src/detect-mqtt-connect-password.c b/src/detect-mqtt-connect-password.c
index 9c964418cd45..38ca04ac42bc 100644
--- a/src/detect-mqtt-connect-password.c
+++ b/src/detect-mqtt-connect-password.c
@@ -23,7 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-mqtt-connect-username.c b/src/detect-mqtt-connect-username.c
index a4f5a723d56d..4ccaa188e9d6 100644
--- a/src/detect-mqtt-connect-username.c
+++ b/src/detect-mqtt-connect-username.c
@@ -23,7 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-mqtt-connect-willmessage.c b/src/detect-mqtt-connect-willmessage.c
index 4fdcab6250b3..8f253347f143 100644
--- a/src/detect-mqtt-connect-willmessage.c
+++ b/src/detect-mqtt-connect-willmessage.c
@@ -23,7 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-mqtt-connect-willtopic.c b/src/detect-mqtt-connect-willtopic.c
index 2794a7d48c7f..36f951af258d 100644
--- a/src/detect-mqtt-connect-willtopic.c
+++ b/src/detect-mqtt-connect-willtopic.c
@@ -23,7 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-mqtt-flags.c b/src/detect-mqtt-flags.c
index bbde89e9a2c4..a2f764abf4ed 100644
--- a/src/detect-mqtt-flags.c
+++ b/src/detect-mqtt-flags.c
@@ -22,11 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-mqtt-flags.h"
 #include "util-unittest.h"
 
diff --git a/src/detect-mqtt-protocol-version.c b/src/detect-mqtt-protocol-version.c
index 39a9ce67d6f9..37b0b7ffca7e 100644
--- a/src/detect-mqtt-protocol-version.c
+++ b/src/detect-mqtt-protocol-version.c
@@ -22,18 +22,12 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-engine-uint.h"
 #include "detect-mqtt-protocol-version.h"
-#include "util-byte.h"
 #include "util-unittest.h"
 
-#include "rust.h"
-
 static int mqtt_protocol_version_id = 0;
 
 static int DetectMQTTProtocolVersionMatch(DetectEngineThreadCtx *det_ctx,
diff --git a/src/detect-mqtt-publish-message.c b/src/detect-mqtt-publish-message.c
index 32671bc32c22..806c18db6ee8 100644
--- a/src/detect-mqtt-publish-message.c
+++ b/src/detect-mqtt-publish-message.c
@@ -23,7 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-mqtt-publish-topic.c b/src/detect-mqtt-publish-topic.c
index 3a33acf732c3..999803dac9d5 100644
--- a/src/detect-mqtt-publish-topic.c
+++ b/src/detect-mqtt-publish-topic.c
@@ -23,7 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-mqtt-qos.c b/src/detect-mqtt-qos.c
index c6fed65892c8..ba1eb5184893 100644
--- a/src/detect-mqtt-qos.c
+++ b/src/detect-mqtt-qos.c
@@ -22,11 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-mqtt-qos.h"
 #include "util-byte.h"
 #include "util-unittest.h"
diff --git a/src/detect-mqtt-reason-code.c b/src/detect-mqtt-reason-code.c
index 50553aa63de9..e81205114fe6 100644
--- a/src/detect-mqtt-reason-code.c
+++ b/src/detect-mqtt-reason-code.c
@@ -22,11 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-mqtt-reason-code.h"
 #include "util-byte.h"
 #include "util-unittest.h"
diff --git a/src/detect-mqtt-subscribe-topic.c b/src/detect-mqtt-subscribe-topic.c
index 1e88259f19e7..b1660522f84a 100644
--- a/src/detect-mqtt-subscribe-topic.c
+++ b/src/detect-mqtt-subscribe-topic.c
@@ -23,36 +23,14 @@
 
 #include "suricata-common.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "conf.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-content.h"
-#include "detect-parse.h"
 #include "detect-pcre.h"
 #include "detect-engine.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-mqtt-subscribe-topic.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "rust-bindings.h"
-
-#include "threads.h"
-
-#include "flow.h"
-#include "flow-util.h"
-#include "flow-var.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 static int DetectMQTTSubscribeTopicSetup(DetectEngineCtx *, Signature *, const char *);
 
diff --git a/src/detect-mqtt-type.c b/src/detect-mqtt-type.c
index 5d5a32ed58f4..29bf5556b34b 100644
--- a/src/detect-mqtt-type.c
+++ b/src/detect-mqtt-type.c
@@ -22,11 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-mqtt-type.h"
 #include "util-unittest.h"
 
diff --git a/src/detect-mqtt-unsubscribe-topic.c b/src/detect-mqtt-unsubscribe-topic.c
index 94283fd4f4ec..8361d23d0ddf 100644
--- a/src/detect-mqtt-unsubscribe-topic.c
+++ b/src/detect-mqtt-unsubscribe-topic.c
@@ -23,36 +23,14 @@
 
 #include "suricata-common.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "conf.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-content.h"
-#include "detect-parse.h"
 #include "detect-pcre.h"
 #include "detect-engine.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-mqtt-unsubscribe-topic.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "rust-bindings.h"
-
-#include "threads.h"
-
-#include "flow.h"
-#include "flow-util.h"
-#include "flow-var.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 static int DetectMQTTUnsubscribeTopicSetup(DetectEngineCtx *, Signature *, const char *);
 
diff --git a/src/detect-msg.c b/src/detect-msg.c
index bdc21ef295f4..f1d24248249f 100644
--- a/src/detect-msg.c
+++ b/src/detect-msg.c
@@ -24,14 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "util-classification-config.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "detect-msg.h"
 
 static int DetectMsgSetup (DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-nfs-procedure.c b/src/detect-nfs-procedure.c
index 0aa8333fc884..ee09b0f30a41 100644
--- a/src/detect-nfs-procedure.c
+++ b/src/detect-nfs-procedure.c
@@ -22,31 +22,13 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-nfs-procedure.h"
 #include "detect-engine-uint.h"
 
-#include "app-layer-parser.h"
-
-#include "flow.h"
-#include "flow-util.h"
-#include "flow-var.h"
-
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-byte.h"
-
-#include "app-layer-nfs-tcp.h"
-#include "rust.h"
 
 static int DetectNfsProcedureSetup (DetectEngineCtx *, Signature *s, const char *str);
 static void DetectNfsProcedureFree(DetectEngineCtx *, void *);
diff --git a/src/detect-nfs-version.c b/src/detect-nfs-version.c
index ee6feeddc0e0..1290486e3a43 100644
--- a/src/detect-nfs-version.c
+++ b/src/detect-nfs-version.c
@@ -22,33 +22,12 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-nfs-version.h"
 #include "detect-engine-uint.h"
 
-#include "app-layer-parser.h"
-
-#include "flow.h"
-#include "flow-util.h"
-#include "flow-var.h"
-
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-byte.h"
-
-#include "app-layer-nfs-tcp.h"
-#include "rust.h"
-
-
 static int DetectNfsVersionSetup (DetectEngineCtx *, Signature *s, const char *str);
 static void DetectNfsVersionFree(DetectEngineCtx *de_ctx, void *);
 static int g_nfs_request_buffer_id = 0;
diff --git a/src/detect-noalert.c b/src/detect-noalert.c
index 0a89163e45d0..db31fdbc7dd0 100644
--- a/src/detect-noalert.c
+++ b/src/detect-noalert.c
@@ -24,9 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-noalert.h"
-#include "util-debug.h"
 
 static int DetectNoalertSetup (DetectEngineCtx *, Signature *, const char *);
 
diff --git a/src/detect-nocase.c b/src/detect-nocase.c
index b2d8b834a0c9..27f28242fadb 100644
--- a/src/detect-nocase.c
+++ b/src/detect-nocase.c
@@ -25,15 +25,11 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 #include "detect-nocase.h"
 
-#include "util-debug.h"
-
 static int DetectNocaseSetup (DetectEngineCtx *, Signature *, const char *);
 
 void DetectNocaseRegister(void)
diff --git a/src/detect-offset.c b/src/detect-offset.c
index 67dbb5ec963c..d68e0f2ecb8c 100644
--- a/src/detect-offset.c
+++ b/src/detect-offset.c
@@ -26,20 +26,12 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
-#include "detect-uricontent.h"
 #include "detect-byte.h"
-#include "detect-byte-extract.h"
 #include "detect-offset.h"
 
-#include "flow-var.h"
-
 #include "util-byte.h"
-#include "util-debug.h"
 
 static int DetectOffsetSetup(DetectEngineCtx *, Signature *, const char *);
 
diff --git a/src/detect-parse.c b/src/detect-parse.c
index 3fd1d9934cac..53980b20463e 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -24,52 +24,36 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
 
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-engine-address.h"
 #include "detect-engine-port.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 
 #include "detect-content.h"
 #include "detect-pcre.h"
-#include "detect-uricontent.h"
-#include "detect-reference.h"
 #include "detect-ipproto.h"
 #include "detect-flow.h"
-#include "detect-app-layer-protocol.h"
-#include "detect-lua.h"
 #include "detect-app-layer-event.h"
-#include "detect-http-method.h"
 
 #include "pkt-var.h"
-#include "host.h"
 #include "util-profiling.h"
-#include "decode.h"
-
-#include "flow.h"
-
-#include "util-rule-vars.h"
-#include "conf.h"
-#include "conf-yaml-loader.h"
 
 #include "app-layer.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-htp.h"
 
 #include "util-classification-config.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
-#include "string.h"
 #include "detect-parse.h"
 #include "detect-engine-iponly.h"
 #include "app-layer-detect-proto.h"
 
+#ifdef HAVE_LUA
+#include "detect-lua.h"
+#endif
+
 /* Table with all SigMatch registrations */
 SigTableElmt sigmatch_table[DETECT_TBLSIZE];
 
diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index 2df85d871104..0cf5300120db 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -24,40 +24,22 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "pkt-var.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
 #include "detect-pcre.h"
 #include "detect-flowvar.h"
 
-#include "detect-parse.h"
 #include "detect-content.h"
 #include "detect-engine.h"
-#include "detect-engine-sigorder.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 
 #include "util-var-name.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-print.h"
-#include "util-pool.h"
 
-#include "conf.h"
-#include "app-layer.h"
 #include "app-layer-htp.h"
-#include "stream.h"
 #include "stream-tcp.h"
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
-#include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "util-pages.h"
 
diff --git a/src/detect-pkt-data.c b/src/detect-pkt-data.c
index 730d59d2f997..8e2507494f81 100644
--- a/src/detect-pkt-data.c
+++ b/src/detect-pkt-data.c
@@ -23,25 +23,12 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-pkt-data.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-spm-bm.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
 static int DetectPktDataSetup (DetectEngineCtx *, Signature *, const char *);
 #ifdef UNITTESTS
diff --git a/src/detect-pktvar.c b/src/detect-pktvar.c
index 2b3abac1d781..065a4bbf4439 100644
--- a/src/detect-pktvar.c
+++ b/src/detect-pktvar.c
@@ -24,17 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
-#include "threads.h"
 #include "pkt-var.h"
 #include "detect-pktvar.h"
 #include "detect-content.h"
-#include "util-spm.h"
-#include "util-debug.h"
 #include "util-var-name.h"
 
 #define PARSE_REGEX         "(.*),(.*)"
diff --git a/src/detect-prefilter.c b/src/detect-prefilter.c
index 87e8491e7c00..40bd7a89610d 100644
--- a/src/detect-prefilter.c
+++ b/src/detect-prefilter.c
@@ -24,13 +24,10 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 #include "detect-prefilter.h"
-#include "util-debug.h"
 
 static int DetectPrefilterSetup (DetectEngineCtx *, Signature *, const char *);
 
diff --git a/src/detect-priority.c b/src/detect-priority.c
index ce72a19e4667..6804e7a51f0e 100644
--- a/src/detect-priority.c
+++ b/src/detect-priority.c
@@ -25,13 +25,9 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-priority.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 
 #define PARSE_REGEX "^\\s*(\\d+|\"\\d+\")\\s*$"
diff --git a/src/detect-quic-cyu-hash.c b/src/detect-quic-cyu-hash.c
index 095453037a60..16741605f0a3 100644
--- a/src/detect-quic-cyu-hash.c
+++ b/src/detect-quic-cyu-hash.c
@@ -21,7 +21,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
diff --git a/src/detect-quic-cyu-string.c b/src/detect-quic-cyu-string.c
index 6a49f2667a20..022b41b2b07c 100644
--- a/src/detect-quic-cyu-string.c
+++ b/src/detect-quic-cyu-string.c
@@ -21,7 +21,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-quic-sni.c b/src/detect-quic-sni.c
index 439f6b1fb69b..853cf9779baf 100644
--- a/src/detect-quic-sni.c
+++ b/src/detect-quic-sni.c
@@ -21,16 +21,11 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-engine-uint.h"
 #include "detect-quic-sni.h"
-#include "util-byte.h"
 #include "util-unittest.h"
 #include "rust.h"
 
diff --git a/src/detect-quic-ua.c b/src/detect-quic-ua.c
index b90f4fc5e575..b720dcc4d996 100644
--- a/src/detect-quic-ua.c
+++ b/src/detect-quic-ua.c
@@ -21,16 +21,11 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-engine-uint.h"
 #include "detect-quic-ua.h"
-#include "util-byte.h"
 #include "util-unittest.h"
 #include "rust.h"
 
diff --git a/src/detect-quic-version.c b/src/detect-quic-version.c
index d97f62ac1e95..51a0f5fc794a 100644
--- a/src/detect-quic-version.c
+++ b/src/detect-quic-version.c
@@ -21,16 +21,11 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-engine-uint.h"
 #include "detect-quic-version.h"
-#include "util-byte.h"
 #include "util-unittest.h"
 #include "rust.h"
 
diff --git a/src/detect-rawbytes.c b/src/detect-rawbytes.c
index d478f7072404..01ba0b641301 100644
--- a/src/detect-rawbytes.c
+++ b/src/detect-rawbytes.c
@@ -27,17 +27,12 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-rawbytes.h"
 #include "detect-engine.h"
 
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "util-debug.h"
-
 static int DetectRawbytesSetup(DetectEngineCtx *, Signature *, const char *);
 
 void DetectRawbytesRegister(void)
diff --git a/src/detect-reference.c b/src/detect-reference.c
index cbcda0c09cce..0ea9d0b8120a 100644
--- a/src/detect-reference.c
+++ b/src/detect-reference.c
@@ -25,23 +25,13 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-
-#include "decode.h"
-#include "flow-var.h"
-#include "decode-events.h"
-#include "stream-tcp.h"
 
 #include "util-reference-config.h"
 #include "detect-reference.h"
 
 #include "util-unittest.h"
-#include "util-byte.h"
-#include "util-debug.h"
 
 #define PARSE_REGEX "^\\s*([A-Za-z0-9]+)\\s*,\"?\\s*\"?\\s*([a-zA-Z0-9\\-_\\.\\/\\?\\=]+)\"?\\s*\"?"
 
diff --git a/src/detect-replace.c b/src/detect-replace.c
index 4164a651a93f..9b75a8fc2961 100644
--- a/src/detect-replace.c
+++ b/src/detect-replace.c
@@ -28,36 +28,20 @@
 
 #include "suricata-common.h"
 
-#include "runmodes.h"
-
 extern int run_mode;
 
-#include "decode.h"
-
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-content.h"
-#include "detect-uricontent.h"
-#include "detect-byte-extract.h"
 #include "detect-replace.h"
 #include "app-layer.h"
 
-#include "detect-engine-mpm.h"
 #include "detect-engine.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 
 #include "util-checksum.h"
 
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "flow-var.h"
-
-#include "util-debug.h"
 
 #include "pkt-var.h"
-#include "host.h"
 #include "util-profiling.h"
 
 static int DetectReplaceSetup(DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-rev.c b/src/detect-rev.c
index fb3def8d1028..7489010582cb 100644
--- a/src/detect-rev.c
+++ b/src/detect-rev.c
@@ -24,10 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-rev.h"
-#include "util-debug.h"
-#include "util-error.h"
 
 static int DetectRevSetup (DetectEngineCtx *, Signature *, const char *);
 
diff --git a/src/detect-rfb-name.c b/src/detect-rfb-name.c
index 556c3e0c687e..413c39276897 100644
--- a/src/detect-rfb-name.c
+++ b/src/detect-rfb-name.c
@@ -21,35 +21,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-urilen.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
 #include "detect-rfb-name.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-rfb.h"
-#include "rust-bindings.h"
 
 #define KEYWORD_NAME "rfb.name"
 #define KEYWORD_DOC  "rfb-keywords.html#rfb-name";
diff --git a/src/detect-rfb-secresult.c b/src/detect-rfb-secresult.c
index 1e5236811ce1..b77fac0a1d3a 100644
--- a/src/detect-rfb-secresult.c
+++ b/src/detect-rfb-secresult.c
@@ -22,11 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-rfb-secresult.h"
 #include "util-unittest.h"
 
diff --git a/src/detect-rfb-sectype.c b/src/detect-rfb-sectype.c
index 5b53287b49e6..a6740ab9b8ab 100644
--- a/src/detect-rfb-sectype.c
+++ b/src/detect-rfb-sectype.c
@@ -21,18 +21,10 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-rfb-sectype.h"
 #include "detect-engine-uint.h"
-#include "app-layer-parser.h"
-#include "util-byte.h"
-
-#include "rust-bindings.h"
-
 
 static int DetectRfbSectypeSetup (DetectEngineCtx *, Signature *s, const char *str);
 static void DetectRfbSectypeFree(DetectEngineCtx *, void *);
diff --git a/src/detect-rpc.c b/src/detect-rpc.c
index 6ccc7086dfe1..cfe3730f5d31 100644
--- a/src/detect-rpc.c
+++ b/src/detect-rpc.c
@@ -24,21 +24,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-rpc.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-siggroup.h"
-#include "detect-engine-address.h"
 #include "detect-engine-build.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 #include "util-byte.h"
 
 /**
diff --git a/src/detect-sameip.c b/src/detect-sameip.c
index d15c48d3eb31..2971e20b4eb9 100644
--- a/src/detect-sameip.c
+++ b/src/detect-sameip.c
@@ -24,13 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-build.h"
 
 #include "detect-sameip.h"
diff --git a/src/detect-sid.c b/src/detect-sid.c
index 2333e0589fbd..14212808d566 100644
--- a/src/detect-sid.c
+++ b/src/detect-sid.c
@@ -24,12 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
 #include "detect-sid.h"
-#include "util-debug.h"
-#include "util-error.h"
 #include "util-unittest.h"
 
 static int DetectSidSetup (DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-sip-method.c b/src/detect-sip-method.c
index 05417755c645..856804c21b34 100644
--- a/src/detect-sip-method.c
+++ b/src/detect-sip-method.c
@@ -24,35 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "detect-sip-method.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-sip.h"
 
 #define KEYWORD_NAME "sip.method"
 #define KEYWORD_DOC  "sip-keywords.html#sip-method"
diff --git a/src/detect-sip-protocol.c b/src/detect-sip-protocol.c
index ed8e780fbd36..6e83b10b046c 100644
--- a/src/detect-sip-protocol.c
+++ b/src/detect-sip-protocol.c
@@ -24,36 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "detect-sip-protocol.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-sip.h"
 
 #define KEYWORD_NAME "sip.protocol"
 #define KEYWORD_DOC  "sip-keywords.html#sip-protocol"
diff --git a/src/detect-sip-request-line.c b/src/detect-sip-request-line.c
index 2e91a01b504b..ad0dfbc32e15 100644
--- a/src/detect-sip-request-line.c
+++ b/src/detect-sip-request-line.c
@@ -23,36 +23,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
-#include "detect-urilen.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
 #include "detect-sip-request-line.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-sip.h"
 
 #define KEYWORD_NAME "sip.request_line"
 #define KEYWORD_DOC  "sip-keywords.html#sip-request-line"
diff --git a/src/detect-sip-response-line.c b/src/detect-sip-response-line.c
index 879d5bc69357..3e9b31573e7c 100644
--- a/src/detect-sip-response-line.c
+++ b/src/detect-sip-response-line.c
@@ -23,36 +23,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
-#include "detect-urilen.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
 #include "detect-sip-response-line.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-sip.h"
 
 #define KEYWORD_NAME "sip.response_line"
 #define KEYWORD_DOC  "sip-keywords.html#sip-response-line"
diff --git a/src/detect-sip-stat-code.c b/src/detect-sip-stat-code.c
index 8c15b050eabd..7b515c242d49 100644
--- a/src/detect-sip-stat-code.c
+++ b/src/detect-sip-stat-code.c
@@ -24,36 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
-#include "detect-urilen.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
 #include "detect-sip-stat-code.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-sip.h"
 
 #define KEYWORD_NAME "sip.stat_code"
 #define KEYWORD_DOC  "sip-keywords.html#sip-stat-code"
diff --git a/src/detect-sip-stat-msg.c b/src/detect-sip-stat-msg.c
index f8aac9a5c4b9..9e7584425fff 100644
--- a/src/detect-sip-stat-msg.c
+++ b/src/detect-sip-stat-msg.c
@@ -24,36 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
-#include "detect-urilen.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
 
 #include "detect-sip-stat-msg.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-sip.h"
 
 #define KEYWORD_NAME "sip.stat_msg"
 #define KEYWORD_DOC  "sip-keywords.html#sip-stat-msg"
diff --git a/src/detect-sip-uri.c b/src/detect-sip-uri.c
index 53d3ed954c20..475535b48c48 100644
--- a/src/detect-sip-uri.c
+++ b/src/detect-sip-uri.c
@@ -24,36 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-urilen.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "detect-sip-uri.h"
-#include "stream-tcp.h"
 
 #include "rust.h"
-#include "app-layer-sip.h"
 
 #define KEYWORD_NAME "sip.uri"
 #define KEYWORD_DOC  "sip-keywords.html#sip-uri"
diff --git a/src/detect-smb-share.c b/src/detect-smb-share.c
index c54ffa3779cc..48324266112f 100644
--- a/src/detect-smb-share.c
+++ b/src/detect-smb-share.c
@@ -24,14 +24,11 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
 
 #include "detect-smb-share.h"
 #include "rust.h"
diff --git a/src/detect-snmp-community.c b/src/detect-snmp-community.c
index f1882c269e38..22aa1b2946e5 100644
--- a/src/detect-snmp-community.c
+++ b/src/detect-snmp-community.c
@@ -25,15 +25,11 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-snmp-community.h"
-#include "app-layer-parser.h"
 #include "rust.h"
 
 static int DetectSNMPCommunitySetup(DetectEngineCtx *, Signature *,
diff --git a/src/detect-snmp-pdu_type.c b/src/detect-snmp-pdu_type.c
index f5169448fea4..e467174bede7 100644
--- a/src/detect-snmp-pdu_type.c
+++ b/src/detect-snmp-pdu_type.c
@@ -22,13 +22,9 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-snmp-pdu_type.h"
-#include "app-layer-parser.h"
 #include "rust.h"
 
 /**
diff --git a/src/detect-snmp-version.c b/src/detect-snmp-version.c
index f7ff2b6dd225..33b63cfb907a 100644
--- a/src/detect-snmp-version.c
+++ b/src/detect-snmp-version.c
@@ -22,16 +22,10 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-content-inspection.h"
 #include "detect-snmp-version.h"
 #include "detect-engine-uint.h"
-#include "app-layer-parser.h"
-#include "rust.h"
-
 
 static int DetectSNMPVersionSetup (DetectEngineCtx *, Signature *s, const char *str);
 static void DetectSNMPVersionFree(DetectEngineCtx *, void *);
diff --git a/src/detect-ssh-hassh-server-string.c b/src/detect-ssh-hassh-server-string.c
index d6a76f5f1207..a10974f9e6c9 100644
--- a/src/detect-ssh-hassh-server-string.c
+++ b/src/detect-ssh-hassh-server-string.c
@@ -22,29 +22,13 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-#include "stream-tcp.h"
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
 #include "detect-ssh-hassh-server-string.h"
 #include "rust.h"
 
diff --git a/src/detect-ssh-hassh-server.c b/src/detect-ssh-hassh-server.c
index 679ca8583b3e..29dddbd7ba59 100644
--- a/src/detect-ssh-hassh-server.c
+++ b/src/detect-ssh-hassh-server.c
@@ -22,30 +22,14 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-#include "stream-tcp.h"
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
 #include "detect-ssh-hassh-server.h"
 #include "rust.h"
 
diff --git a/src/detect-ssh-hassh-string.c b/src/detect-ssh-hassh-string.c
index a6ad4223b42b..d79d07e28fa3 100644
--- a/src/detect-ssh-hassh-string.c
+++ b/src/detect-ssh-hassh-string.c
@@ -22,29 +22,13 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "stream-tcp.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
 #include "detect-ssh-hassh-string.h"
 #include "rust.h"
 
diff --git a/src/detect-ssh-hassh.c b/src/detect-ssh-hassh.c
index d7cc837e318a..f7403cf76c01 100644
--- a/src/detect-ssh-hassh.c
+++ b/src/detect-ssh-hassh.c
@@ -22,30 +22,14 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "stream-tcp.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
 #include "detect-ssh-hassh.h"
 #include "rust.h"
 
diff --git a/src/detect-ssh-proto-version.c b/src/detect-ssh-proto-version.c
index 056db6fc8974..b759f8ef0a52 100644
--- a/src/detect-ssh-proto-version.c
+++ b/src/detect-ssh-proto-version.c
@@ -28,34 +28,18 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
 #include "detect-ssh-proto-version.h"
 #include "rust.h"
 
-#include "stream-tcp.h"
-
 /**
  * \brief Regex for parsing the protoversion string
  */
@@ -337,8 +321,6 @@ static int DetectSshVersionTestParse03 (void)
     return 1;
 }
 
-
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp-util.h"
 
 /** \test Send a get request in three chunks + more data. */
diff --git a/src/detect-ssh-proto.c b/src/detect-ssh-proto.c
index 4f4874a9161b..f29d54ac36a3 100644
--- a/src/detect-ssh-proto.c
+++ b/src/detect-ssh-proto.c
@@ -31,20 +31,12 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
 
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
 #include "detect-ssh-proto.h"
 #include "rust.h"
 
diff --git a/src/detect-ssh-software-version.c b/src/detect-ssh-software-version.c
index c0ef98e331d6..9ef30f3b3d19 100644
--- a/src/detect-ssh-software-version.c
+++ b/src/detect-ssh-software-version.c
@@ -32,34 +32,18 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
 #include "detect-ssh-software-version.h"
 #include "rust.h"
 
-#include "stream-tcp.h"
-
 /**
  * \brief Regex for parsing the softwareversion string
  */
@@ -311,8 +295,6 @@ static int DetectSshSoftwareVersionTestParse03 (void)
     return 1;
 }
 
-
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp-util.h"
 
 /** \test Send a get request in three chunks + more data. */
diff --git a/src/detect-ssh-software.c b/src/detect-ssh-software.c
index ac7b1973cedf..5c86be2ba6f6 100644
--- a/src/detect-ssh-software.c
+++ b/src/detect-ssh-software.c
@@ -31,20 +31,12 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
 
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
 #include "detect-ssh-software.h"
 #include "rust.h"
 
diff --git a/src/detect-ssl-state.c b/src/detect-ssl-state.c
index 548689dba656..b07d18b8fdf2 100644
--- a/src/detect-ssl-state.c
+++ b/src/detect-ssl-state.c
@@ -24,26 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "detect-ssl-state.h"
diff --git a/src/detect-ssl-version.c b/src/detect-ssl-version.c
index 6eb0af27e6e6..31d6b871e289 100644
--- a/src/detect-ssl-version.c
+++ b/src/detect-ssl-version.c
@@ -24,26 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "detect-ssl-version.h"
diff --git a/src/detect-stream_size.c b/src/detect-stream_size.c
index 86aabd77c8e8..5879130ff358 100644
--- a/src/detect-stream_size.c
+++ b/src/detect-stream_size.c
@@ -24,20 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "stream-tcp.h"
 #include "util-unittest.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
-#include "flow.h"
 #include "detect-stream_size.h"
 #include "stream-tcp-private.h"
-#include "detect-engine-prefilter-common.h"
 #include "detect-engine-uint.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
 
 /*prototypes*/
 static int DetectStreamSizeMatch (DetectEngineThreadCtx *, Packet *,
diff --git a/src/detect-tag.c b/src/detect-tag.c
index db894f79212c..365d565bcfc3 100644
--- a/src/detect-tag.c
+++ b/src/detect-tag.c
@@ -26,28 +26,12 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-tag.h"
 #include "detect-engine-tag.h"
-#include "detect-engine.h"
-#include "detect-engine-state.h"
-#include "app-layer-parser.h"
 
-#include "debug.h"
-#include "decode.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-#include "stream-tcp-private.h"
-
-#include "util-time.h"
 #include "util-byte.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-debug.h"
-#include "threads.h"
 
 SC_ATOMIC_EXTERN(unsigned int, num_tags);
 
diff --git a/src/detect-tcp-ack.c b/src/detect-tcp-ack.c
index 3e5046d23139..8bbac0dfc541 100644
--- a/src/detect-tcp-ack.c
+++ b/src/detect-tcp-ack.c
@@ -25,14 +25,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-engine-build.h"
 
@@ -41,7 +36,6 @@
 #include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 
 /* prototypes */
 static int DetectAckSetup(DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-tcp-flags.c b/src/detect-tcp-flags.c
index fd0ff100e6f7..6f39ece9b675 100644
--- a/src/detect-tcp-flags.c
+++ b/src/detect-tcp-flags.c
@@ -24,22 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine-prefilter.h"
 #include "detect-engine-prefilter-common.h"
 
-#include "flow-var.h"
-#include "decode-events.h"
-
 #include "detect-tcp-flags.h"
 #include "util-unittest.h"
 
-#include "util-debug.h"
-
 /**
  *  Regex (by Brian Rectanus)
  *  flags: [!+*](SAPRFU120)[,SAPRFU12]
diff --git a/src/detect-tcp-seq.c b/src/detect-tcp-seq.c
index 0f7025d5681f..bd6149ec9544 100644
--- a/src/detect-tcp-seq.c
+++ b/src/detect-tcp-seq.c
@@ -24,13 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-prefilter.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-engine-build.h"
 
@@ -39,7 +35,6 @@
 #include "util-byte.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
-#include "util-debug.h"
 
 static int DetectSeqSetup(DetectEngineCtx *, Signature *, const char *);
 static int DetectSeqMatch(DetectEngineThreadCtx *,
diff --git a/src/detect-tcp-window.c b/src/detect-tcp-window.c
index de25663db995..e1017374a62d 100644
--- a/src/detect-tcp-window.c
+++ b/src/detect-tcp-window.c
@@ -24,17 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-tcp-window.h"
-#include "flow.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-byte.h"
diff --git a/src/detect-tcphdr.c b/src/detect-tcphdr.c
index 4b6a65986d27..2ff8ab003a73 100644
--- a/src/detect-tcphdr.c
+++ b/src/detect-tcphdr.c
@@ -24,13 +24,8 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-fast-pattern.h"
 #include "detect-tcphdr.h"
 
 /* prototypes */
diff --git a/src/detect-tcpmss.c b/src/detect-tcpmss.c
index 1ed04d349943..4ba3f9be9e62 100644
--- a/src/detect-tcpmss.c
+++ b/src/detect-tcpmss.c
@@ -24,11 +24,8 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine-prefilter-common.h"
 #include "detect-engine-uint.h"
-#include "util-byte.h"
 
 #include "detect-tcpmss.h"
 
diff --git a/src/detect-template-buffer.c b/src/detect-template-buffer.c
index 419d4783885a..fbea8db11d1c 100644
--- a/src/detect-template-buffer.c
+++ b/src/detect-template-buffer.c
@@ -31,8 +31,6 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-template-rust-buffer.c b/src/detect-template-rust-buffer.c
index 24f81f6245c7..80a68ee88fd6 100644
--- a/src/detect-template-rust-buffer.c
+++ b/src/detect-template-rust-buffer.c
@@ -31,16 +31,12 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-template-rust-buffer.h"
 #include "app-layer-parser.h"
 #include "detect-engine-build.h"
-#include "rust.h"
-
 
 static int DetectTemplateRustBufferSetup(DetectEngineCtx *, Signature *,
     const char *);
diff --git a/src/detect-template.c b/src/detect-template.c
index ae04da95a133..c30825feba59 100644
--- a/src/detect-template.c
+++ b/src/detect-template.c
@@ -24,11 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "util-unittest.h"
 #include "util-byte.h"
 
 #include "detect-parse.h"
-#include "detect-engine.h"
 
 #include "detect-template.h"
 
diff --git a/src/detect-template2.c b/src/detect-template2.c
index 7b554599a362..46cdc8ab93a6 100644
--- a/src/detect-template2.c
+++ b/src/detect-template2.c
@@ -23,11 +23,8 @@
  */
 
 #include "suricata-common.h"
-#include "util-byte.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine-prefilter-common.h"
 #include "detect-engine-uint.h"
 
 #include "detect-template2.h"
diff --git a/src/detect-threshold.c b/src/detect-threshold.c
index 1395a33898a7..7825b89b2c3c 100644
--- a/src/detect-threshold.c
+++ b/src/detect-threshold.c
@@ -33,19 +33,9 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
 
-#include "host.h"
-#include "host-storage.h"
-
-#include "detect.h"
 #include "detect-parse.h"
 
-#include "flow-var.h"
-#include "decode-events.h"
-#include "stream-tcp.h"
-
 #include "detect-threshold.h"
 #include "detect-engine-threshold.h"
 #include "detect-engine-address.h"
@@ -54,7 +44,6 @@
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-byte.h"
-#include "util-debug.h"
 
 #ifdef UNITTESTS
 #include "util-cpu.h"
@@ -339,9 +328,7 @@ DetectThresholdData *DetectThresholdDataCopy(DetectThresholdData *de)
  */
 #ifdef UNITTESTS
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "util-time.h"
-#include "util-hashlist.h"
 
 /**
  * \test ThresholdTestParse01 is a test for a valid threshold options
diff --git a/src/detect-tls-cert-fingerprint.c b/src/detect-tls-cert-fingerprint.c
index 56e424cb3906..a8da9d96ab16 100644
--- a/src/detect-tls-cert-fingerprint.c
+++ b/src/detect-tls-cert-fingerprint.c
@@ -24,12 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
@@ -37,18 +32,12 @@
 #include "detect-pcre.h"
 #include "detect-tls-cert-fingerprint.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 
 #include "util-unittest.h"
diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c
index bf89e6550a8e..087a05ead28b 100644
--- a/src/detect-tls-cert-issuer.c
+++ b/src/detect-tls-cert-issuer.c
@@ -24,30 +24,18 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 #include "detect-tls-cert-issuer.h"
 
diff --git a/src/detect-tls-cert-serial.c b/src/detect-tls-cert-serial.c
index d7096bdf60eb..ea720812f7af 100644
--- a/src/detect-tls-cert-serial.c
+++ b/src/detect-tls-cert-serial.c
@@ -24,30 +24,19 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 #include "detect-tls-cert-serial.h"
 
diff --git a/src/detect-tls-cert-subject.c b/src/detect-tls-cert-subject.c
index 0e43a45a1acd..1cad6db13122 100644
--- a/src/detect-tls-cert-subject.c
+++ b/src/detect-tls-cert-subject.c
@@ -24,31 +24,19 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-tls-cert-subject.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 
 #include "util-unittest.h"
diff --git a/src/detect-tls-cert-validity.c b/src/detect-tls-cert-validity.c
index 7b9225c3fc90..9d9d6880b958 100644
--- a/src/detect-tls-cert-validity.c
+++ b/src/detect-tls-cert-validity.c
@@ -24,25 +24,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-tls-cert-validity.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 
 #include "util-time.h"
diff --git a/src/detect-tls-certs.c b/src/detect-tls-certs.c
index b6f748f34c54..fcf090dabbbf 100644
--- a/src/detect-tls-certs.c
+++ b/src/detect-tls-certs.c
@@ -24,32 +24,20 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-tls-certs.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 
 #include "util-unittest.h"
diff --git a/src/detect-tls-ja3-hash.c b/src/detect-tls-ja3-hash.c
index 4f15dd661e35..9fae7e35588f 100644
--- a/src/detect-tls-ja3-hash.c
+++ b/src/detect-tls-ja3-hash.c
@@ -24,12 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
@@ -37,22 +32,12 @@
 #include "detect-pcre.h"
 #include "detect-tls-ja3-hash.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "conf.h"
-#include "conf-yaml-loader.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
-#include "util-ja3.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 
 #include "util-unittest.h"
diff --git a/src/detect-tls-ja3-string.c b/src/detect-tls-ja3-string.c
index 76c44c8c0d56..95d255404a4d 100644
--- a/src/detect-tls-ja3-string.c
+++ b/src/detect-tls-ja3-string.c
@@ -24,35 +24,19 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-tls-ja3-string.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "conf.h"
-#include "conf-yaml-loader.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
-#include "util-ja3.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 
 #include "util-unittest.h"
diff --git a/src/detect-tls-ja3s-hash.c b/src/detect-tls-ja3s-hash.c
index 4c63fff0cc5d..ffe8443078d4 100644
--- a/src/detect-tls-ja3s-hash.c
+++ b/src/detect-tls-ja3s-hash.c
@@ -24,12 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
@@ -37,22 +32,12 @@
 #include "detect-pcre.h"
 #include "detect-tls-ja3s-hash.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "conf.h"
-#include "conf-yaml-loader.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
-#include "util-ja3.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 
 #include "util-unittest.h"
diff --git a/src/detect-tls-ja3s-string.c b/src/detect-tls-ja3s-string.c
index 7b22fce6c29e..2d265a685dd0 100644
--- a/src/detect-tls-ja3s-string.c
+++ b/src/detect-tls-ja3s-string.c
@@ -24,35 +24,19 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-tls-ja3s-string.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "conf.h"
-#include "conf-yaml-loader.h"
-
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
-#include "util-ja3.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
 #include "app-layer-ssl.h"
 
 #include "util-unittest.h"
diff --git a/src/detect-tls-sni.c b/src/detect-tls-sni.c
index 5bcb4172a728..ffd8c7f79db0 100644
--- a/src/detect-tls-sni.c
+++ b/src/detect-tls-sni.c
@@ -24,30 +24,17 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-content.h"
 #include "detect-pcre.h"
 
-#include "flow.h"
 #include "flow-util.h"
-#include "flow-var.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
-#include "util-spm.h"
-#include "util-print.h"
 
 #include "stream-tcp.h"
 
-#include "app-layer.h"
-#include "app-layer-ssl.h"
 #include "detect-engine-prefilter.h"
 #include "detect-tls-sni.h"
 
diff --git a/src/detect-tls-version.c b/src/detect-tls-version.c
index 49319146074c..61404adcd539 100644
--- a/src/detect-tls-version.c
+++ b/src/detect-tls-version.c
@@ -24,28 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "flow.h"
-#include "flow-var.h"
 #include "flow-util.h"
 
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 #include "app-layer-ssl.h"
 #include "detect-tls-version.h"
 
diff --git a/src/detect-tls.c b/src/detect-tls.c
index b8973b1fdd6d..2f74d6d7ab4e 100644
--- a/src/detect-tls.c
+++ b/src/detect-tls.c
@@ -34,33 +34,15 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-content.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "app-layer.h"
 
 #include "app-layer-ssl.h"
 #include "detect-tls.h"
 
-#include "stream-tcp.h"
-
 /**
  * \brief Regex for parsing "id" option, matching number or "number"
  */
diff --git a/src/detect-tos.c b/src/detect-tos.c
index a71aa969a2d3..74029476d0b5 100644
--- a/src/detect-tos.c
+++ b/src/detect-tos.c
@@ -22,24 +22,11 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-tos.h"
 
-#include "app-layer-protos.h"
-
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-
 #include "util-byte.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
diff --git a/src/detect-transform-compress-whitespace.c b/src/detect-transform-compress-whitespace.c
index 13b5f4d01e1c..7b0988abcded 100644
--- a/src/detect-transform-compress-whitespace.c
+++ b/src/detect-transform-compress-whitespace.c
@@ -25,9 +25,7 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-prefilter.h"
 #include "detect-parse.h"
 #include "detect-transform-compress-whitespace.h"
 
diff --git a/src/detect-transform-dotprefix.c b/src/detect-transform-dotprefix.c
index 52a263372b43..bfeffa51ac2d 100644
--- a/src/detect-transform-dotprefix.c
+++ b/src/detect-transform-dotprefix.c
@@ -25,17 +25,13 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-prefilter.h"
 #include "detect-parse.h"
 #include "detect-transform-dotprefix.h"
 #include "detect-engine-build.h"
 
 #include "util-unittest.h"
 #include "util-print.h"
-#include "util-memrchr.h"
-#include "util-memcpy.h"
 
 static int DetectTransformDotPrefixSetup (DetectEngineCtx *, Signature *, const char *);
 #ifdef UNITTESTS
diff --git a/src/detect-transform-md5.c b/src/detect-transform-md5.c
index 2e6d8d4ea6f7..56cd3ae9fbd6 100644
--- a/src/detect-transform-md5.c
+++ b/src/detect-transform-md5.c
@@ -25,9 +25,7 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-prefilter.h"
 #include "detect-parse.h"
 #include "detect-transform-md5.h"
 
diff --git a/src/detect-transform-pcrexform.c b/src/detect-transform-pcrexform.c
index 7ab9fd3a349b..aee34cf920b0 100644
--- a/src/detect-transform-pcrexform.c
+++ b/src/detect-transform-pcrexform.c
@@ -25,9 +25,7 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-parse.h"
 #include "detect-transform-pcrexform.h"
 #include "detect-pcre.h"
 
diff --git a/src/detect-transform-sha1.c b/src/detect-transform-sha1.c
index 6ff84b5ccbef..a00f8868e70a 100644
--- a/src/detect-transform-sha1.c
+++ b/src/detect-transform-sha1.c
@@ -25,9 +25,7 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-prefilter.h"
 #include "detect-parse.h"
 #include "detect-transform-sha1.h"
 
diff --git a/src/detect-transform-sha256.c b/src/detect-transform-sha256.c
index af07454d8a6d..94b9b82527c6 100644
--- a/src/detect-transform-sha256.c
+++ b/src/detect-transform-sha256.c
@@ -25,9 +25,7 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-prefilter.h"
 #include "detect-parse.h"
 #include "detect-transform-sha256.h"
 
diff --git a/src/detect-transform-strip-whitespace.c b/src/detect-transform-strip-whitespace.c
index 7ca48b104851..f43aaf2b5e5f 100644
--- a/src/detect-transform-strip-whitespace.c
+++ b/src/detect-transform-strip-whitespace.c
@@ -25,9 +25,7 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-prefilter.h"
 #include "detect-engine-build.h"
 #include "detect-parse.h"
 #include "detect-transform-strip-whitespace.h"
diff --git a/src/detect-transform-urldecode.c b/src/detect-transform-urldecode.c
index f74e69497003..c504cfb3f462 100644
--- a/src/detect-transform-urldecode.c
+++ b/src/detect-transform-urldecode.c
@@ -25,9 +25,7 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-prefilter.h"
 #include "detect-engine-build.h"
 #include "detect-parse.h"
 #include "detect-transform-urldecode.h"
diff --git a/src/detect-transform-xor.c b/src/detect-transform-xor.c
index 7fbf7fb3cda0..312da0b8b61b 100644
--- a/src/detect-transform-xor.c
+++ b/src/detect-transform-xor.c
@@ -24,7 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
 #include "detect-transform-xor.h"
diff --git a/src/detect-ttl.c b/src/detect-ttl.c
index 20d1563bfee9..7723d37f10ee 100644
--- a/src/detect-ttl.c
+++ b/src/detect-ttl.c
@@ -25,16 +25,11 @@
  */
 
 #include "suricata-common.h"
-#include "stream-tcp.h"
 
-#include "detect.h"
 #include "detect-parse.h"
-#include "detect-engine-prefilter-common.h"
 #include "detect-engine-uint.h"
 
 #include "detect-ttl.h"
-#include "util-debug.h"
-#include "util-byte.h"
 
 /* prototypes */
 static int DetectTtlMatch (DetectEngineThreadCtx *, Packet *,
diff --git a/src/detect-udphdr.c b/src/detect-udphdr.c
index 6c58a8883c59..b384a4044db1 100644
--- a/src/detect-udphdr.c
+++ b/src/detect-udphdr.c
@@ -24,13 +24,8 @@
 
 #include "suricata-common.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-fast-pattern.h"
 #include "detect-udphdr.h"
 
 /* prototypes */
diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c
index 425e22324964..22168eed5dbf 100644
--- a/src/detect-uricontent.c
+++ b/src/detect-uricontent.c
@@ -25,35 +25,13 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
 #include "detect-content.h"
 #include "detect-http-uri.h"
 #include "detect-uricontent.h"
-#include "detect-engine-mpm.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-state.h"
-#include "flow.h"
-#include "detect-flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-#include "threads.h"
-
-#include "stream-tcp.h"
-#include "stream.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-protos.h"
-#include "app-layer-htp.h"
-
-#include "util-mpm.h"
-#include "util-print.h"
-#include "util-debug.h"
+
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-spm.h"
-#include "conf.h"
 
 /* prototypes */
 static int DetectUricontentSetup (DetectEngineCtx *, Signature *, const char *);
@@ -155,7 +133,6 @@ int DetectUricontentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *con
 #ifdef UNITTESTS
 
 #include "detect-isdataat.h"
-#include "stream-tcp-reassemble.h"
 
 /**
  * \test Checks if a uricontent is registered in a Signature
diff --git a/src/detect-urilen.c b/src/detect-urilen.c
index ad4ca72f6bf5..0b76400dc40f 100644
--- a/src/detect-urilen.c
+++ b/src/detect-urilen.c
@@ -24,23 +24,17 @@
  */
 
 #include "suricata-common.h"
-#include "app-layer.h"
-#include "app-layer-protos.h"
 #include "app-layer-htp.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 #include "detect-content.h"
 #include "detect-engine-uint.h"
 
 #include "detect-urilen.h"
-#include "util-debug.h"
-#include "util-byte.h"
 #include "flow-util.h"
 #include "stream-tcp.h"
 
@@ -232,11 +226,7 @@ bool DetectUrilenValidateContent(const Signature *s, int list, const char **sige
 
 #ifdef UNITTESTS
 
-#include "stream.h"
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "app-layer-parser.h"
 
 /** \test   Test the Urilen keyword setup */
diff --git a/src/detect-within.c b/src/detect-within.c
index 5bb89a1b2a1c..8cb181737aaa 100644
--- a/src/detect-within.c
+++ b/src/detect-within.c
@@ -26,20 +26,11 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-parse.h"
 #include "detect-content.h"
-#include "detect-uricontent.h"
 #include "detect-byte.h"
-#include "app-layer.h"
-
-#include "flow-var.h"
 
 #include "util-byte.h"
-#include "util-debug.h"
 #include "detect-pcre.h"
 #include "detect-within.h"
 #include "util-unittest.h"
diff --git a/src/detect-xbits.c b/src/detect-xbits.c
index 6dc3dd425c15..f1c8e4ab175d 100644
--- a/src/detect-xbits.c
+++ b/src/detect-xbits.c
@@ -24,32 +24,18 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "threads.h"
-#include "flow.h"
-#include "flow-util.h"
 #include "detect-xbits.h"
 #include "detect-hostbits.h"
-#include "util-spm.h"
 #include "util-byte.h"
 
-#include "detect-engine-sigorder.h"
-
-#include "app-layer-parser.h"
-
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-build.h"
 
-#include "flow-bit.h"
 #include "host-bit.h"
 #include "ippair-bit.h"
 #include "util-var-name.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 /*
     xbits:set,bitname,track ip_pair,expire 60
diff --git a/src/detect.c b/src/detect.c
index 0a6662859170..92938fcd4d1b 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -24,46 +24,31 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "conf.h"
 
-#include "decode.h"
-#include "flow.h"
 #include "stream-tcp.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "app-layer-frames.h"
 
 #include "detect.h"
 #include "detect-dsize.h"
 #include "detect-engine.h"
 #include "detect-engine-build.h"
 #include "detect-engine-frame.h"
-#include "detect-engine-profile.h"
 
-#include "detect-engine-alert.h"
-#include "detect-engine-siggroup.h"
 #include "detect-engine-address.h"
-#include "detect-engine-proto.h"
 #include "detect-engine-port.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-iponly.h"
-#include "detect-engine-threshold.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-state.h"
-#include "detect-engine-analyzer.h"
-
-#include "detect-engine-payload.h"
-#include "detect-engine-event.h"
 
-#include "detect-filestore.h"
 #include "detect-flowvar.h"
 #include "detect-replace.h"
 
 #include "util-validate.h"
-#include "util-detect.h"
 #include "util-profiling.h"
 
+#ifdef PROFILING
+#include "detect-engine-profile.h"
+#endif
+
 typedef struct DetectRunScratchpad {
     const AppProto alproto;
     const uint8_t flow_flags; /* flow/state flags: STREAM_* */
diff --git a/src/device-storage.c b/src/device-storage.c
index d01ff41f2bff..a34b75208918 100644
--- a/src/device-storage.c
+++ b/src/device-storage.c
@@ -25,7 +25,6 @@
 
 #include "suricata-common.h"
 #include "device-storage.h"
-#include "util-unittest.h"
 
 unsigned int LiveDevStorageSize(void)
 {
diff --git a/src/feature.c b/src/feature.c
index 0cc27861261e..c8ade9987117 100644
--- a/src/feature.c
+++ b/src/feature.c
@@ -27,8 +27,6 @@
 #include "suricata.h"
 #include "feature.h"
 
-#include "util-hash.h"
-
 typedef struct FeatureEntryType {
 	const char *feature;
 } FeatureEntryType;
diff --git a/src/flow-bit.c b/src/flow-bit.c
index 3662611ec8cf..0612ab73642f 100644
--- a/src/flow-bit.c
+++ b/src/flow-bit.c
@@ -32,14 +32,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
 #include "flow-bit.h"
-#include "flow.h"
-#include "flow-util.h"
-#include "flow-private.h"
-#include "detect.h"
-#include "util-var.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 
 /* get the flowbit with idx from the flow */
diff --git a/src/flow-bypass.c b/src/flow-bypass.c
index 98e62f519e25..7b2b5bc4688a 100644
--- a/src/flow-bypass.c
+++ b/src/flow-bypass.c
@@ -23,10 +23,7 @@
 
 #include "suricata-common.h"
 #include "tm-threads.h"
-#include "flow.h"
 #include "flow-bypass.h"
-#include "flow-private.h"
-#include "util-ebpf.h"
 #include "runmodes.h"
 
 #ifdef CAPTURE_OFFLOAD_MANAGER
diff --git a/src/flow-hash.c b/src/flow-hash.c
index f16bac3ef83c..68d82d53dded 100644
--- a/src/flow-hash.c
+++ b/src/flow-hash.c
@@ -25,31 +25,18 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
 
-#include "decode.h"
-#include "detect-engine-state.h"
-
-#include "flow.h"
 #include "flow-hash.h"
 #include "flow-util.h"
 #include "flow-private.h"
 #include "flow-manager.h"
 #include "flow-storage.h"
-#include "flow-timeout.h"
 #include "flow-spare-pool.h"
-#include "app-layer-parser.h"
-
-#include "util-time.h"
-#include "util-debug.h"
 
 #include "util-hash-lookup3.h"
 
-#include "conf.h"
 #include "output.h"
-#include "output-flow.h"
 #include "stream-tcp.h"
-#include "util-exception-policy.h"
 
 extern TcpStreamCnf stream_config;
 
diff --git a/src/flow-manager.c b/src/flow-manager.c
index b68eb22ffc17..26958591c030 100644
--- a/src/flow-manager.c
+++ b/src/flow-manager.c
@@ -23,47 +23,21 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "conf.h"
-#include "threadvars.h"
 #include "tm-threads.h"
-#include "runmodes.h"
 
-#include "util-random.h"
 #include "util-time.h"
 
-#include "flow.h"
-#include "flow-queue.h"
-#include "flow-hash.h"
 #include "flow-util.h"
-#include "flow-var.h"
 #include "flow-private.h"
 #include "flow-timeout.h"
 #include "flow-manager.h"
 #include "flow-storage.h"
 #include "flow-spare-pool.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp.h"
 
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-byte.h"
 #include "util-device.h"
 
-#include "util-debug.h"
-#include "util-privs.h"
-#include "util-signal.h"
-
-#include "threads.h"
-#include "detect.h"
-#include "detect-engine-state.h"
-#include "stream.h"
-
-#include "app-layer-parser.h"
-
 #include "host-timeout.h"
 #include "defrag-timeout.h"
 #include "ippair-timeout.h"
diff --git a/src/flow-queue.c b/src/flow-queue.c
index 530cab3db781..7d5929b121ac 100644
--- a/src/flow-queue.c
+++ b/src/flow-queue.c
@@ -24,14 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "flow-private.h"
 #include "flow-queue.h"
-#include "flow-util.h"
-#include "util-error.h"
-#include "util-debug.h"
-#include "util-print.h"
 
 FlowQueue *FlowQueueNew()
 {
diff --git a/src/flow-spare-pool.c b/src/flow-spare-pool.c
index dc6b8292ec69..ecf0423e227e 100644
--- a/src/flow-spare-pool.c
+++ b/src/flow-spare-pool.c
@@ -24,15 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
 #include "flow-private.h"
-#include "flow-queue.h"
 #include "flow-util.h"
 #include "flow-spare-pool.h"
-#include "util-error.h"
-#include "util-debug.h"
-#include "util-print.h"
 #include "util-validate.h"
 
 typedef struct FlowSparePool {
diff --git a/src/flow-storage.c b/src/flow-storage.c
index d4f89e8a2d84..5c614fce791b 100644
--- a/src/flow-storage.c
+++ b/src/flow-storage.c
@@ -27,7 +27,6 @@
 
 #include "suricata-common.h"
 #include "flow-storage.h"
-#include "flow-hash.h"
 #include "flow-util.h"
 #include "util-unittest.h"
 
diff --git a/src/flow-timeout.c b/src/flow-timeout.c
index 7f12f2e03b31..4b2b62dc9bac 100644
--- a/src/flow-timeout.c
+++ b/src/flow-timeout.c
@@ -22,45 +22,18 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "conf.h"
-#include "threadvars.h"
 #include "tm-threads.h"
-#include "runmodes.h"
 
-#include "util-random.h"
 #include "util-time.h"
 
-#include "flow.h"
-#include "flow-queue.h"
-#include "flow-hash.h"
-#include "flow-util.h"
-#include "flow-var.h"
 #include "flow-private.h"
-#include "flow-manager.h"
 #include "flow-timeout.h"
-#include "pkt-var.h"
-#include "host.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp.h"
 
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-byte.h"
-
-#include "util-debug.h"
-#include "util-privs.h"
 #include "util-datalink.h"
 
-#include "detect.h"
-#include "detect-engine-state.h"
-#include "stream.h"
-
 #include "app-layer-parser.h"
-#include "app-layer.h"
 
 #include "util-profiling.h"
 
diff --git a/src/flow-util.c b/src/flow-util.c
index 91c14eb3ebe6..72ec109b1c22 100644
--- a/src/flow-util.c
+++ b/src/flow-util.c
@@ -24,24 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
 
-#include "flow.h"
 #include "flow-private.h"
 #include "flow-util.h"
-#include "flow-var.h"
-#include "app-layer.h"
 
-#include "util-var.h"
-#include "util-debug.h"
 #include "util-macset.h"
 #include "flow-storage.h"
 
-#include "detect.h"
-#include "detect-engine-state.h"
-
-#include "decode-icmpv4.h"
-
 /** \brief allocate a flow
  *
  *  We check against the memuse counter. If it passes that check we increment
diff --git a/src/flow-var.c b/src/flow-var.c
index a92358f27144..450a112e7c30 100644
--- a/src/flow-var.c
+++ b/src/flow-var.c
@@ -26,11 +26,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
 #include "flow-var.h"
-#include "flow.h"
-#include "detect.h"
-#include "util-debug.h"
 
 /* puts a new value into a flowvar */
 static void FlowVarUpdateStr(FlowVar *fv, uint8_t *value, uint16_t size)
diff --git a/src/flow-worker.c b/src/flow-worker.c
index 66fa73baad39..40f33da9920a 100644
--- a/src/flow-worker.c
+++ b/src/flow-worker.c
@@ -32,10 +32,7 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "decode.h"
-#include "detect.h"
 #include "stream-tcp.h"
 #include "app-layer.h"
 #include "detect-engine.h"
@@ -49,7 +46,6 @@
 #include "tmqh-packetpool.h"
 
 #include "flow-util.h"
-#include "flow-manager.h"
 #include "flow-timeout.h"
 #include "flow-spare-pool.h"
 #include "flow-worker.h"
diff --git a/src/flow.c b/src/flow.c
index 9f4d1450845f..bfca9444e7fb 100644
--- a/src/flow.c
+++ b/src/flow.c
@@ -24,30 +24,17 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "conf.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-#include "runmodes.h"
 
 #include "util-random.h"
 #include "util-time.h"
 
 #include "flow.h"
-#include "flow-queue.h"
-#include "flow-hash.h"
 #include "flow-util.h"
-#include "flow-var.h"
 #include "flow-private.h"
-#include "flow-timeout.h"
 #include "flow-manager.h"
-#include "flow-storage.h"
 #include "flow-bypass.h"
 #include "flow-spare-pool.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp.h"
 
 #include "util-unittest.h"
@@ -56,14 +43,8 @@
 #include "util-misc.h"
 #include "util-macset.h"
 
-#include "util-debug.h"
-#include "util-privs.h"
 #include "util-validate.h"
 
-#include "detect.h"
-#include "detect-engine-state.h"
-#include "stream.h"
-
 #include "app-layer-parser.h"
 #include "app-layer-expectation.h"
 
@@ -1235,7 +1216,6 @@ uint32_t FlowGetFlags(Flow *flow)
 /************************************Unittests*******************************/
 
 #ifdef UNITTESTS
-#include "threads.h"
 
 /**
  *  \test   Test the setting of the per protocol timeouts.
diff --git a/src/host-bit.c b/src/host-bit.c
index 40aae4920eb9..216c101c6a01 100644
--- a/src/host-bit.c
+++ b/src/host-bit.c
@@ -29,12 +29,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
 #include "host-bit.h"
-#include "host.h"
-#include "detect.h"
-#include "util-var.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "host-storage.h"
 
diff --git a/src/host-queue.c b/src/host-queue.c
index 2ef1628d33b6..a58fb4bbc267 100644
--- a/src/host-queue.c
+++ b/src/host-queue.c
@@ -24,12 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
 #include "host-queue.h"
-#include "util-error.h"
-#include "util-debug.h"
-#include "util-print.h"
 
 HostQueue *HostQueueInit (HostQueue *q)
 {
diff --git a/src/host-timeout.c b/src/host-timeout.c
index ccb9214983c7..ced9d6ada1c0 100644
--- a/src/host-timeout.c
+++ b/src/host-timeout.c
@@ -22,7 +22,6 @@
  */
 
 #include "suricata-common.h"
-#include "host.h"
 
 #include "detect-engine-tag.h"
 #include "detect-engine-threshold.h"
@@ -30,8 +29,6 @@
 #include "host-bit.h"
 #include "host-timeout.h"
 
-#include "reputation.h"
-
 uint32_t HostGetSpareCount(void)
 {
     return HostSpareQueueGetSize();
diff --git a/src/host.c b/src/host.c
index 015a0889e02f..ed1d21a0648b 100644
--- a/src/host.c
+++ b/src/host.c
@@ -24,12 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 
-#include "util-debug.h"
 #include "host.h"
-#include "host-storage.h"
-#include "host-bit.h"
 
 #include "util-random.h"
 #include "util-misc.h"
@@ -38,8 +34,6 @@
 
 #include "host-queue.h"
 
-#include "detect-tag.h"
-#include "detect-engine-tag.h"
 #include "detect-engine-threshold.h"
 
 #include "util-hash-lookup3.h"
diff --git a/src/ippair-bit.c b/src/ippair-bit.c
index 501d750fd21c..c23673ba6016 100644
--- a/src/ippair-bit.c
+++ b/src/ippair-bit.c
@@ -29,12 +29,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
 #include "ippair-bit.h"
-#include "ippair.h"
-#include "detect.h"
-#include "util-var.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "ippair-storage.h"
 
diff --git a/src/ippair-queue.c b/src/ippair-queue.c
index 0f68200dd947..1879de2d482b 100644
--- a/src/ippair-queue.c
+++ b/src/ippair-queue.c
@@ -24,12 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
 #include "ippair-queue.h"
-#include "util-error.h"
-#include "util-debug.h"
-#include "util-print.h"
 
 IPPairQueue *IPPairQueueInit (IPPairQueue *q)
 {
diff --git a/src/ippair-timeout.c b/src/ippair-timeout.c
index 47f420b17c56..57c454a4fdc7 100644
--- a/src/ippair-timeout.c
+++ b/src/ippair-timeout.c
@@ -22,7 +22,6 @@
  */
 
 #include "suricata-common.h"
-#include "ippair.h"
 #include "ippair-bit.h"
 #include "ippair-timeout.h"
 #include "detect-engine-threshold.h"
diff --git a/src/ippair.c b/src/ippair.c
index 00c2b80eb39f..1df6a8166bed 100644
--- a/src/ippair.c
+++ b/src/ippair.c
@@ -24,9 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 
-#include "util-debug.h"
 #include "ippair.h"
 #include "ippair-storage.h"
 
@@ -37,10 +35,6 @@
 
 #include "ippair-queue.h"
 
-#include "detect-tag.h"
-#include "detect-engine-tag.h"
-#include "detect-engine-threshold.h"
-
 #include "util-hash-lookup3.h"
 
 static IPPair *IPPairGetUsedIPPair(void);
diff --git a/src/log-httplog.c b/src/log-httplog.c
index 63e54ccd14a9..956c6df59b43 100644
--- a/src/log-httplog.c
+++ b/src/log-httplog.c
@@ -25,27 +25,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
 #include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 
 #include "output.h"
 #include "log-httplog.h"
 #include "app-layer-htp.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
 
 #include "util-logopenfile.h"
 #include "util-time.h"
diff --git a/src/log-pcap.c b/src/log-pcap.c
index 61b2ba2779d6..6dba67424da8 100644
--- a/src/log-pcap.c
+++ b/src/log-pcap.c
@@ -41,33 +41,15 @@
 #include <fnmatch.h>
 #endif
 
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
 #include "log-pcap.h"
-#include "decode-ipv4.h"
 
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-time.h"
 #include "util-byte.h"
 #include "util-misc.h"
 #include "util-cpu.h"
-#include "util-atomic.h"
-
-#include "source-pcap.h"
 
 #include "output.h"
 
-#include "queue.h"
-
 #define DEFAULT_LOG_FILENAME            "pcaplog"
 #define MODULE_NAME                     "PcapLog"
 #define MIN_LIMIT                       4 * 1024 * 1024
diff --git a/src/log-stats.c b/src/log-stats.c
index ac8ea13a5aa5..044ea570923a 100644
--- a/src/log-stats.c
+++ b/src/log-stats.c
@@ -23,24 +23,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 
 #include "output.h"
 #include "log-stats.h"
-#include "util-privs.h"
-#include "util-buffer.h"
 
 #include "util-logopenfile.h"
 #include "util-time.h"
diff --git a/src/log-tcp-data.c b/src/log-tcp-data.c
index f9e5a5d4261e..1190e5956765 100644
--- a/src/log-tcp-data.c
+++ b/src/log-tcp-data.c
@@ -22,30 +22,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
 #include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 
 #include "output.h"
 #include "log-tcp-data.h"
-#include "app-layer-htp.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
 
 #include "util-logopenfile.h"
-#include "util-time.h"
 
 #define DEFAULT_LOG_FILENAME "tcp-data.log"
 
diff --git a/src/log-tlslog.c b/src/log-tlslog.c
index 4b41ffbeea68..0c4626705a1c 100644
--- a/src/log-tlslog.c
+++ b/src/log-tlslog.c
@@ -27,27 +27,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
 #include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 
 #include "output.h"
 #include "log-tlslog.h"
 #include "app-layer-ssl.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
 
 #include "util-logopenfile.h"
 #include "util-time.h"
diff --git a/src/log-tlsstore.c b/src/log-tlsstore.c
index 481c7dd7de78..890eb3dbcf65 100644
--- a/src/log-tlsstore.c
+++ b/src/log-tlsstore.c
@@ -27,30 +27,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 
 #include "output.h"
 #include "log-tlslog.h"
 #include "log-tlsstore.h"
 #include "app-layer-ssl.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
 
-#include "util-logopenfile.h"
 #include "util-time.h"
 
 #define MODULE_NAME "LogTlsStoreLog"
diff --git a/src/output-eve-syslog.c b/src/output-eve-syslog.c
index 7dc0ca908518..0d31ad2f93d7 100644
--- a/src/output-eve-syslog.c
+++ b/src/output-eve-syslog.c
@@ -26,7 +26,6 @@
  */
 
 #include "suricata-common.h" /* errno.h, string.h, etc. */
-#include "output.h"          /* DEFAULT_LOG_* */
 #include "output-eve-syslog.h"
 #include "util-syslog.h"
 
diff --git a/src/output-file.c b/src/output-file.c
index f62e846b3747..fec63491c001 100644
--- a/src/output-file.c
+++ b/src/output-file.c
@@ -24,7 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "tm-modules.h"
 #include "output.h"
 #include "output-file.h"
 #include "app-layer.h"
diff --git a/src/output-filedata.c b/src/output-filedata.c
index dd943d2f809c..c6ed8c22f226 100644
--- a/src/output-filedata.c
+++ b/src/output-filedata.c
@@ -24,13 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "tm-modules.h"
 #include "output.h"
 #include "output-filedata.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
 #include "detect-filemagic.h"
-#include "conf.h"
 #include "util-profiling.h"
 #include "util-validate.h"
 #include "util-magic.h"
diff --git a/src/output-filestore.c b/src/output-filestore.c
index e45142d8c093..cf3b0cd5e05e 100644
--- a/src/output-filestore.c
+++ b/src/output-filestore.c
@@ -18,9 +18,6 @@
 #include "suricata-common.h"
 
 #include "stream-tcp.h"
-#include "app-layer-parser.h"
-#include "app-layer-htp.h"
-#include "app-layer-htp-xff.h"
 #include "app-layer-smtp.h"
 
 #include "feature.h"
diff --git a/src/output-flow.c b/src/output-flow.c
index ebef951ad5bd..07cca8d66763 100644
--- a/src/output-flow.c
+++ b/src/output-flow.c
@@ -24,10 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "tm-modules.h"
 #include "output.h"
 #include "output-flow.h"
-#include "util-profiling.h"
 #include "util-validate.h"
 
 /** per thread data for this module, contains a list of per thread
diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index 69d6f7c30f36..8f16acef7b73 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -25,48 +25,23 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
 
 #include "stream.h"
-#include "threads.h"
-#include "tm-threads.h"
-#include "threadvars.h"
-#include "util-debug.h"
 
-#include "util-logopenfile.h"
 #include "util-misc.h"
 #include "util-time.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
 
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-reference.h"
-#include "detect-metadata.h"
 #include "app-layer-parser.h"
-#include "app-layer-dnp3.h"
-#include "app-layer-htp.h"
-#include "app-layer-htp-xff.h"
 #include "app-layer-ftp.h"
-#include "app-layer-frames.h"
-#include "util-classification-config.h"
-#include "util-syslog.h"
-#include "util-logopenfile.h"
 #include "log-pcap.h"
 
-#include "output.h"
 #include "output-json.h"
 #include "output-json-alert.h"
 #include "output-json-dnp3.h"
 #include "output-json-dns.h"
 #include "output-json-http.h"
 #include "output-json-tls.h"
-#include "output-json-ssh.h"
-#include "rust.h"
 #include "output-json-smtp.h"
 #include "output-json-email-common.h"
 #include "output-json-nfs.h"
@@ -80,12 +55,7 @@
 #include "output-json-frame.h"
 #include "output-json-quic.h"
 
-#include "util-byte.h"
-#include "util-privs.h"
 #include "util-print.h"
-#include "util-proto-name.h"
-#include "util-optimize.h"
-#include "util-buffer.h"
 #include "util-validate.h"
 
 #define MODULE_NAME "JsonAlertLog"
diff --git a/src/output-json-anomaly.c b/src/output-json-anomaly.c
index c2f9f9709e3e..9c668cbefeef 100644
--- a/src/output-json-anomaly.c
+++ b/src/output-json-anomaly.c
@@ -25,36 +25,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
 #include "app-layer.h"
-#include "app-layer-events.h"
 #include "app-layer-parser.h"
 
-#include "threads.h"
-#include "tm-threads.h"
-#include "threadvars.h"
-#include "util-debug.h"
-
-#include "util-misc.h"
-
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "util-logopenfile.h"
-
-#include "output.h"
 #include "output-json.h"
 #include "output-json-anomaly.h"
 
-#include "util-byte.h"
-#include "util-enum.h"
-#include "util-privs.h"
-#include "util-print.h"
-#include "util-proto-name.h"
-#include "util-optimize.h"
-#include "util-buffer.h"
 #include "util-validate.h"
 
 #define MODULE_NAME "JsonAnomalyLog"
diff --git a/src/output-json-common.c b/src/output-json-common.c
index c97d8b1089e6..e92f44903e1a 100644
--- a/src/output-json-common.c
+++ b/src/output-json-common.c
@@ -22,25 +22,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
-#include "app-layer-parser.h"
-
 OutputJsonThreadCtx *CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
 {
     OutputJsonThreadCtx *thread = SCCalloc(1, sizeof(*thread));
diff --git a/src/output-json-dcerpc.c b/src/output-json-dcerpc.c
index f3f28859f328..245240cec920 100644
--- a/src/output-json-dcerpc.c
+++ b/src/output-json-dcerpc.c
@@ -16,30 +16,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "app-layer-dcerpc-common.h"
 #include "output-json-dcerpc.h"
 
-#include "rust.h"
-
-
 static int JsonDCERPCLogger(ThreadVars *tv, void *thread_data,
     const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
 {
diff --git a/src/output-json-dhcp.c b/src/output-json-dhcp.c
index 35846f4e3e7b..e23b895c56c8 100644
--- a/src/output-json-dhcp.c
+++ b/src/output-json-dhcp.c
@@ -22,29 +22,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "output-json-dhcp.h"
-#include "rust.h"
-
 
 typedef struct LogDHCPFileCtx_ {
     void       *rs_logger;
diff --git a/src/output-json-dnp3-objects.c b/src/output-json-dnp3-objects.c
index ce499213cbd2..b474abec4e61 100644
--- a/src/output-json-dnp3-objects.c
+++ b/src/output-json-dnp3-objects.c
@@ -27,7 +27,6 @@
 #include "app-layer-dnp3.h"
 #include "app-layer-dnp3-objects.h"
 #include "output-json-dnp3-objects.h"
-#include "output-json.h"
 
 // clang-format off
 void OutputJsonDNP3SetItem(JsonBuilder *js, DNP3Object *object,
diff --git a/src/output-json-dnp3.c b/src/output-json-dnp3.c
index ddddec6723fb..33794f584e2d 100644
--- a/src/output-json-dnp3.c
+++ b/src/output-json-dnp3.c
@@ -16,28 +16,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer-dnp3.h"
-#include "app-layer-dnp3-objects.h"
 
 #include "detect-dnp3.h"
 
-#include "output.h"
 #include "output-json.h"
 #include "output-json-dnp3.h"
 #include "output-json-dnp3-objects.h"
diff --git a/src/output-json-dns.c b/src/output-json-dns.c
index 2dfd69ebb839..07247b52e009 100644
--- a/src/output-json-dns.c
+++ b/src/output-json-dns.c
@@ -24,32 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-#include "util-mem.h"
 #include "app-layer-parser.h"
-#include "output.h"
-#include "app-layer.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #include "output-json.h"
 #include "output-json-dns.h"
-#include "rust.h"
 
 /* we can do query logging as well, but it's disabled for now as the
  * TX id handling doesn't expect it */
diff --git a/src/output-json-drop.c b/src/output-json-drop.c
index 0746e2600aaf..b96e7f3adff2 100644
--- a/src/output-json-drop.c
+++ b/src/output-json-drop.c
@@ -25,37 +25,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "tm-threads.h"
-#include "threadvars.h"
-#include "util-debug.h"
-
-#include "decode-ipv4.h"
-#include "detect-parse.h"
+
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-reference.h"
 
-#include "output.h"
 #include "output-json.h"
 #include "output-json-alert.h"
 #include "output-json-drop.h"
 
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-#include "util-classification-config.h"
-#include "util-privs.h"
-#include "util-print.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
-#include "util-buffer.h"
-
 #define MODULE_NAME "JsonDropLog"
 
 #define LOG_DROP_ALERTS 1
diff --git a/src/output-json-email-common.c b/src/output-json-email-common.c
index cadad2c1c2d5..1ffe6270ca3e 100644
--- a/src/output-json-email-common.c
+++ b/src/output-json-email-common.c
@@ -25,31 +25,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 #include "suricata.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-#include "tm-threads-common.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 #include "app-layer-parser.h"
-#include "output.h"
 #include "app-layer-smtp.h"
 #include "app-layer.h"
-#include "util-privs.h"
-#include "util-buffer.h"
 #include "util-byte.h"
 
-#include "util-logopenfile.h"
-
 #include "output-json.h"
 #include "output-json-email-common.h"
 
diff --git a/src/output-json-file.c b/src/output-json-file.c
index cc6146813de6..9fd78e54cce5 100644
--- a/src/output-json-file.c
+++ b/src/output-json-file.c
@@ -25,36 +25,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threadvars.h"
-#include "tm-modules.h"
-
-#include "threads.h"
-
-#include "app-layer-parser.h"
-
-#include "detect-filemagic.h"
-
-#include "stream.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-#include "util-privs.h"
-#include "util-debug.h"
-#include "util-atomic.h"
-#include "util-file.h"
-#include "util-time.h"
-#include "util-buffer.h"
-#include "util-byte.h"
 #include "util-validate.h"
 
-#include "util-logopenfile.h"
-
-#include "output.h"
 #include "output-json.h"
 #include "output-json-file.h"
 #include "output-json-http.h"
@@ -64,11 +37,6 @@
 #include "output-json-smb.h"
 #include "output-json-http2.h"
 
-#include "app-layer-htp.h"
-#include "app-layer-htp-xff.h"
-#include "util-memcmp.h"
-#include "stream-tcp-reassemble.h"
-
 typedef struct OutputFileCtx_ {
     uint32_t file_cnt;
     HttpXFFCfg *xff_cfg;
diff --git a/src/output-json-flow.c b/src/output-json-flow.c
index 17b4c0f33a65..2e5856c7f93b 100644
--- a/src/output-json-flow.c
+++ b/src/output-json-flow.c
@@ -24,32 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
 #include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 
-#include "output.h"
-#include "util-privs.h"
-#include "util-buffer.h"
 #include "util-device.h"
 #include "util-proto-name.h"
-#include "util-logopenfile.h"
 #include "util-time.h"
 #include "output-json.h"
 #include "output-json-flow.h"
 
 #include "stream-tcp.h"
-#include "stream-tcp-private.h"
 #include "flow-storage.h"
 
 static JsonBuilder *CreateEveHeaderFromFlow(const Flow *f)
diff --git a/src/output-json-frame.c b/src/output-json-frame.c
index 76e0475446b8..b426c12432a1 100644
--- a/src/output-json-frame.c
+++ b/src/output-json-frame.c
@@ -25,45 +25,14 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "tm-threads.h"
-#include "threadvars.h"
-#include "util-debug.h"
-
-#include "util-logopenfile.h"
-#include "util-misc.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-reference.h"
-#include "detect-metadata.h"
+
 #include "app-layer-parser.h"
-#include "app-layer-frames.h"
-#include "app-layer-dnp3.h"
-#include "app-layer-htp.h"
-#include "app-layer-htp-xff.h"
-#include "app-layer-ftp.h"
-#include "util-classification-config.h"
 #include "stream-tcp.h"
 
-#include "output.h"
 #include "output-json.h"
 #include "output-json-frame.h"
 
-#include "util-byte.h"
-#include "util-privs.h"
 #include "util-print.h"
-#include "util-proto-name.h"
-#include "util-optimize.h"
-#include "util-buffer.h"
 #include "util-validate.h"
 
 #define MODULE_NAME "JsonFrameLog"
diff --git a/src/output-json-ftp.c b/src/output-json-ftp.c
index f4fd6fd4f727..52130c5d16a9 100644
--- a/src/output-json-ftp.c
+++ b/src/output-json-ftp.c
@@ -23,26 +23,10 @@
  * Implement JSON/eve logging app-layer FTP.
  */
 
-
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-mem.h"
 
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-ftp.h"
diff --git a/src/output-json-http.c b/src/output-json-http.c
index bb6bc0643408..bf68830aee12 100644
--- a/src/output-json-http.c
+++ b/src/output-json-http.c
@@ -24,33 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
 #include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 
-#include "output.h"
-#include "app-layer-htp.h"
 #include "app-layer-htp-file.h"
-#include "app-layer-htp-xff.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 #include "output-json.h"
-#include "output-json-alert.h"
 #include "output-json-http.h"
 #include "util-byte.h"
 
diff --git a/src/output-json-http2.c b/src/output-json-http2.c
index 609ac87879a5..cde69e9efd68 100644
--- a/src/output-json-http2.c
+++ b/src/output-json-http2.c
@@ -24,31 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 #include "app-layer-parser.h"
-#include "output.h"
-#include "app-layer-http2.h"
-#include "app-layer.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-
-#include "util-logopenfile.h"
 
 #include "output-json.h"
 #include "output-json-http2.h"
-#include "rust.h"
 
 #define MODULE_NAME "LogHttp2Log"
 
diff --git a/src/output-json-ike.c b/src/output-json-ike.c
index 5093e55db31c..755829445d9e 100644
--- a/src/output-json-ike.c
+++ b/src/output-json-ike.c
@@ -25,31 +25,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-ike.h"
 #include "output-json-ike.h"
 
-#include "rust.h"
-
 #define LOG_IKE_DEFAULT  0
 #define LOG_IKE_EXTENDED (1 << 0)
 
diff --git a/src/output-json-krb5.c b/src/output-json-krb5.c
index f3200cbe44c9..3f27d2714cc8 100644
--- a/src/output-json-krb5.c
+++ b/src/output-json-krb5.c
@@ -24,31 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-krb5.h"
 #include "output-json-krb5.h"
 
-#include "rust.h"
-
 static int JsonKRB5Logger(ThreadVars *tv, void *thread_data,
     const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
 {
diff --git a/src/output-json-metadata.c b/src/output-json-metadata.c
index 6ec943ddd5b6..d28de750ab3b 100644
--- a/src/output-json-metadata.c
+++ b/src/output-json-metadata.c
@@ -25,43 +25,10 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "tm-threads.h"
-#include "threadvars.h"
-#include "util-debug.h"
-
-#include "util-misc.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-reference.h"
-#include "app-layer-parser.h"
-#include "app-layer-dnp3.h"
-#include "app-layer-htp.h"
-#include "app-layer-htp-xff.h"
-#include "util-classification-config.h"
-#include "util-syslog.h"
-#include "util-logopenfile.h"
-
-#include "output.h"
 #include "output-json.h"
 #include "output-json-metadata.h"
 
-#include "util-byte.h"
-#include "util-privs.h"
-#include "util-print.h"
-#include "util-proto-name.h"
-#include "util-optimize.h"
-#include "util-buffer.h"
-
 #define MODULE_NAME "JsonMetadataLog"
 
 static int MetadataJson(ThreadVars *tv, OutputJsonThreadCtx *aft, const Packet *p)
diff --git a/src/output-json-modbus.c b/src/output-json-modbus.c
index a952e99aa531..74489e4e3040 100644
--- a/src/output-json-modbus.c
+++ b/src/output-json-modbus.c
@@ -16,23 +16,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-#include "output.h"
 #include "output-json.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "output-json-modbus.h"
-#include "rust.h"
 
 typedef struct LogModbusFileCtx_ {
     LogFileCtx *file_ctx;
diff --git a/src/output-json-mqtt.c b/src/output-json-mqtt.c
index 76f4e9f47b71..bc47daa96ac1 100644
--- a/src/output-json-mqtt.c
+++ b/src/output-json-mqtt.c
@@ -22,29 +22,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-mqtt.h"
 #include "output-json-mqtt.h"
-#include "rust.h"
 
 #define MQTT_LOG_PASSWORDS BIT_U32(0)
 #define MQTT_DEFAULTS (MQTT_LOG_PASSWORDS)
diff --git a/src/output-json-netflow.c b/src/output-json-netflow.c
index 0aa90a49bbbe..e8c6419e437c 100644
--- a/src/output-json-netflow.c
+++ b/src/output-json-netflow.c
@@ -24,26 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
 #include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 
-#include "output.h"
-#include "util-privs.h"
-#include "util-buffer.h"
 #include "util-device.h"
 #include "util-proto-name.h"
-#include "util-logopenfile.h"
 #include "util-time.h"
 #include "output-json.h"
 #include "output-json-netflow.h"
diff --git a/src/output-json-nfs.c b/src/output-json-nfs.c
index 088c99b6f863..2fc233213a93 100644
--- a/src/output-json-nfs.c
+++ b/src/output-json-nfs.c
@@ -24,30 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "output-json-nfs.h"
 
-#include "rust.h"
-
 bool EveNFSAddMetadataRPC(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
 {
     NFSState *state = FlowGetAppState(f);
diff --git a/src/output-json-pgsql.c b/src/output-json-pgsql.c
index 515a25a98f03..b1019111c62c 100644
--- a/src/output-json-pgsql.c
+++ b/src/output-json-pgsql.c
@@ -24,28 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "output-json-pgsql.h"
-#include "rust.h"
 
 #define PGSQL_LOG_PASSWORDS BIT_U32(0)
 
diff --git a/src/output-json-quic.c b/src/output-json-quic.c
index 8f249ff9bb15..13d1ba13f116 100644
--- a/src/output-json-quic.c
+++ b/src/output-json-quic.c
@@ -22,23 +22,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-#include "output.h"
 #include "output-json.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "output-json-quic.h"
-#include "rust.h"
 
 typedef struct LogQuicFileCtx_ {
     LogFileCtx *file_ctx;
diff --git a/src/output-json-rdp.c b/src/output-json-rdp.c
index 69c0b460f5ab..dd5387b01c27 100644
--- a/src/output-json-rdp.c
+++ b/src/output-json-rdp.c
@@ -24,24 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-#include "output.h"
 #include "output-json.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "app-layer-rdp.h"
 #include "output-json-rdp.h"
-#include "rust.h"
 
 static int JsonRdpLogger(ThreadVars *tv, void *thread_data,
     const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
diff --git a/src/output-json-rfb.c b/src/output-json-rfb.c
index e3d87841e814..050c6c421bfc 100644
--- a/src/output-json-rfb.c
+++ b/src/output-json-rfb.c
@@ -24,28 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-rfb.h"
 #include "output-json-rfb.h"
 
-#include "rust-bindings.h"
-
 bool JsonRFBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
 {
     RFBState *state = FlowGetAppState(f);
diff --git a/src/output-json-sip.c b/src/output-json-sip.c
index fa0f0a12ee05..8336ab4b0c7b 100644
--- a/src/output-json-sip.c
+++ b/src/output-json-sip.c
@@ -24,31 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-sip.h"
 #include "output-json-sip.h"
 
-#include "rust.h"
-
 void JsonSIPAddMetadata(JsonBuilder *js, const Flow *f, uint64_t tx_id)
 {
     SIPState *state = FlowGetAppState(f);
diff --git a/src/output-json-smb.c b/src/output-json-smb.c
index 780f903cc487..116aad306082 100644
--- a/src/output-json-smb.c
+++ b/src/output-json-smb.c
@@ -24,29 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "output-json-smb.h"
 
-#include "rust.h"
-
 bool EveSMBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
 {
     SMBState *state = FlowGetAppState(f);
diff --git a/src/output-json-smtp.c b/src/output-json-smtp.c
index 5fe126f4184c..9c96b2bb27d6 100644
--- a/src/output-json-smtp.c
+++ b/src/output-json-smtp.c
@@ -24,29 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
 #include "app-layer-smtp.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #include "output-json.h"
 #include "output-json-smtp.h"
diff --git a/src/output-json-snmp.c b/src/output-json-snmp.c
index 6c86fcbe074b..87fc8c1b7a3e 100644
--- a/src/output-json-snmp.c
+++ b/src/output-json-snmp.c
@@ -24,31 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-snmp.h"
 #include "output-json-snmp.h"
 
-#include "rust.h"
-
 static int JsonSNMPLogger(ThreadVars *tv, void *thread_data,
     const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
 {
diff --git a/src/output-json-ssh.c b/src/output-json-ssh.c
index e82e4994e4db..71e01324392f 100644
--- a/src/output-json-ssh.c
+++ b/src/output-json-ssh.c
@@ -24,31 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
 #include "app-layer-parser.h"
-#include "output.h"
 #include "app-layer-ssh.h"
-#include "app-layer.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-
-#include "util-logopenfile.h"
 
 #include "output-json.h"
 #include "output-json-ssh.h"
-#include "rust.h"
 
 #define MODULE_NAME "LogSshLog"
 
diff --git a/src/output-json-stats.c b/src/output-json-stats.c
index 9b9c22151b8c..7b93bc82397f 100644
--- a/src/output-json-stats.c
+++ b/src/output-json-stats.c
@@ -24,26 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 #include "detect-engine.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
 #include "util-time.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-#include "output.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-
-#include "util-logopenfile.h"
 
 #include "output-json.h"
 #include "output-json-stats.h"
diff --git a/src/output-json-template-rust.c b/src/output-json-template-rust.c
index 33280f740ce2..18985d108238 100644
--- a/src/output-json-template-rust.c
+++ b/src/output-json-template-rust.c
@@ -30,29 +30,12 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-template-rust.h"
 #include "output-json-template-rust.h"
-#include "rust.h"
 
 typedef struct LogTemplateFileCtx_ {
     uint32_t    flags;
diff --git a/src/output-json-template.c b/src/output-json-template.c
index 2e9907808cb2..89087e535dd7 100644
--- a/src/output-json-template.c
+++ b/src/output-json-template.c
@@ -30,24 +30,9 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
 #include "app-layer-template.h"
diff --git a/src/output-json-tftp.c b/src/output-json-tftp.c
index ceaebde95881..8f607e866d1a 100644
--- a/src/output-json-tftp.c
+++ b/src/output-json-tftp.c
@@ -23,33 +23,14 @@
  * Implement JSON/eve logging app-layer TFTP.
  */
 
-
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 
-#include "util-unittest.h"
-#include "util-buffer.h"
-#include "util-debug.h"
-#include "util-byte.h"
-
-#include "output.h"
 #include "output-json.h"
 
-#include "app-layer.h"
 #include "app-layer-parser.h"
 
-#include "app-layer-tftp.h"
 #include "output-json-tftp.h"
 
-#include "rust.h"
-
 static int JsonTFTPLogger(ThreadVars *tv, void *thread_data,
     const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
 {
diff --git a/src/output-json-tls.c b/src/output-json-tls.c
index fce953ae38bf..07f06904a5a9 100644
--- a/src/output-json-tls.c
+++ b/src/output-json-tls.c
@@ -24,29 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
 #include "util-time.h"
-#include "util-unittest.h"
 
-#include "util-debug.h"
 #include "app-layer-parser.h"
-#include "output.h"
-#include "app-layer-ssl.h"
 #include "app-layer.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-
-#include "util-logopenfile.h"
-#include "util-ja3.h"
 
 #include "output-json.h"
 #include "output-json-tls.h"
diff --git a/src/output-json.c b/src/output-json.c
index 4590fe244d83..7f1384fe04d9 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -25,42 +25,19 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "tm-threads.h"
-#include "threadvars.h"
-#include "util-debug.h"
+
 #include "util-time.h"
 #include "util-var-name.h"
 #include "util-macset.h"
 
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
-
-#include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-reference.h"
-#include "app-layer-parser.h"
-#include "util-classification-config.h"
-#include "util-syslog.h"
 #include "output-eve-syslog.h"
 
-#include "output.h"
 #include "output-json.h"
 
 #include "util-byte.h"
-#include "util-privs.h"
 #include "util-print.h"
 #include "util-proto-name.h"
-#include "util-optimize.h"
-#include "util-buffer.h"
-#include "util-logopenfile.h"
-#include "util-log-redis.h"
 #include "util-device.h"
 #include "util-validate.h"
 #include "util-plugin.h"
@@ -71,8 +48,6 @@
 
 #include "source-pcap-file.h"
 
-#include "suricata-plugin.h"
-
 #define DEFAULT_LOG_FILENAME "eve.json"
 #define MODULE_NAME "OutputJSON"
 
diff --git a/src/output-lua.c b/src/output-lua.c
index 8e1ae3c7e05f..59856cf31a7e 100644
--- a/src/output-lua.c
+++ b/src/output-lua.c
@@ -23,30 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer-htp.h"
-#include "app-layer.h"
-#include "app-layer-ssl.h"
-#include "app-layer-ssh.h"
-#include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #include "output-lua.h"
 
@@ -56,6 +32,13 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "output.h"
+#include "app-layer-parser.h"
+#include "util-time.h"
+#include "app-layer-htp.h"
+#include "app-layer-ssl.h"
+#include "app-layer-ssh.h"
+
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-http.h"
diff --git a/src/output-packet.c b/src/output-packet.c
index c7b509520d15..232be2697e5a 100644
--- a/src/output-packet.c
+++ b/src/output-packet.c
@@ -24,7 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "tm-modules.h"
 #include "output.h"
 #include "output-packet.h"
 #include "util-profiling.h"
diff --git a/src/output-streaming.c b/src/output-streaming.c
index 60efef57910b..cdc73c770f81 100644
--- a/src/output-streaming.c
+++ b/src/output-streaming.c
@@ -24,18 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "tm-modules.h"
 #include "output.h"
 #include "output-streaming.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "app-layer-htp.h"
-#include "util-print.h"
-#include "conf.h"
 #include "util-profiling.h"
 #include "stream-tcp.h"
-#include "stream-tcp-inline.h"
-#include "stream-tcp-reassemble.h"
 #include "util-validate.h"
 
 /** per thread data for this module, contains a list of per thread
diff --git a/src/output-tx.c b/src/output-tx.c
index 635b18506fec..8fa24c3bb612 100644
--- a/src/output-tx.c
+++ b/src/output-tx.c
@@ -24,10 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "tm-modules.h"
 #include "output.h"
 #include "output-tx.h"
-#include "app-layer.h"
 #include "app-layer-parser.h"
 #include "util-profiling.h"
 #include "util-validate.h"
diff --git a/src/output.c b/src/output.c
index 74f6308a01dc..58b9164dfa5e 100644
--- a/src/output.c
+++ b/src/output.c
@@ -33,11 +33,6 @@
  */
 
 #include "suricata-common.h"
-#include "flow.h"
-#include "conf.h"
-#include "tm-threads.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "output.h"
 
 #include "alert-fastlog.h"
diff --git a/src/packet-queue.c b/src/packet-queue.c
index e9617007c192..820785c96084 100644
--- a/src/packet-queue.c
+++ b/src/packet-queue.c
@@ -24,12 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "packet-queue.h"
-#include "threads.h"
-#include "suricata.h"
-#include "util-var.h"
-#include "pkt-var.h"
 
 #ifdef DEBUG
 void PacketQueueValidateDebug(PacketQueue *q);
diff --git a/src/pkt-var.c b/src/pkt-var.c
index a81af35e1af2..2912e2f0998d 100644
--- a/src/pkt-var.c
+++ b/src/pkt-var.c
@@ -30,9 +30,7 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "pkt-var.h"
-#include "util-debug.h"
 
 /* get the pktvar with name 'name' from the pkt
  *
diff --git a/src/reputation.c b/src/reputation.c
index 101f580ae760..0e6eb52c6cf1 100644
--- a/src/reputation.c
+++ b/src/reputation.c
@@ -26,17 +26,9 @@
  */
 
 #include "suricata-common.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-byte.h"
-#include "util-ip.h"
-#include "util-radix-tree.h"
 #include "util-unittest.h"
-#include "threads.h"
 #include "util-print.h"
-#include "host.h"
-#include "conf.h"
-#include "detect.h"
 #include "reputation.h"
 #include "util-validate.h"
 
diff --git a/src/respond-reject-libnet11.c b/src/respond-reject-libnet11.c
index 9a646bc013fd..1b54e0173032 100644
--- a/src/respond-reject-libnet11.c
+++ b/src/respond-reject-libnet11.c
@@ -35,17 +35,6 @@
 #include "suricata-common.h"
 #include "suricata.h"
 
-#include "decode.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
-#include "decode-sctp.h"
-#include "decode-udp.h"
-#include "packet-queue.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-queuehandlers.h"
-#include "tm-threads.h"
-#include "action-globals.h"
 #include "respond-reject.h"
 #include "respond-reject-libnet11.h"
 #include "util-device.h"
diff --git a/src/respond-reject.c b/src/respond-reject.c
index 8b19e277db9e..2ef04858ea51 100644
--- a/src/respond-reject.c
+++ b/src/respond-reject.c
@@ -25,20 +25,11 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "packet-queue.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-queuehandlers.h"
 #include "tm-threads.h"
-#include "action-globals.h"
 
 #include "respond-reject.h"
 #include "respond-reject-libnet11.h"
 
-#include "util-debug.h"
-#include "util-privs.h"
-
 int RejectSendIPv4TCP(ThreadVars *, Packet *, void *);
 int RejectSendIPv4ICMP(ThreadVars *, Packet *, void *);
 int RejectSendIPv6TCP(ThreadVars *, Packet *, void *);
diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index ac0b570a9b6b..8e956aaf9e5d 100644
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -31,30 +31,9 @@
  */
 
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
 #include "runmodes.h"
 #include "runmode-af-packet.h"
 #include "output.h"
-#include "log-httplog.h"
-#include "detect-engine-mpm.h"
-
-#include "alert-fastlog.h"
-#include "alert-debuglog.h"
-
-#include "flow-bypass.h"
-
-#include "util-debug.h"
-#include "util-time.h"
-#include "util-cpu.h"
-#include "util-affinity.h"
-#include "util-device.h"
-#include "util-runmodes.h"
-#include "util-ioctl.h"
-#include "util-ebpf.h"
-#include "util-byte.h"
-
-#include "source-af-packet.h"
 
 extern int max_pending_packets;
 
@@ -83,6 +62,17 @@ void RunModeIdsAFPRegister(void)
 
 #ifdef HAVE_AF_PACKET
 
+#include "util-byte.h"
+#include "util-cpu.h"
+#include "util-ioctl.h"
+#include "util-device.h"
+#include "util-time.h"
+#include "util-runmodes.h"
+
+#ifdef HAVE_PACKET_EBPF
+#include "util-ebpf.h"
+#endif
+
 static void AFPDerefConfig(void *conf)
 {
     AFPIfaceConfig *pfp = (AFPIfaceConfig *)conf;
diff --git a/src/runmode-dpdk.c b/src/runmode-dpdk.c
index 170679ae3229..8d546eedef3f 100644
--- a/src/runmode-dpdk.c
+++ b/src/runmode-dpdk.c
@@ -33,6 +33,8 @@
 #include "suricata-common.h"
 #include "runmodes.h"
 #include "runmode-dpdk.h"
+
+#ifdef HAVE_DPDK
 #include "source-dpdk.h"
 #include "util-runmodes.h"
 #include "util-byte.h"
@@ -43,8 +45,6 @@
 #include "util-dpdk-ixgbe.h"
 #include "util-time.h"
 
-#ifdef HAVE_DPDK
-
 #define RSS_HKEY_LEN 40
 // General purpose RSS key for symmetric bidirectional flow distribution
 uint8_t rss_hkey[] = { 0x6D, 0x5A, 0x6D, 0x5A, 0x6D, 0x5A, 0x6D, 0x5A, 0x6D, 0x5A, 0x6D, 0x5A, 0x6D,
diff --git a/src/runmode-erf-dag.c b/src/runmode-erf-dag.c
index 3019f6caf917..0062871be012 100644
--- a/src/runmode-erf-dag.c
+++ b/src/runmode-erf-dag.c
@@ -16,18 +16,11 @@
  */
 
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
-#include "runmodes.h"
 #include "runmode-erf-dag.h"
-#include "output.h"
 
 #include "detect-engine.h"
 
-#include "util-debug.h"
 #include "util-time.h"
-#include "util-cpu.h"
-#include "util-affinity.h"
 #include "util-runmodes.h"
 
 static int DagConfigGetThreadCount(void *conf)
diff --git a/src/runmode-erf-file.c b/src/runmode-erf-file.c
index 31e8d2639110..65f470192c12 100644
--- a/src/runmode-erf-file.c
+++ b/src/runmode-erf-file.c
@@ -17,14 +17,10 @@
 
 #include "suricata-common.h"
 #include "tm-threads.h"
-#include "conf.h"
-#include "runmodes.h"
 #include "runmode-erf-file.h"
-#include "output.h"
 
 #include "detect-engine.h"
 
-#include "util-debug.h"
 #include "util-time.h"
 #include "util-cpu.h"
 #include "util-affinity.h"
diff --git a/src/runmode-ipfw.c b/src/runmode-ipfw.c
index 88a9187c11f2..f5179840b20d 100644
--- a/src/runmode-ipfw.c
+++ b/src/runmode-ipfw.c
@@ -24,22 +24,9 @@
  * Handling of ipfw runmodes.
  */
 
-
-
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
 #include "runmodes.h"
 #include "runmode-ipfw.h"
-#include "output.h"
-
-#include "util-debug.h"
-#include "util-time.h"
-#include "util-cpu.h"
-#include "util-affinity.h"
-#include "util-runmodes.h"
-#include "source-ipfw.h"
-#include "util-device.h"
 
 const char *RunModeIpsIPFWGetDefaultMode(void)
 {
diff --git a/src/runmode-napatech.c b/src/runmode-napatech.c
index 584e2d8e468b..f707a539e82c 100644
--- a/src/runmode-napatech.c
+++ b/src/runmode-napatech.c
@@ -23,20 +23,7 @@
  */
 
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
-#include "runmodes.h"
-#include "output.h"
-#include "util-debug.h"
-#include "util-time.h"
-#include "util-cpu.h"
-#include "util-byte.h"
-#include "util-affinity.h"
-#include "util-runmodes.h"
-#include "util-device.h"
-#include "util-napatech.h"
 #include "runmode-napatech.h"
-#include "source-napatech.h" // need NapatechStreamDevConf structure
 
 #define NT_RUNMODE_AUTOFP  1
 #define NT_RUNMODE_WORKERS 2
diff --git a/src/runmode-netmap.c b/src/runmode-netmap.c
index 699f4fbb10c0..d0cbe44d65bb 100644
--- a/src/runmode-netmap.c
+++ b/src/runmode-netmap.c
@@ -34,17 +34,12 @@
 #include "suricata-common.h"
 #include "runmodes.h"
 #include "runmode-netmap.h"
-#include "util-runmodes.h"
-#include "util-ioctl.h"
-#include "util-byte.h"
 
 #ifdef HAVE_NETMAP
 #define NETMAP_WITH_LIBS
 #include <net/netmap_user.h>
 #endif /* HAVE_NETMAP */
 
-#include "source-netmap.h"
-
 extern int max_pending_packets;
 
 const char *RunModeNetmapGetDefaultMode(void)
diff --git a/src/runmode-nflog.c b/src/runmode-nflog.c
index fe795764c069..fcf8f86fe213 100644
--- a/src/runmode-nflog.c
+++ b/src/runmode-nflog.c
@@ -21,18 +21,9 @@
  * \author Giuseppe Longo <giuseppelng@gmail.com>
  */
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
 #include "runmodes.h"
 #include "runmode-nflog.h"
 
-#include "util-debug.h"
-#include "util-device.h"
-#include "util-runmodes.h"
-#include "util-misc.h"
-
-#include "source-nflog.h"
-
 #ifdef HAVE_NFLOG
 #include "util-time.h"
 
diff --git a/src/runmode-nfq.c b/src/runmode-nfq.c
index f1c6b19410c9..28cb98f765a4 100644
--- a/src/runmode-nfq.c
+++ b/src/runmode-nfq.c
@@ -24,20 +24,9 @@
  * Handling of NFQ runmodes.
  */
 
-
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
 #include "runmodes.h"
 #include "runmode-nfq.h"
-#include "output.h"
-
-#include "util-debug.h"
-#include "util-time.h"
-#include "util-cpu.h"
-#include "util-affinity.h"
-#include "util-runmodes.h"
-#include "util-device.h"
 
 const char *RunModeIpsNFQGetDefaultMode(void)
 {
diff --git a/src/runmode-pcap-file.c b/src/runmode-pcap-file.c
index 1961b1d80910..8d0ca04177a9 100644
--- a/src/runmode-pcap-file.c
+++ b/src/runmode-pcap-file.c
@@ -17,15 +17,11 @@
 
 #include "suricata-common.h"
 #include "tm-threads.h"
-#include "conf.h"
-#include "runmodes.h"
 #include "runmode-pcap-file.h"
-#include "output.h"
 
 #include "detect-engine.h"
 #include "source-pcap-file.h"
 
-#include "util-debug.h"
 #include "util-time.h"
 #include "util-cpu.h"
 #include "util-affinity.h"
diff --git a/src/runmode-pcap.c b/src/runmode-pcap.c
index de451a78fa74..b01164584b44 100644
--- a/src/runmode-pcap.c
+++ b/src/runmode-pcap.c
@@ -16,20 +16,12 @@
  */
 
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
 #include "runmodes.h"
 #include "runmode-pcap.h"
 #include "output.h"
-#include "log-httplog.h"
 
-#include "util-debug.h"
 #include "util-time.h"
-#include "util-cpu.h"
-#include "util-affinity.h"
-#include "util-device.h"
 #include "util-runmodes.h"
-#include "util-atomic.h"
 #include "util-misc.h"
 #include "util-byte.h"
 
diff --git a/src/runmode-pfring.c b/src/runmode-pfring.c
index 528d850760f0..991d7e7f4da8 100644
--- a/src/runmode-pfring.c
+++ b/src/runmode-pfring.c
@@ -16,21 +16,8 @@
  */
 
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
 #include "runmodes.h"
 #include "runmode-pfring.h"
-#include "source-pfring.h"
-#include "output.h"
-
-#include "util-debug.h"
-#include "util-time.h"
-#include "util-cpu.h"
-#include "util-affinity.h"
-#include "util-runmodes.h"
-#include "util-device.h"
-#include "util-ioctl.h"
-#include "util-byte.h"
 
 #ifdef HAVE_PFRING
 #include <pfring.h>
diff --git a/src/runmode-unittests.c b/src/runmode-unittests.c
index 851de186e90e..9c015d2a399c 100644
--- a/src/runmode-unittests.c
+++ b/src/runmode-unittests.c
@@ -26,31 +26,17 @@
 
 #ifdef UNITTESTS
 
-#include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-address.h"
-#include "detect-engine-proto.h"
 #include "detect-engine-port.h"
-#include "detect-engine-mpm.h"
 #include "detect-engine-sigorder.h"
 #include "detect-engine-payload.h"
 #include "detect-engine-dcepayload.h"
-#include "detect-engine-state.h"
 #include "detect-engine-tag.h"
-#include "detect-engine-enip.h"
-#include "detect-fast-pattern.h"
-#include "flow.h"
-#include "flow-timeout.h"
-#include "flow-manager.h"
-#include "flow-var.h"
 #include "flow-bit.h"
-#include "pkt-var.h"
 
-#include "host.h"
 #include "host-bit.h"
-#include "ippair.h"
 #include "ippair-bit.h"
-#include "unix-manager.h"
 
 #include "stream-tcp.h"
 
@@ -58,51 +44,32 @@
 #include "app-layer-parser.h"
 #include "app-layer.h"
 #include "app-layer-htp.h"
-#include "app-layer-ftp.h"
-#include "app-layer-ssl.h"
-#include "app-layer-ssh.h"
 #include "app-layer-smtp.h"
 
 #include "util-action.h"
-#include "util-radix-tree.h"
 #include "util-host-os-info.h"
 #include "util-cidr.h"
 #include "util-unittest-helper.h"
-#include "util-time.h"
 #include "util-rule-vars.h"
 #include "util-classification-config.h"
 #include "util-threshold-config.h"
 #include "util-reference-config.h"
-#include "util-profiling.h"
 #include "util-magic.h"
 #include "util-memcmp.h"
 #include "util-misc.h"
-#include "util-signal.h"
 
-#include "reputation.h"
-#include "util-atomic.h"
-#include "util-spm.h"
-#include "util-hash.h"
-#include "util-hashlist.h"
 #include "util-bloomfilter.h"
 #include "util-bloomfilter-counting.h"
-#include "util-pool.h"
 #include "util-byte.h"
 #include "util-proto-name.h"
 #include "util-macset.h"
 #include "util-memrchr.h"
 
-#include "util-mpm-ac.h"
-#include "util-mpm-hs.h"
-
-#include "conf.h"
 #include "conf-yaml-loader.h"
 #include "tmqh-flow.h"
 #include "defrag.h"
 #include "detect-engine-siggroup.h"
 
-#include "util-streaming-buffer.h"
-#include "util-lua.h"
 #include "tm-modules.h"
 #include "tmqh-packetpool.h"
 #include "decode-chdlc.h"
@@ -120,9 +87,21 @@
 #include "source-windivert.h"
 #endif
 
+#ifdef PROFILING
+#include "util-profiling.h"
+#endif
+
+#ifdef HAVE_LUAJIT
+#include "util-luajit.h"
+#endif
+
+#ifdef BUILD_HYPERSCAN
+#include "util-mpm-hs.h"
+#endif
+
 #endif /* UNITTESTS */
 
-void TmqhSetup (void);
+void TmqhSetup(void);
 
 #ifdef UNITTESTS
 static void RegisterUnittests(void)
diff --git a/src/runmode-unix-socket.c b/src/runmode-unix-socket.c
index 24ac172179fe..d904ced5bad6 100644
--- a/src/runmode-unix-socket.c
+++ b/src/runmode-unix-socket.c
@@ -16,37 +16,22 @@
  */
 
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
-#include "runmodes.h"
-#include "runmode-pcap-file.h"
-#include "output.h"
 #include "output-json.h"
 
-#include "util-debug.h"
 #include "util-time.h"
-#include "util-cpu.h"
-#include "util-affinity.h"
 #include "util-var-name.h"
 #include "unix-manager.h"
 
 #include "detect-engine.h"
 
-#include "flow-manager.h"
-#include "flow-timeout.h"
 #include "stream-tcp.h"
-#include "stream-tcp-reassemble.h"
 #include "source-pcap-file-directory-helper.h"
-#include "host.h"
-#include "defrag.h"
 #include "defrag-hash.h"
 #include "ippair.h"
-#include "app-layer.h"
 #include "app-layer-htp-mem.h"
 #include "host-bit.h"
 
 #include "util-misc.h"
-#include "util-profiling.h"
 
 #include "conf-yaml-loader.h"
 
diff --git a/src/runmode-windivert.c b/src/runmode-windivert.c
index 6b96da0c11ca..b7cb1f9a5cca 100644
--- a/src/runmode-windivert.c
+++ b/src/runmode-windivert.c
@@ -24,18 +24,8 @@
  */
 
 #include "suricata-common.h"
-#include "tm-threads.h"
-#include "conf.h"
 #include "runmodes.h"
 #include "runmode-windivert.h"
-#include "output.h"
-
-#include "util-affinity.h"
-#include "util-cpu.h"
-#include "util-debug.h"
-#include "util-device.h"
-#include "util-runmodes.h"
-#include "util-time.h"
 
 const char *RunModeIpsWinDivertGetDefaultMode(void)
 {
diff --git a/src/runmodes.c b/src/runmodes.c
index 8f729a46a913..c6d6e9721b51 100644
--- a/src/runmodes.c
+++ b/src/runmodes.c
@@ -23,18 +23,9 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 #include "app-layer-parser.h"
-#include "tm-threads.h"
-#include "util-debug.h"
-#include "util-time.h"
-#include "util-cpu.h"
-#include "util-byte.h"
 #include "util-affinity.h"
-#include "conf.h"
-#include "queue.h"
 #include "runmodes.h"
 #include "runmode-af-packet.h"
 #include "runmode-dpdk.h"
@@ -56,19 +47,9 @@
 
 #include "output.h"
 
-#include "alert-fastlog.h"
-#include "alert-debuglog.h"
-
-#include "log-httplog.h"
-
-#include "source-pfring.h"
-
 #include "tmqh-flow.h"
 #include "flow-manager.h"
 #include "flow-bypass.h"
-#include "counters.h"
-
-#include "suricata-plugin.h"
 
 int debuglog_enabled = 0;
 int threading_set_cpu_affinity = FALSE;
diff --git a/src/source-af-packet.c b/src/source-af-packet.c
index dfa9f8e5422f..dd4f64c0a788 100644
--- a/src/source-af-packet.c
+++ b/src/source-af-packet.c
@@ -34,33 +34,18 @@
 #define SC_PCAP_DONT_INCLUDE_PCAP_H 1
 #include "suricata-common.h"
 #include "suricata.h"
-#include "decode.h"
-#include "packet-queue.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-queuehandlers.h"
-#include "tm-modules.h"
 #include "tm-threads.h"
-#include "tm-threads-common.h"
-#include "conf.h"
-#include "util-cpu.h"
-#include "util-datalink.h"
-#include "util-debug.h"
+#include "source-af-packet.h"
+
+#ifdef HAVE_AF_PACKET
+
 #include "util-device.h"
-#include "util-ebpf.h"
-#include "util-error.h"
 #include "util-privs.h"
-#include "util-optimize.h"
-#include "util-checksum.h"
 #include "util-ioctl.h"
-#include "util-host-info.h"
-#include "tmqh-packetpool.h"
-#include "source-af-packet.h"
-#include "runmodes.h"
-#include "flow-storage.h"
 #include "util-validate.h"
-
-#ifdef HAVE_AF_PACKET
+#include "util-checksum.h"
+#include "util-datalink.h"
+#include "util-host-info.h"
 
 #if HAVE_SYS_IOCTL_H
 #include <sys/ioctl.h>
@@ -74,6 +59,8 @@
 #include "util-ebpf.h"
 #include <bpf/libbpf.h>
 #include <bpf/bpf.h>
+#include "flow-storage.h"
+#include "util-cpu.h"
 #endif
 
 struct bpf_program {
@@ -81,6 +68,8 @@ struct bpf_program {
     struct bpf_insn *bf_insns;
 };
 
+#include "util-bpf.h"
+
 #ifdef HAVE_PCAP_H
 #include <pcap.h>
 #endif
@@ -89,8 +78,6 @@ struct bpf_program {
 #include <pcap/pcap.h>
 #endif
 
-#include "util-bpf.h"
-
 #if HAVE_LINUX_IF_ETHER_H
 #include <linux/if_ether.h>
 #endif
diff --git a/src/source-dpdk.c b/src/source-dpdk.c
index c22c68b3fc60..b0e78d536638 100644
--- a/src/source-dpdk.c
+++ b/src/source-dpdk.c
@@ -31,14 +31,8 @@
  */
 
 #include "suricata-common.h"
-#include "runmodes.h"
 #include "source-dpdk.h"
-#include "suricata.h"
-#include "threads.h"
-#include "threadvars.h"
 #include "tm-threads.h"
-#include "tmqh-packetpool.h"
-#include "util-privs.h"
 
 #ifndef HAVE_DPDK
 
@@ -83,6 +77,12 @@ TmEcode NoDPDKSupportExit(ThreadVars *tv, const void *initdata, void **data)
 
 #else /* We have DPDK support */
 
+#include "runmodes.h"
+#include "suricata.h"
+#include "threads.h"
+#include "threadvars.h"
+#include "tmqh-packetpool.h"
+#include "util-privs.h"
 #include "util-dpdk.h"
 #include "util-dpdk-i40e.h"
 #include <numa.h>
diff --git a/src/source-erf-dag.c b/src/source-erf-dag.c
index d0925cc7a2e8..2195b3756362 100644
--- a/src/source-erf-dag.c
+++ b/src/source-erf-dag.c
@@ -27,13 +27,9 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 #include "tm-threads.h"
 
 #include "util-privs.h"
-#include "util-datalink.h"
-#include "util-device.h"
-#include "tmqh-packetpool.h"
 #include "source-erf-dag.h"
 
 #ifndef HAVE_DAG
diff --git a/src/source-ipfw.c b/src/source-ipfw.c
index 4e768d3cccaa..b4fe66f8e46b 100644
--- a/src/source-ipfw.c
+++ b/src/source-ipfw.c
@@ -25,21 +25,8 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "packet-queue.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-queuehandlers.h"
 #include "tm-threads.h"
 #include "source-ipfw.h"
-#include "util-debug.h"
-#include "conf.h"
-#include "util-byte.h"
-#include "util-privs.h"
-#include "util-datalink.h"
-#include "util-device.h"
-#include "runmodes.h"
 
 #define IPFW_ACCEPT 0
 #define IPFW_DROP 1
diff --git a/src/source-napatech.c b/src/source-napatech.c
index 39863aa25129..ec72902b34c3 100644
--- a/src/source-napatech.c
+++ b/src/source-napatech.c
@@ -26,16 +26,8 @@
  *
  */
 #include "suricata-common.h"
-#include "suricata.h"
-#include "threadvars.h"
-#include "util-datalink.h"
-#include "util-optimize.h"
-#include "tm-queuehandlers.h"
-#include "tm-threads.h"
 #include "tm-modules.h"
 #include "util-privs.h"
-#include "tmqh-packetpool.h"
-#include "util-napatech.h"
 #include "source-napatech.h"
 
 #ifndef HAVE_NAPATECH
diff --git a/src/source-netmap.c b/src/source-netmap.c
index 2cfea7aee614..b37c4eff0995 100644
--- a/src/source-netmap.c
+++ b/src/source-netmap.c
@@ -34,13 +34,8 @@
  *
  */
 
-#include "suricata.h"
 #include "suricata-common.h"
 #include "tm-threads.h"
-#include "util-bpf.h"
-#include "util-privs.h"
-#include "util-validate.h"
-#include "util-datalink.h"
 
 #include "source-netmap.h"
 
@@ -56,8 +51,6 @@
 
 #endif /* HAVE_NETMAP */
 
-#include "util-ioctl.h"
-
 #ifndef HAVE_NETMAP
 
 /**
diff --git a/src/source-nflog.c b/src/source-nflog.c
index 2d83bc432b5a..6be684f422ef 100644
--- a/src/source-nflog.c
+++ b/src/source-nflog.c
@@ -23,21 +23,8 @@
  *  Netfilter's netfilter_log support
  */
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "packet-queue.h"
 
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 #include "tm-modules.h"
-#include "tm-queuehandlers.h"
-#include "tmqh-packetpool.h"
-
-#include "runmodes.h"
-#include "util-error.h"
-#include "util-device.h"
-#include "util-datalink.h"
 
 #ifndef HAVE_NFLOG
 /** Handle the case where no NFLOG support is compiled in.
diff --git a/src/source-nfq.c b/src/source-nfq.c
index a3d02fa3f3d0..91df512d6ef7 100644
--- a/src/source-nfq.c
+++ b/src/source-nfq.c
@@ -26,31 +26,12 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "decode.h"
-#include "packet-queue.h"
 
-#include "threads.h"
-#include "threadvars.h"
 #include "tm-threads.h"
-#include "tm-queuehandlers.h"
-#include "tmqh-packetpool.h"
 
-#include "conf.h"
-#include "conf-yaml-loader.h"
-#include "source-nfq-prototypes.h"
-#include "action-globals.h"
-
-#include "util-datalink.h"
-#include "util-debug.h"
-#include "util-error.h"
-#include "util-byte.h"
-#include "util-cpu.h"
 #include "util-privs.h"
-#include "util-device.h"
-
-#include "runmodes.h"
 
+#include "source-nfq-prototypes.h"
 #include "source-nfq.h"
 
 /* Handle the case where no NFQ support is compiled in. */
diff --git a/src/source-pcap-file-directory-helper.c b/src/source-pcap-file-directory-helper.c
index 43ccadf69772..01b90b8ff8d6 100644
--- a/src/source-pcap-file-directory-helper.c
+++ b/src/source-pcap-file-directory-helper.c
@@ -26,9 +26,7 @@
 #include "source-pcap-file-directory-helper.h"
 #include "suricata.h"
 #include "runmode-unix-socket.h"
-#include "util-mem.h"
 #include "util-time.h"
-#include "source-pcap-file.h"
 
 static void GetTime(struct timespec *tm);
 static void CopyTime(struct timespec *from, struct timespec *to);
diff --git a/src/source-pcap-file-helper.c b/src/source-pcap-file-helper.c
index 91341facfb2a..aeea1a5bfd0c 100644
--- a/src/source-pcap-file-helper.c
+++ b/src/source-pcap-file-helper.c
@@ -29,7 +29,6 @@
 #include "util-checksum.h"
 #include "util-profiling.h"
 #include "source-pcap-file.h"
-#include "util-exception-policy.h"
 
 extern int max_pending_packets;
 extern PcapFileGlobalVars pcap_g;
diff --git a/src/source-pcap-file.c b/src/source-pcap-file.c
index eb2683378951..a207cb99c732 100644
--- a/src/source-pcap-file.c
+++ b/src/source-pcap-file.c
@@ -25,9 +25,7 @@
 
 #include "suricata-common.h"
 #include "source-pcap-file.h"
-#include "source-pcap-file-helper.h"
 #include "source-pcap-file-directory-helper.h"
-#include "flow-manager.h"
 #include "util-checksum.h"
 #include "runmode-unix-socket.h"
 #include "suricata.h"
diff --git a/src/source-pcap.c b/src/source-pcap.c
index 5e7ebc5f8874..3022a4cab4e6 100644
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -25,24 +25,13 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "decode.h"
-#include "packet-queue.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-queuehandlers.h"
 #include "tm-threads.h"
 #include "source-pcap.h"
-#include "conf.h"
-#include "util-debug.h"
-#include "util-error.h"
 #include "util-privs.h"
 #include "util-datalink.h"
-#include "util-device.h"
-#include "util-optimize.h"
 #include "util-checksum.h"
 #include "util-ioctl.h"
 #include "util-time.h"
-#include "tmqh-packetpool.h"
 
 #define PCAP_STATE_DOWN 0
 #define PCAP_STATE_UP 1
diff --git a/src/source-pfring.c b/src/source-pfring.c
index c75b275c9e79..f52dc57eb8d5 100644
--- a/src/source-pfring.c
+++ b/src/source-pfring.c
@@ -29,23 +29,9 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "conf.h"
-#include "decode.h"
-#include "packet-queue.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-queuehandlers.h"
 #include "tm-threads.h"
 #include "source-pfring.h"
-#include "util-debug.h"
-#include "util-checksum.h"
 #include "util-privs.h"
-#include "util-datalink.h"
-#include "util-device.h"
-#include "util-host-info.h"
-#include "runmodes.h"
-#include "util-profiling.h"
 
 TmEcode ReceivePfringLoop(ThreadVars *tv, void *data, void *slot);
 TmEcode PfringBreakLoop(ThreadVars *tv, void *data);
diff --git a/src/source-windivert.c b/src/source-windivert.c
index edd0d7753b12..b96429aef613 100644
--- a/src/source-windivert.c
+++ b/src/source-windivert.c
@@ -26,21 +26,8 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 #include "tm-threads.h"
 
-#include "util-byte.h"
-#include "util-debug.h"
-#include "util-device.h"
-#include "util-error.h"
-#include "util-ioctl.h"
-#include "util-privs.h"
-#include "util-unittest.h"
-
-#include "runmodes.h"
-
-#include "queue.h"
-
 #include "source-windivert-prototypes.h"
 #include "source-windivert.h"
 
diff --git a/src/stream-tcp-inline.c b/src/stream-tcp-inline.c
index 36374c5566a6..50de79dfced0 100644
--- a/src/stream-tcp-inline.c
+++ b/src/stream-tcp-inline.c
@@ -24,13 +24,10 @@
  */
 
 #include "suricata-common.h"
-#include "stream-tcp-private.h"
 #include "stream-tcp-inline.h"
 
 #include "util-memcmp.h"
-#include "util-print.h"
 
-#include "util-unittest.h"
 #include "util-unittest-helper.h"
 
 /**
diff --git a/src/stream-tcp-list.c b/src/stream-tcp-list.c
index 7dde2b0ea934..6d5559710bb7 100644
--- a/src/stream-tcp-list.c
+++ b/src/stream-tcp-list.c
@@ -22,14 +22,9 @@
  */
 
 #include "suricata-common.h"
-#include "rust.h"
-#include "stream-tcp-private.h"
 #include "stream-tcp.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp-inline.h"
 #include "stream-tcp-list.h"
-#include "util-streaming-buffer.h"
-#include "util-print.h"
 #include "util-validate.h"
 #include "app-layer-frames.h"
 
diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c
index bb793cf8e830..e7381b68050d 100644
--- a/src/stream-tcp-reassemble.c
+++ b/src/stream-tcp-reassemble.c
@@ -28,46 +28,23 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "debug.h"
-#include "detect.h"
-#include "flow.h"
-#include "threads.h"
-#include "conf.h"
 
 #include "flow-util.h"
 
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-pool.h"
 #include "util-unittest.h"
 #include "util-print.h"
-#include "util-host-os-info.h"
 #include "util-unittest-helper.h"
 #include "util-byte.h"
-#include "util-device.h"
 
 #include "stream-tcp.h"
-#include "stream-tcp-private.h"
 #include "stream-tcp-reassemble.h"
-#include "stream-tcp-inline.h"
-#include "stream-tcp-list.h"
 #include "stream-tcp-util.h"
 
-#include "stream.h"
-
-#include "util-debug.h"
-#include "app-layer-protos.h"
 #include "app-layer.h"
-#include "app-layer-events.h"
 #include "app-layer-parser.h"
 #include "app-layer-frames.h"
 
-#include "detect-engine-state.h"
-
-#include "util-profiling.h"
 #include "util-validate.h"
-#include "util-exception-policy.h"
 
 #ifdef DEBUG
 static SCMutex segment_pool_memuse_mutex;
diff --git a/src/stream-tcp-sack.c b/src/stream-tcp-sack.c
index 9a36a94958be..b9a6edae7582 100644
--- a/src/stream-tcp-sack.c
+++ b/src/stream-tcp-sack.c
@@ -25,7 +25,6 @@
 
 #include "suricata-common.h"
 #include "stream-tcp.h"
-#include "stream-tcp-private.h"
 #include "stream-tcp-sack.h"
 #include "util-unittest.h"
 
diff --git a/src/stream-tcp-util.c b/src/stream-tcp-util.c
index 6565e295a072..581c193c09e8 100644
--- a/src/stream-tcp-util.c
+++ b/src/stream-tcp-util.c
@@ -25,14 +25,9 @@
 
 #include "suricata-common.h"
 
-#include "stream-tcp-reassemble.h"
-#include "stream-tcp-inline.h"
 #include "stream-tcp.h"
 #include "stream-tcp-util.h"
 
-#include "util-memcmp.h"
-#include "util-print.h"
-
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "ippair.h"
diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 1d354b0011d3..5e1897d6f43c 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -29,52 +29,24 @@
 #include "suricata-common.h"
 #include "suricata.h"
 
-#include "decode.h"
-#include "debug.h"
-#include "detect.h"
-
-#include "flow.h"
 #include "flow-util.h"
 
-#include "conf.h"
 #include "conf-yaml-loader.h"
 
-#include "threads.h"
-#include "threadvars.h"
 #include "tm-threads.h"
 
-#include "util-pool.h"
-#include "util-pool-thread.h"
 #include "util-checksum.h"
-#include "util-unittest.h"
-#include "util-print.h"
-#include "util-debug.h"
 #include "util-device.h"
 
-#include "stream-tcp-private.h"
-#include "stream-tcp-reassemble.h"
 #include "stream-tcp.h"
-#include "stream-tcp-inline.h"
 #include "stream-tcp-sack.h"
-#include "stream-tcp-util.h"
-#include "stream.h"
-
-#include "pkt-var.h"
-#include "host.h"
 
 #include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-protos.h"
-#include "app-layer-htp-mem.h"
 
 #include "util-host-os-info.h"
-#include "util-privs.h"
-#include "util-profiling.h"
 #include "util-misc.h"
 #include "util-validate.h"
-#include "util-runmodes.h"
 #include "util-random.h"
-#include "util-exception-policy.h"
 #include "util-time.h"
 
 #include "source-pcap-file.h"
diff --git a/src/stream.c b/src/stream.c
index 59cc251f111a..e15a730f0790 100644
--- a/src/stream.c
+++ b/src/stream.c
@@ -22,13 +22,8 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "threads.h"
 #include "stream.h"
-#include "util-pool.h"
-#include "util-debug.h"
 #include "stream-tcp.h"
-#include "flow-util.h"
 
 /** \brief Run callback for all segments in a single direction.
  *
diff --git a/src/suricata.c b/src/suricata.c
index 094b2c885acb..434008d0da4a 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -32,21 +32,12 @@
 #endif
 
 #include "suricata.h"
-#include "decode.h"
 #include "feature.h"
-#include "detect.h"
-#include "packet-queue.h"
-#include "threads.h"
-#include "threadvars.h"
 #include "flow-worker.h"
 
-#include "util-atomic.h"
-#include "util-spm.h"
 #include "util-cpu.h"
-#include "util-action.h"
 #include "util-pidfile.h"
 #include "util-ioctl.h"
-#include "util-device.h"
 #include "util-misc.h"
 #include "util-macset.h"
 #include "util-running-modes.h"
@@ -58,15 +49,9 @@
 #include "detect-engine-threshold.h"
 #include "detect-engine-address.h"
 #include "detect-engine-port.h"
-#include "detect-engine-mpm.h"
 
 #include "tm-queuehandlers.h"
-#include "tm-queues.h"
-#include "tm-threads.h"
 
-#include "tmqh-flow.h"
-
-#include "conf.h"
 #include "conf-yaml-loader.h"
 
 #include "app-layer-htp-range.h"
@@ -74,14 +59,8 @@
 
 #include "stream-tcp.h"
 
-#include "source-nfq.h"
 #include "source-nfq-prototypes.h"
 
-#include "source-nflog.h"
-
-#include "source-ipfw.h"
-
-#include "source-pcap.h"
 #include "source-pcap-file.h"
 #include "source-pcap-file-helper.h"
 
@@ -91,97 +70,69 @@
 #include "source-erf-dag.h"
 #include "source-napatech.h"
 
-#include "source-af-packet.h"
-#include "source-netmap.h"
-
 #include "source-dpdk.h"
 
-#include "source-windivert.h"
 #include "source-windivert-prototypes.h"
 
 #include "respond-reject.h"
 
-#include "flow.h"
 #include "flow-timeout.h"
 #include "flow-manager.h"
-#include "flow-bypass.h"
-#include "flow-var.h"
-#include "flow-bit.h"
-#include "pkt-var.h"
 #include "host-bit.h"
 
-#include "ippair.h"
 #include "ippair-bit.h"
 
-#include "host.h"
 #include "unix-manager.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
-#include "app-layer-register.h"
-#include "app-layer-htp.h"
-#include "app-layer-ssl.h"
-#include "app-layer-ssh.h"
-#include "app-layer-ftp.h"
-#include "app-layer-smtp.h"
-#include "app-layer-enip.h"
-#include "app-layer-dnp3.h"
-#include "app-layer-smb.h"
 #include "app-layer-htp-file.h"
 
 #include "output-filestore.h"
 
 #include "util-ebpf.h"
-#include "util-radix-tree.h"
 #include "util-host-os-info.h"
-#include "util-cidr.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 #include "util-time.h"
-#include "util-rule-vars.h"
 #include "util-classification-config.h"
 #include "util-threshold-config.h"
 #include "util-reference-config.h"
-#include "util-profiling.h"
-#include "util-magic.h"
 #include "util-signal.h"
 
 #include "util-coredump-config.h"
 
-#include "util-decode-mime.h"
-
 #include "defrag.h"
 
-#include "runmodes.h"
 #include "runmode-unittests.h"
-#include "runmode-af-packet.h"
 
-#include "util-debug.h"
-#include "util-error.h"
 #include "util-daemon.h"
 #include "util-byte.h"
-#include "util-luajit.h"
-#include "reputation.h"
 
 #include "output.h"
 
 #include "util-privs.h"
 
-#include "tmqh-packetpool.h"
-
 #include "util-proto-name.h"
-#include "util-mpm-hs.h"
-#include "util-storage.h"
-#include "host-storage.h"
-
-#include "util-lua.h"
 
 #include "util-plugin.h"
 
-#include "util-dpdk.h"
-#include "util-exception-policy.h"
+#include "runmode-af-packet.h"
+
+#ifdef PROFILING
+#include "util-profiling.h"
+#endif
+
+#ifdef BUILD_HYPERSCAN
+#include "util-mpm-hs.h"
+#endif
 
-#include "rust.h"
+#ifdef HAVE_LUAJIT
+#include "util-luajit.h"
+#endif
+
+#ifdef HAVE_DPDK
+#include "util-dpdk.h"
+#endif
 
 /*
  * we put this here, because we only use it here in main.
@@ -893,7 +844,6 @@ static void PrintBuildInfo(void)
     printf("compiled with %s, linked against %s\n",
            HTP_VERSION_STRING_FULL, htp_get_version());
     printf("\n");
-#include "build-info.h"
 }
 
 int coverage_unittests;
diff --git a/src/threads.c b/src/threads.c
index 8d671d382885..13060ecda2ae 100644
--- a/src/threads.c
+++ b/src/threads.c
@@ -26,8 +26,6 @@
 
 #include "suricata-common.h"
 #include "util-unittest.h"
-#include "debug.h"
-#include "util-debug.h"
 #include "threads.h"
 
 thread_local char t_thread_name[THREAD_NAME_LEN + 1];
diff --git a/src/tm-modules.c b/src/tm-modules.c
index bbf11b3156d2..b0d75531bfcf 100644
--- a/src/tm-modules.c
+++ b/src/tm-modules.c
@@ -24,11 +24,7 @@
  */
 
 #include "suricata-common.h"
-#include "packet-queue.h"
 #include "tm-threads.h"
-#include "util-debug.h"
-#include "threads.h"
-#include "util-logopenfile.h"
 
 TmModule tmm_modules[TMM_SIZE];
 
diff --git a/src/tm-queuehandlers.c b/src/tm-queuehandlers.c
index 4850679ceb05..236d4bca3414 100644
--- a/src/tm-queuehandlers.c
+++ b/src/tm-queuehandlers.c
@@ -24,10 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "packet-queue.h"
-#include "decode.h"
-#include "threads.h"
-#include "threadvars.h"
 
 #include "tm-queuehandlers.h"
 #include "tmqh-simple.h"
diff --git a/src/tm-queues.c b/src/tm-queues.c
index 6c745bc275b9..5b1f5c269eee 100644
--- a/src/tm-queues.c
+++ b/src/tm-queues.c
@@ -24,9 +24,7 @@
  */
 
 #include "suricata.h"
-#include "threads.h"
 #include "tm-queues.h"
-#include "util-debug.h"
 
 static TAILQ_HEAD(TmqList_, Tmq_) tmq_list = TAILQ_HEAD_INITIALIZER(tmq_list);
 
diff --git a/src/tm-threads.c b/src/tm-threads.c
index 7bd6cfa8bcb5..5cdc24be7b78 100644
--- a/src/tm-threads.c
+++ b/src/tm-threads.c
@@ -27,22 +27,12 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "stream.h"
-#include "runmodes.h"
-#include "threadvars.h"
-#include "tm-queues.h"
 #include "tm-queuehandlers.h"
 #include "tm-threads.h"
-#include "tmqh-packetpool.h"
-#include "threads.h"
 #include "util-affinity.h"
-#include "util-debug.h"
 #include "util-privs.h"
 #include "util-cpu.h"
-#include "util-optimize.h"
 #include "util-profiling.h"
-#include "util-signal.h"
-#include "queue.h"
 
 #ifdef PROFILE_LOCKING
 thread_local uint64_t mutex_lock_contention;
diff --git a/src/tmqh-flow.c b/src/tmqh-flow.c
index a02c930f101f..6f8cba8192ed 100644
--- a/src/tmqh-flow.c
+++ b/src/tmqh-flow.c
@@ -28,15 +28,10 @@
  */
 
 #include "suricata.h"
-#include "packet-queue.h"
-#include "decode.h"
-#include "threads.h"
-#include "threadvars.h"
 #include "tmqh-flow.h"
 
 #include "tm-queuehandlers.h"
 
-#include "conf.h"
 #include "util-unittest.h"
 
 Packet *TmqhInputFlow(ThreadVars *t);
diff --git a/src/tmqh-packetpool.c b/src/tmqh-packetpool.c
index 92b017a038b4..da1950825ed4 100644
--- a/src/tmqh-packetpool.c
+++ b/src/tmqh-packetpool.c
@@ -24,31 +24,15 @@
  */
 
 #include "suricata.h"
-#include "packet-queue.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-uricontent.h"
-#include "threads.h"
-#include "threadvars.h"
-#include "flow.h"
-#include "flow-util.h"
-#include "host.h"
-
-#include "stream.h"
-#include "stream-tcp-reassemble.h"
 
 #include "tm-queuehandlers.h"
 #include "tm-threads.h"
-#include "tm-modules.h"
 
 #include "pkt-var.h"
 
 #include "tmqh-packetpool.h"
 
-#include "util-debug.h"
-#include "util-error.h"
 #include "util-profiling.h"
-#include "util-device.h"
 
 /* Number of freed packet to save for one pool before freeing them. */
 #define MAX_PENDING_RETURN_PACKETS 32
diff --git a/src/tmqh-simple.c b/src/tmqh-simple.c
index 2cc5ffbe7df7..8827d15fdd81 100644
--- a/src/tmqh-simple.c
+++ b/src/tmqh-simple.c
@@ -24,10 +24,6 @@
  */
 
 #include "suricata.h"
-#include "packet-queue.h"
-#include "decode.h"
-#include "threads.h"
-#include "threadvars.h"
 
 #include "tm-queuehandlers.h"
 #include "tmqh-simple.h"
diff --git a/src/unix-manager.c b/src/unix-manager.c
index 0f0c846c88a5..5e3fb624536a 100644
--- a/src/unix-manager.c
+++ b/src/unix-manager.c
@@ -22,29 +22,21 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 #include "unix-manager.h"
 #include "detect-engine.h"
 #include "tm-threads.h"
-#include "runmodes.h"
-#include "conf.h"
 #include "runmode-unix-socket.h"
 
 #include "output-json-stats.h"
 
 #include "util-privs.h"
-#include "util-debug.h"
 #include "util-device.h"
-#include "util-ebpf.h"
-#include "util-signal.h"
-#include "util-buffer.h"
 
 #if (defined BUILD_UNIX_SOCKET) && (defined HAVE_SYS_UN_H) && (defined HAVE_SYS_STAT_H) && (defined HAVE_SYS_TYPES_H)
 #include <sys/un.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 
-#include "output.h"
 #include "output-json.h"
 
 // MSG_NOSIGNAL does not exists on OS X
diff --git a/src/util-action.c b/src/util-action.c
index aab447564db6..5bdf96db6635 100644
--- a/src/util-action.c
+++ b/src/util-action.c
@@ -23,18 +23,10 @@
 
 #include "suricata-common.h"
 
-#include "action-globals.h"
-#include "conf.h"
 #include "conf-yaml-loader.h"
 
-#include "detect.h"
-#include "detect-engine.h"
-#include "detect-engine-sigorder.h"
-
 #include "util-unittest.h"
 #include "util-action.h"
-#include "util-unittest-helper.h"
-#include "util-debug.h"
 
 /* Default order: */
 uint8_t action_order_sigs[4] = {ACTION_PASS, ACTION_DROP, ACTION_REJECT, ACTION_ALERT};
diff --git a/src/util-affinity.c b/src/util-affinity.c
index 2ad03e6a7352..6889cd374248 100644
--- a/src/util-affinity.c
+++ b/src/util-affinity.c
@@ -27,10 +27,6 @@
 #include "util-affinity.h"
 #include "util-cpu.h"
 #include "util-byte.h"
-#include "conf.h"
-#include "threads.h"
-#include "queue.h"
-#include "runmodes.h"
 
 ThreadsAffinityType thread_affinity[MAX_CPU_SET] = {
     {
diff --git a/src/util-atomic.c b/src/util-atomic.c
index 11aa51afd02b..b299b71ac1f9 100644
--- a/src/util-atomic.c
+++ b/src/util-atomic.c
@@ -22,7 +22,6 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 #include "util-atomic.h"
 #include "util-unittest.h"
 
diff --git a/src/util-bpf.c b/src/util-bpf.c
index 934aca9ad2d6..a1d62cc4fe0a 100644
--- a/src/util-bpf.c
+++ b/src/util-bpf.c
@@ -21,9 +21,7 @@
  * \author Eric Leblond <eric@regit.org>
  */
 
-
 #include "suricata-common.h"
-#include "suricata.h"
 #include "util-bpf.h"
 
 #if !defined __OpenBSD__
diff --git a/src/util-buffer.c b/src/util-buffer.c
index d4f50b06a41b..83aea948f515 100644
--- a/src/util-buffer.c
+++ b/src/util-buffer.c
@@ -22,8 +22,6 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "util-debug.h"
 #include "util-buffer.h"
 
 /* 10 mb */
diff --git a/src/util-byte.c b/src/util-byte.c
index 72ed4bf583cc..2a14111d2c46 100644
--- a/src/util-byte.c
+++ b/src/util-byte.c
@@ -26,7 +26,6 @@
 #include "suricata-common.h"
 #include "util-byte.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 #include "util-validate.h"
 
 /** \brief Turn byte array into string.
diff --git a/src/util-classification-config.c b/src/util-classification-config.c
index 87f52896e792..fb191fd84abc 100644
--- a/src/util-classification-config.c
+++ b/src/util-classification-config.c
@@ -24,15 +24,10 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-engine.h"
-#include "util-hash.h"
 
-#include "conf.h"
 #include "util-classification-config.h"
 #include "util-unittest.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-fmemopen.h"
 #include "util-byte.h"
 
diff --git a/src/util-conf.c b/src/util-conf.c
index 4abdeca7c840..6a2037019008 100644
--- a/src/util-conf.c
+++ b/src/util-conf.c
@@ -24,8 +24,6 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "conf.h"
-#include "runmodes.h"
 #include "util-conf.h"
 
 TmEcode ConfigSetLogDirectory(const char *name)
diff --git a/src/util-coredump-config.c b/src/util-coredump-config.c
index e5b14a75688a..a71b304636ad 100644
--- a/src/util-coredump-config.c
+++ b/src/util-coredump-config.c
@@ -25,7 +25,6 @@
 
 #define _FILE_OFFSET_BITS 64
 #include "util-coredump-config.h"
-#include "conf.h"
 #ifdef HAVE_SYS_RESOURCE_H
 #include <sys/resource.h>
 #endif
diff --git a/src/util-cpu.c b/src/util-cpu.c
index 39f0db582b6c..b380516b6b71 100644
--- a/src/util-cpu.c
+++ b/src/util-cpu.c
@@ -24,8 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-cpu.h"
 #include "util-byte.h"
 
diff --git a/src/util-daemon.c b/src/util-daemon.c
index 8e6e6b63cda5..d7b463c9d580 100644
--- a/src/util-daemon.c
+++ b/src/util-daemon.c
@@ -23,12 +23,9 @@
  * Daemonization process
  */
 
-#include "suricata.h"
 #include "suricata-common.h"
 #include "runmodes.h"
 #include "util-daemon.h"
-#include "util-debug.h"
-#include "conf.h"
 
 #ifndef OS_WIN32
 
diff --git a/src/util-datalink.c b/src/util-datalink.c
index f645ffb88f70..75905339d739 100644
--- a/src/util-datalink.c
+++ b/src/util-datalink.c
@@ -16,7 +16,6 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 #include "util-datalink.h"
 
 int g_datalink_value = LINKTYPE_NULL;
diff --git a/src/util-debug.c b/src/util-debug.c
index f2beabd6cbdd..539fbe7d11a4 100644
--- a/src/util-debug.c
+++ b/src/util-debug.c
@@ -24,31 +24,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
 #include "util-debug.h"
-#include "util-error.h"
-#include "util-enum.h"
-#include "util-debug-filters.h"
 #include "suricata.h"
 
-#include "decode.h"
-#include "detect.h"
-#include "packet-queue.h"
-#include "threadvars.h"
 #include "output.h"
 
-#include "tm-queuehandlers.h"
-#include "tm-queues.h"
-#include "tm-threads.h"
-
 #include "util-unittest.h"
 #include "util-syslog.h"
 #include "util-time.h"
 #include "rust.h"
 
-
-#include "conf.h"
-
 /* holds the string-enum mapping for the enums held in the table SCLogLevel */
 SCEnumCharMap sc_log_level_map[ ] = {
     { "Not set",        SC_LOG_NOTSET},
diff --git a/src/util-decode-mime.c b/src/util-decode-mime.c
index c928c6613450..2fe4c454c563 100644
--- a/src/util-decode-mime.c
+++ b/src/util-decode-mime.c
@@ -27,13 +27,15 @@
 
 #include "util-decode-mime.h"
 #include "util-ip.h"
-#include "util-spm-bs.h"
 #include "util-unittest.h"
 #include "util-memcmp.h"
-#include "util-print.h"
 #include "util-validate.h"
 #include "rust.h"
 
+#ifdef DEBUG
+#include "util-print.h"
+#endif
+
 /* Character constants */
 #ifndef CR
 #define CR  13
diff --git a/src/util-detect.c b/src/util-detect.c
index 37ed2e3c40b5..55ae64ef342b 100644
--- a/src/util-detect.c
+++ b/src/util-detect.c
@@ -24,8 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "detect.h"
 #include "util-detect.h"
 
 /**
diff --git a/src/util-device.c b/src/util-device.c
index 48920197d3a0..cc5ebd8ff467 100644
--- a/src/util-device.c
+++ b/src/util-device.c
@@ -16,7 +16,6 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 #include "util-device.h"
 #include "util-ioctl.h"
 #include "util-misc.h"
diff --git a/src/util-ebpf.c b/src/util-ebpf.c
index 407a436013dc..730abcad20d6 100644
--- a/src/util-ebpf.c
+++ b/src/util-ebpf.c
@@ -34,7 +34,6 @@
 #define SC_PCAP_DONT_INCLUDE_PCAP_H 1
 
 #include "suricata-common.h"
-#include "flow-bypass.h"
 
 #ifdef HAVE_PACKET_EBPF
 
@@ -55,7 +54,6 @@
 #include <bpf/libbpf.h>
 #include <bpf/bpf.h>
 #include <net/if.h>
-#include "autoconf.h"
 
 #define BPF_MAP_MAX_COUNT 16
 
diff --git a/src/util-enum.c b/src/util-enum.c
index f63140afa006..3a8861fb1a15 100644
--- a/src/util-enum.c
+++ b/src/util-enum.c
@@ -24,7 +24,6 @@
 #include "suricata-common.h"
 
 #include "util-enum.h"
-#include "util-debug.h"
 
 /**
  * \brief Maps a string name to an enum value from the supplied table.  Please
diff --git a/src/util-exception-policy.c b/src/util-exception-policy.c
index da51fbd31af8..6d2f5cfa2fc8 100644
--- a/src/util-exception-policy.c
+++ b/src/util-exception-policy.c
@@ -22,7 +22,10 @@
 #include "suricata-common.h"
 #include "suricata.h"
 #include "util-exception-policy.h"
+
+#ifdef DEBUG
 #include "util-misc.h"
+#endif
 
 void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
 {
diff --git a/src/util-file-decompression.c b/src/util-file-decompression.c
index 3eea38c55d88..3bb6c4dec9f8 100644
--- a/src/util-file-decompression.c
+++ b/src/util-file-decompression.c
@@ -25,15 +25,12 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
 #include "detect-engine.h"
 #include "app-layer-htp.h"
 
 #include "util-file-decompression.h"
 #include "util-file-swf-decompression.h"
-#include "util-misc.h"
-#include "util-print.h"
 
 #define SWF_ZLIB_MIN_VERSION    0x06
 #define SWF_LZMA_MIN_VERSION    0x0D
diff --git a/src/util-file-swf-decompression.c b/src/util-file-swf-decompression.c
index 71ca6eda8699..d878440d7ac4 100644
--- a/src/util-file-swf-decompression.c
+++ b/src/util-file-swf-decompression.c
@@ -21,16 +21,9 @@
  *
  */
 
-
-#include "suricata.h"
 #include "suricata-common.h"
 
-#include "app-layer-htp.h"
-
-#include "util-file-decompression.h"
 #include "util-file-swf-decompression.h"
-#include "util-misc.h"
-#include "util-print.h"
 
 #include <zlib.h>
 
diff --git a/src/util-file.c b/src/util-file.c
index 81913ae21e32..863587e170f4 100644
--- a/src/util-file.c
+++ b/src/util-file.c
@@ -24,19 +24,9 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "debug.h"
-#include "flow.h"
-#include "stream.h"
 #include "stream-tcp.h"
-#include "runmodes.h"
-#include "util-hash.h"
-#include "util-debug.h"
-#include "util-memcmp.h"
-#include "util-print.h"
 #include "app-layer-parser.h"
 #include "util-validate.h"
-#include "rust.h"
 
 extern int g_detect_disabled;
 
diff --git a/src/util-hashlist.c b/src/util-hashlist.c
index 686626173677..0ee28470e8ae 100644
--- a/src/util-hashlist.c
+++ b/src/util-hashlist.c
@@ -29,7 +29,6 @@
 #include "suricata-common.h"
 #include "util-hashlist.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 #include "util-memcmp.h"
 
 HashListTable* HashListTableInit(uint32_t size, uint32_t (*Hash)(struct HashListTable_ *, void *, uint16_t), char (*Compare)(void *, uint16_t, void *, uint16_t), void (*Free)(void *)) {
diff --git a/src/util-host-os-info.c b/src/util-host-os-info.c
index a9ede07755b5..a647a8614999 100644
--- a/src/util-host-os-info.c
+++ b/src/util-host-os-info.c
@@ -25,15 +25,10 @@
 
 #include "suricata-common.h"
 #include "util-host-os-info.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-ip.h"
-#include "util-radix-tree.h"
 #include "util-byte.h"
-#include "stream-tcp-private.h"
 #include "stream-tcp-reassemble.h"
 
-#include "conf.h"
 #include "conf-yaml-loader.h"
 
 #include "util-enum.h"
diff --git a/src/util-hyperscan.c b/src/util-hyperscan.c
index c5886d6691ca..391099ceefc2 100644
--- a/src/util-hyperscan.c
+++ b/src/util-hyperscan.c
@@ -24,7 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
 #ifdef BUILD_HYPERSCAN
 #include "util-hyperscan.h"
diff --git a/src/util-ioctl.c b/src/util-ioctl.c
index e0f7009e3297..38a3bdf30a97 100644
--- a/src/util-ioctl.c
+++ b/src/util-ioctl.c
@@ -23,8 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
-#include "util-device.h"
 #include "decode-sll.h"
 
 #ifdef HAVE_SYS_IOCTL_H
diff --git a/src/util-log-redis.c b/src/util-log-redis.c
index 6814b142ab88..9b380f7b37c8 100644
--- a/src/util-log-redis.c
+++ b/src/util-log-redis.c
@@ -25,10 +25,10 @@
  */
 #include "suricata-common.h" /* errno.h, string.h, etc. */
 #include "util-log-redis.h"
-#include "util-logopenfile.h"
-#include "util-byte.h"
 
 #ifdef HAVE_LIBHIREDIS
+#include "util-logopenfile.h"
+#include "util-byte.h"
 
 #ifdef HAVE_LIBEVENT_PTHREADS
 #include <event2/thread.h>
diff --git a/src/util-logopenfile.c b/src/util-logopenfile.c
index d46168458656..d1a28aa4d65c 100644
--- a/src/util-logopenfile.c
+++ b/src/util-logopenfile.c
@@ -27,7 +27,6 @@
 #include "suricata-common.h" /* errno.h, string.h, etc. */
 #include "util-logopenfile.h"
 #include "suricata.h"
-#include "conf.h"            /* ConfNode, etc. */
 #include "output.h"          /* DEFAULT_LOG_* */
 #include "util-byte.h"
 #include "util-time.h"
diff --git a/src/util-lua-common.c b/src/util-lua-common.c
index 671904e0e527..f9e8c4e79e85 100644
--- a/src/util-lua-common.c
+++ b/src/util-lua-common.c
@@ -24,29 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer-htp.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #ifdef HAVE_LUA
 
@@ -54,6 +31,9 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "output.h"
+#include "util-print.h"
+#include "util-time.h"
 #include "util-lua.h"
 #include "util-lua-common.h"
 
diff --git a/src/util-lua-dnp3-objects.c b/src/util-lua-dnp3-objects.c
index 27bbc5351901..8fa3538389a1 100644
--- a/src/util-lua-dnp3-objects.c
+++ b/src/util-lua-dnp3-objects.c
@@ -25,7 +25,6 @@
 #include "suricata-common.h"
 
 #include "app-layer-dnp3.h"
-#include "app-layer-dnp3-objects.h"
 
 #ifdef HAVE_LUA
 
@@ -33,6 +32,7 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "app-layer-dnp3-objects.h"
 #include "util-lua.h"
 #include "util-lua-dnp3-objects.h"
 
diff --git a/src/util-lua-dnp3.c b/src/util-lua-dnp3.c
index 7a791a0db07f..7f8e9e04f16b 100644
--- a/src/util-lua-dnp3.c
+++ b/src/util-lua-dnp3.c
@@ -18,7 +18,6 @@
 #include "suricata-common.h"
 
 #include "app-layer-dnp3.h"
-#include "app-layer-dnp3-objects.h"
 
 #ifdef HAVE_LUA
 
@@ -30,7 +29,6 @@
 #include "util-lua-common.h"
 #include "util-lua-dnp3.h"
 #include "util-lua-dnp3-objects.h"
-
 /**
  * \brief Helper macro to push key and integer value onto a table.
  */
diff --git a/src/util-lua-dns.c b/src/util-lua-dns.c
index 75ef710bde7a..f1e1f82e7403 100644
--- a/src/util-lua-dns.c
+++ b/src/util-lua-dns.c
@@ -24,29 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
-#include "rust.h"
 
 #ifdef HAVE_LUA
 
@@ -54,6 +31,7 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "rust.h"
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-dns.h"
diff --git a/src/util-lua-hassh.c b/src/util-lua-hassh.c
index f5bf12f4bef2..f55be6bea0b6 100644
--- a/src/util-lua-hassh.c
+++ b/src/util-lua-hassh.c
@@ -24,29 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssl.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #ifdef HAVE_LUA
 
@@ -54,6 +31,7 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "rust.h"
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-hassh.h"
diff --git a/src/util-lua-http.c b/src/util-lua-http.c
index 5dc521df7dab..5c7000b7d713 100644
--- a/src/util-lua-http.c
+++ b/src/util-lua-http.c
@@ -23,29 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer-htp.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #ifdef HAVE_LUA
 
@@ -53,6 +30,7 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "app-layer-htp.h"
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-http.h"
diff --git a/src/util-lua-ja3.c b/src/util-lua-ja3.c
index 3143f30816f7..f4e6f584abb4 100644
--- a/src/util-lua-ja3.c
+++ b/src/util-lua-ja3.c
@@ -24,29 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssl.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #ifdef HAVE_LUA
 
@@ -54,6 +31,7 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "app-layer-ssl.h"
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-ja3.h"
diff --git a/src/util-lua-smtp.c b/src/util-lua-smtp.c
index 25bb0eb19190..8de26c2ba153 100644
--- a/src/util-lua-smtp.c
+++ b/src/util-lua-smtp.c
@@ -27,25 +27,15 @@
 
 #include "suricata-common.h"
 
-#include "debug.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-#include "output.h"
-
-#include "app-layer-smtp.h"
-
 #ifdef HAVE_LUA
 
 #include <lua.h>
 #include <lualib.h>
 
+#include "app-layer-smtp.h"
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-smtp.h"
-#include "util-file.h"
 
 /*
  * \brief internal function used by SMTPGetMimeField
diff --git a/src/util-lua-ssh.c b/src/util-lua-ssh.c
index 4b52ece34c18..7d92935fb2bc 100644
--- a/src/util-lua-ssh.c
+++ b/src/util-lua-ssh.c
@@ -24,30 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssh.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
-#include "rust.h"
 
 #ifdef HAVE_LUA
 
@@ -55,6 +31,7 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "rust.h"
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-ssh.h"
diff --git a/src/util-lua-tls.c b/src/util-lua-tls.c
index b87d5961dd95..abc5fa7154ea 100644
--- a/src/util-lua-tls.c
+++ b/src/util-lua-tls.c
@@ -24,29 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-ssl.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #ifdef HAVE_LUA
 
@@ -54,6 +31,7 @@
 #include <lualib.h>
 #include <lauxlib.h>
 
+#include "app-layer-ssl.h"
 #include "util-lua.h"
 #include "util-lua-common.h"
 #include "util-lua-tls.h"
diff --git a/src/util-lua.c b/src/util-lua.c
index 084a3e132dd2..32bf0f9cb8a5 100644
--- a/src/util-lua.c
+++ b/src/util-lua.c
@@ -24,30 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "debug.h"
-#include "detect.h"
-#include "pkt-var.h"
-#include "conf.h"
-
-#include "threads.h"
-#include "threadvars.h"
-#include "tm-threads.h"
-
-#include "util-print.h"
-#include "util-unittest.h"
-#include "util-luajit.h"
-
-#include "util-debug.h"
-
-#include "output.h"
-#include "app-layer-htp.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "util-privs.h"
-#include "util-buffer.h"
-#include "util-proto-name.h"
-#include "util-logopenfile.h"
-#include "util-time.h"
 
 #ifdef HAVE_LUA
 
@@ -57,6 +33,10 @@
 
 #include "util-lua.h"
 
+#ifdef HAVE_LUAJIT
+#include "util-luajit.h"
+#endif
+
 lua_State *LuaGetState(void)
 {
     lua_State *s = NULL;
diff --git a/src/util-luajit.c b/src/util-luajit.c
index 5ecaf9447e45..54dbd0f85216 100644
--- a/src/util-luajit.c
+++ b/src/util-luajit.c
@@ -25,9 +25,7 @@
 #include "suricata-common.h"
 
 #ifdef HAVE_LUAJIT
-#include "conf.h"
 #include "util-pool.h"
-#include "util-lua.h"
 #include "util-luajit.h"
 
 /** \brief lua_State pool
diff --git a/src/util-macset.c b/src/util-macset.c
index 0896e907cda7..ac9ec8b3ab6c 100644
--- a/src/util-macset.c
+++ b/src/util-macset.c
@@ -26,13 +26,11 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 #include "flow-util.h"
 #include "flow-private.h"
 #include "flow-storage.h"
 #include "util-macset.h"
 #include "util-unittest.h"
-#include "util-unittest-helper.h"
 
 typedef uint8_t MacAddr[6];
 typedef enum {
diff --git a/src/util-magic.c b/src/util-magic.c
index 20ba08bb8807..bee30fdf522c 100644
--- a/src/util-magic.c
+++ b/src/util-magic.c
@@ -29,8 +29,6 @@
 
 #include "suricata-common.h"
 
-#include "conf.h"
-
 #include "util-unittest.h"
 #include "util-magic.h"
 
diff --git a/src/util-mem.c b/src/util-mem.c
index 2cf008e70952..24d1b69b54ef 100644
--- a/src/util-mem.c
+++ b/src/util-mem.c
@@ -17,7 +17,6 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "util-atomic.h"
 
 #if defined(_WIN32) || defined(__WIN32)
 #include <mm_malloc.h>
diff --git a/src/util-memcmp.c b/src/util-memcmp.c
index 4342ac1f6cf0..c44eba0c3f02 100644
--- a/src/util-memcmp.c
+++ b/src/util-memcmp.c
@@ -179,8 +179,6 @@ static int MemcmpTest13 (void)
     return 1;
 }
 
-#include "util-cpu.h"
-
 #define TEST_RUNS 1000000
 
 static int MemcmpTest14 (void)
diff --git a/src/util-misc.c b/src/util-misc.c
index 32816f8e3335..ec41234b5996 100644
--- a/src/util-misc.c
+++ b/src/util-misc.c
@@ -22,9 +22,6 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "util-byte.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-misc.h"
 
diff --git a/src/util-mpm-ac-bs.c b/src/util-mpm-ac-bs.c
index 8a51c59811d2..7126f6b7ad8a 100644
--- a/src/util-mpm-ac-bs.c
+++ b/src/util-mpm-ac-bs.c
@@ -46,20 +46,15 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-build.h"
 #include "util-mpm-ac-bs.h"
 
-#include "conf.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-memcmp.h"
-#include "util-memcpy.h"
 #include "util-validate.h"
 
 void SCACBSInitCtx(MpmCtx *);
diff --git a/src/util-mpm-ac-ks.c b/src/util-mpm-ac-ks.c
index dc699a79c7c5..1864bf12729d 100644
--- a/src/util-mpm-ac-ks.c
+++ b/src/util-mpm-ac-ks.c
@@ -66,19 +66,14 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-build.h"
 
-#include "conf.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-memcmp.h"
-#include "util-memcpy.h"
 #include "util-validate.h"
 #include "util-mpm-ac-ks.h"
 
diff --git a/src/util-mpm-ac.c b/src/util-mpm-ac.c
index 8b9f5107b9e8..3fdf266cf5da 100644
--- a/src/util-mpm-ac.c
+++ b/src/util-mpm-ac.c
@@ -46,20 +46,15 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-build.h"
 
-#include "conf.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-memcmp.h"
 #include "util-mpm-ac.h"
-#include "util-memcpy.h"
 #include "util-validate.h"
 
 void SCACInitCtx(MpmCtx *);
diff --git a/src/util-mpm-hs.c b/src/util-mpm-hs.c
index 2fff553bc7c5..52e82412e8f0 100644
--- a/src/util-mpm-hs.c
+++ b/src/util-mpm-hs.c
@@ -25,26 +25,13 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "detect.h"
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-build.h"
-
-#include "conf.h"
-#include "util-debug.h"
-#include "util-unittest.h"
-#include "util-unittest-helper.h"
 #include "util-memcmp.h"
 #include "util-mpm-hs.h"
-#include "util-memcpy.h"
-#include "util-hash.h"
-#include "util-hash-lookup3.h"
-#include "util-hyperscan.h"
 
 #ifdef BUILD_HYPERSCAN
-
+#include "util-hyperscan.h"
+#include "util-hash-lookup3.h"
 #include <hs.h>
 
 void SCHSInitCtx(MpmCtx *);
@@ -1094,6 +1081,11 @@ void MpmHSGlobalCleanup(void)
 /*************************************Unittests********************************/
 
 #ifdef UNITTESTS
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+#include "detect-parse.h"
+#include "detect-engine.h"
+#include "detect-engine-build.h"
 
 static int SCHSTest01(void)
 {
diff --git a/src/util-mpm.c b/src/util-mpm.c
index 2cd1b9a6902e..9d3beafe63d8 100644
--- a/src/util-mpm.c
+++ b/src/util-mpm.c
@@ -25,24 +25,17 @@
 
 #include "suricata-common.h"
 #include "util-mpm.h"
-#include "util-debug.h"
 
 /* include pattern matchers */
 #include "util-mpm-ac.h"
 #include "util-mpm-ac-bs.h"
 #include "util-mpm-ac-ks.h"
-#include "util-mpm-hs.h"
-#include "util-hashlist.h"
 
 #include "detect-engine.h"
-#include "util-misc.h"
-#include "conf.h"
-#include "conf-yaml-loader.h"
-#include "queue.h"
-#include "util-unittest.h"
 #include "util-memcpy.h"
 #ifdef BUILD_HYPERSCAN
 #include "hs.h"
+#include "util-mpm-hs.h"
 #endif
 
 MpmTableElmt mpm_table[MPM_TABLE_SIZE];
@@ -557,9 +550,6 @@ int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
 
 /************************************Unittests*********************************/
 
-#ifdef UNITTESTS
-#endif /* UNITTESTS */
-
 void MpmRegisterTests(void)
 {
 #ifdef UNITTESTS
diff --git a/src/util-napatech.c b/src/util-napatech.c
index b61aa85dd48e..a8f8fcd10318 100644
--- a/src/util-napatech.c
+++ b/src/util-napatech.c
@@ -25,14 +25,7 @@
 #include "suricata-common.h"
 
 #ifdef HAVE_NAPATECH
-#include "suricata.h"
-#include "util-device.h"
-#include "util-cpu.h"
-#include "util-byte.h"
-#include "threadvars.h"
-#include "tm-threads.h"
 #include "util-napatech.h"
-#include "source-napatech.h"
 
 #ifdef NAPATECH_ENABLE_BYPASS
 
diff --git a/src/util-path.c b/src/util-path.c
index de2068dd0eec..14728ce53a07 100644
--- a/src/util-path.c
+++ b/src/util-path.c
@@ -23,9 +23,6 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "debug.h"
-#include "util-debug.h"
 #include "util-path.h"
 
 #ifdef OS_WIN32
diff --git a/src/util-plugin.c b/src/util-plugin.c
index 6a59f257c367..719f2f39fa7e 100644
--- a/src/util-plugin.c
+++ b/src/util-plugin.c
@@ -16,10 +16,7 @@
  */
 
 #include "suricata-common.h"
-#include "suricata-plugin.h"
 #include "suricata.h"
-#include "runmodes.h"
-#include "output-eve-syslog.h"
 #include "util-plugin.h"
 
 #ifdef HAVE_PLUGINS
diff --git a/src/util-pool-thread.c b/src/util-pool-thread.c
index 8ed982bb236f..c9ea9a3a25d4 100644
--- a/src/util-pool-thread.c
+++ b/src/util-pool-thread.c
@@ -30,10 +30,8 @@
  */
 
 #include "suricata-common.h"
-#include "util-pool.h"
 #include "util-pool-thread.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 /**
  *  \brief per thread Pool, initialization function
diff --git a/src/util-pool.c b/src/util-pool.c
index 4a95afceee88..5621fd508d66 100644
--- a/src/util-pool.c
+++ b/src/util-pool.c
@@ -42,7 +42,6 @@
 #include "util-pool.h"
 #include "util-pool-thread.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 
 static int PoolMemset(void *pitem, void *initdata)
 {
diff --git a/src/util-print.c b/src/util-print.c
index efef9021633a..2032bdfd3085 100644
--- a/src/util-print.c
+++ b/src/util-print.c
@@ -25,8 +25,6 @@
 
 #include "suricata-common.h"
 #include "util-print.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-validate.h"
 #include "rust.h"
 
diff --git a/src/util-privs.c b/src/util-privs.c
index 657115a5e535..8df77f0cac50 100644
--- a/src/util-privs.c
+++ b/src/util-privs.c
@@ -27,8 +27,6 @@
 #ifndef OS_WIN32
 
 #include "suricata-common.h"
-#include "util-debug.h"
-#include "suricata.h"
 
 #include "util-privs.h"
 #include "util-byte.h"
@@ -39,8 +37,6 @@
 #ifdef HAVE_SYS_PRCTL_H
 #include <sys/prctl.h>
 #endif
-#include "threadvars.h"
-#include "util-cpu.h"
 #include "runmodes.h"
 
 /** flag indicating if we'll be using caps */
diff --git a/src/util-profiling-keywords.c b/src/util-profiling-keywords.c
index 3aba66c09400..87a79def13f5 100644
--- a/src/util-profiling-keywords.c
+++ b/src/util-profiling-keywords.c
@@ -25,21 +25,12 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-engine.h"
-#include "conf.h"
-
-#include "tm-threads.h"
 
-#include "util-unittest.h"
-#include "util-byte.h"
+#ifdef PROFILING
+#include "detect-engine.h"
 #include "util-profiling.h"
-#include "util-profiling-locks.h"
 #include "util-time.h"
 
-#ifdef PROFILING
-
 #ifndef MIN
 #define MIN(a, b) (((a) < (b)) ? (a) : (b))
 #endif
diff --git a/src/util-profiling-locks.c b/src/util-profiling-locks.c
index 084075059604..6758270f136d 100644
--- a/src/util-profiling-locks.c
+++ b/src/util-profiling-locks.c
@@ -26,7 +26,6 @@
 
 #include "suricata-common.h"
 #include "util-profiling-locks.h"
-#include "util-hashlist.h"
 
 #ifdef PROFILING
 #ifdef PROFILE_LOCKING
diff --git a/src/util-profiling-prefilter.c b/src/util-profiling-prefilter.c
index 1831a5dd52d2..be4bffbbeb6c 100644
--- a/src/util-profiling-prefilter.c
+++ b/src/util-profiling-prefilter.c
@@ -25,21 +25,11 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-engine.h"
-#include "detect-engine-prefilter.h"
-#include "conf.h"
-
-#include "tm-threads.h"
 
-#include "util-unittest.h"
-#include "util-byte.h"
+#ifdef PROFILING
 #include "util-profiling.h"
-#include "util-profiling-locks.h"
 #include "util-time.h"
-
-#ifdef PROFILING
+#include "detect-engine-prefilter.h"
 
 typedef struct SCProfilePrefilterData_ {
     uint64_t called;
diff --git a/src/util-profiling-rulegroups.c b/src/util-profiling-rulegroups.c
index 1a89908cd462..4d4b2de433fa 100644
--- a/src/util-profiling-rulegroups.c
+++ b/src/util-profiling-rulegroups.c
@@ -25,21 +25,11 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-engine.h"
-#include "conf.h"
 
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-byte.h"
+#ifdef PROFILING
 #include "util-profiling.h"
-#include "util-profiling-locks.h"
 #include "util-time.h"
 
-#ifdef PROFILING
-
 /**
  * Extra data for rule profiling.
  */
diff --git a/src/util-profiling-rules.c b/src/util-profiling-rules.c
index 6c3f31d967a2..8a670e51d039 100644
--- a/src/util-profiling-rules.c
+++ b/src/util-profiling-rules.c
@@ -25,19 +25,11 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "conf.h"
 
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-byte.h"
+#ifdef PROFILING
 #include "util-profiling.h"
-#include "util-profiling-locks.h"
 #include "util-time.h"
-
-#ifdef PROFILING
+#include "util-byte.h"
 
 /**
  * Extra data for rule profiling.
diff --git a/src/util-profiling.c b/src/util-profiling.c
index d020e73f7137..9947893ec8cc 100644
--- a/src/util-profiling.c
+++ b/src/util-profiling.c
@@ -27,20 +27,11 @@
  */
 
 #include "suricata-common.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-engine-prefilter.h"
-#include "conf.h"
-#include "flow-worker.h"
 
-#include "tm-threads.h"
-
-#include "util-unittest.h"
-#include "util-byte.h"
 #include "util-profiling.h"
-#include "util-profiling-locks.h"
 
 #ifdef PROFILING
+#include "tm-threads.h"
 
 #ifndef MIN
 #define MIN(a, b) (((a) < (b)) ? (a) : (b))
@@ -1315,6 +1306,7 @@ const char * PacketProfileLoggertIdToString(LoggerId id)
 }
 
 #ifdef UNITTESTS
+#include "util-unittest.h"
 
 static int
 ProfilingGenericTicksTest01(void)
diff --git a/src/util-radix-tree.c b/src/util-radix-tree.c
index 3277ac0ecc93..a9ddec14c6ed 100644
--- a/src/util-radix-tree.c
+++ b/src/util-radix-tree.c
@@ -25,8 +25,6 @@
 
 #include "suricata-common.h"
 #include "util-radix-tree.h"
-#include "util-debug.h"
-#include "util-error.h"
 #include "util-ip.h"
 #include "util-unittest.h"
 #include "util-memcmp.h"
diff --git a/src/util-reference-config.c b/src/util-reference-config.c
index 5e41f5841596..62bcc3f7c75b 100644
--- a/src/util-reference-config.c
+++ b/src/util-reference-config.c
@@ -22,15 +22,10 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 #include "detect-engine.h"
-#include "util-hash.h"
 
 #include "util-reference-config.h"
-#include "conf.h"
 #include "util-unittest.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-fmemopen.h"
 
 /* Regex to parse each line from reference.config file.  The first substring
diff --git a/src/util-rohash.c b/src/util-rohash.c
index 3b35201065e4..dfe6d852afa1 100644
--- a/src/util-rohash.c
+++ b/src/util-rohash.c
@@ -35,11 +35,8 @@
  */
 
 #include "suricata-common.h"
-#include "util-hash.h"
-#include "util-unittest.h"
 #include "util-memcmp.h"
 #include "util-hash-lookup3.h"
-#include "queue.h"
 #include "util-rohash.h"
 
 /** item_size data beyond this header */
diff --git a/src/util-rule-vars.c b/src/util-rule-vars.c
index b5eb68c4364c..a37ada3485d6 100644
--- a/src/util-rule-vars.c
+++ b/src/util-rule-vars.c
@@ -24,18 +24,13 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 #include "conf-yaml-loader.h"
 
-#include "detect.h"
-#include "detect-content.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 
 #include "util-rule-vars.h"
 #include "util-enum.h"
-#include "util-debug.h"
 #include "util-unittest.h"
 
 /** An enum-string map, that maps the different vars type in the yaml conf
diff --git a/src/util-runmodes.c b/src/util-runmodes.c
index 2e7a21c4ead6..42e0c75ed6eb 100644
--- a/src/util-runmodes.c
+++ b/src/util-runmodes.c
@@ -26,28 +26,15 @@
 
 #include "suricata-common.h"
 #include "tm-threads.h"
-#include "conf.h"
-#include "runmodes.h"
-#include "runmode-af-packet.h"
 #include "output.h"
-#include "log-httplog.h"
 
 #include "detect-engine.h"
-#include "detect-engine-mpm.h"
 
-#include "alert-fastlog.h"
-#include "alert-debuglog.h"
-
-#include "util-debug.h"
-#include "util-time.h"
-#include "util-cpu.h"
 #include "util-affinity.h"
 #include "util-device.h"
 
 #include "util-runmodes.h"
 
-#include "flow-hash.h"
-
 /** \brief create a queue string for autofp to pass to
  *         the flow queue handler.
  *
diff --git a/src/util-running-modes.c b/src/util-running-modes.c
index a88885c0a26f..eb99562eeb18 100644
--- a/src/util-running-modes.c
+++ b/src/util-running-modes.c
@@ -21,11 +21,7 @@
  */
 
 #include "suricata-common.h"
-#include "app-layer-detect-proto.h"
 #include "app-layer.h"
-#include "app-layer-parser.h"
-#include "util-unittest.h"
-#include "util-debug.h"
 #include "conf-yaml-loader.h"
 #include "util-running-modes.h"
 
diff --git a/src/util-signal.c b/src/util-signal.c
index 9e3ec0cdf812..1e1f6e8770f6 100644
--- a/src/util-signal.c
+++ b/src/util-signal.c
@@ -22,8 +22,6 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "util-debug.h"
 #include "util-signal.h"
 
 int UtilSignalBlock(int signum)
diff --git a/src/util-spm-bm.c b/src/util-spm-bm.c
index df6742054ff1..3733447c64ad 100644
--- a/src/util-spm-bm.c
+++ b/src/util-spm-bm.c
@@ -34,9 +34,6 @@
 #include "suricata.h"
 
 #include "util-spm-bm.h"
-#include "util-spm.h"
-#include "util-debug.h"
-#include "util-error.h"
 #include "util-memcpy.h"
 #include "util-validate.h"
 
diff --git a/src/util-spm-bs.c b/src/util-spm-bs.c
index 6d49ff658347..c0b19aabaed1 100644
--- a/src/util-spm-bs.c
+++ b/src/util-spm-bs.c
@@ -30,7 +30,6 @@
 #include "suricata-common.h"
 #include "suricata.h"
 
-#include "util-debug.h"
 #include "util-spm-bs.h"
 
 
diff --git a/src/util-spm-hs.c b/src/util-spm-hs.c
index 747a5d423e14..4b71d63d70ab 100644
--- a/src/util-spm-hs.c
+++ b/src/util-spm-hs.c
@@ -24,13 +24,11 @@
  */
 
 #include "suricata-common.h"
-#include "suricata.h"
 
-#include "util-hyperscan.h"
 #include "util-spm-hs.h"
 
 #ifdef BUILD_HYPERSCAN
-
+#include "util-hyperscan.h"
 #include <hs.h>
 
 /**
diff --git a/src/util-spm.c b/src/util-spm.c
index b3b14d7f7138..44ffe286c183 100644
--- a/src/util-spm.c
+++ b/src/util-spm.c
@@ -47,16 +47,13 @@
 #include "suricata.h"
 #include "util-unittest.h"
 
-#include "conf.h"
-
 #include "util-spm.h"
-#include "util-spm-bs.h"
 #include "util-spm-bs2bm.h"
 #include "util-spm-bm.h"
-#include "util-spm-hs.h"
 #include "util-clock.h"
 #ifdef BUILD_HYPERSCAN
 #include "hs.h"
+#include "util-spm-hs.h"
 #endif
 
 SpmTableElmt spm_table[SPM_TABLE_SIZE];
diff --git a/src/util-strptime.c b/src/util-strptime.c
index e0475ec611f0..89c0ea1dde25 100644
--- a/src/util-strptime.c
+++ b/src/util-strptime.c
@@ -34,7 +34,6 @@
 __RCSID("$NetBSD: strptime.c,v 1.36 2012/03/13 21:13:48 christos Exp $");
 #endif
 
-#include "namespace.h"
 #include <sys/localedef.h>
 */
 #include "suricata-common.h"
@@ -46,7 +45,6 @@ __RCSID("$NetBSD: strptime.c,v 1.36 2012/03/13 21:13:48 christos Exp $");
 #include <stdint.h>
 /*
 #include <tzfile.h>
-#include "private.h"
 
 #ifdef __weak_alias
 __weak_alias(strptime,_strptime)
diff --git a/src/util-thash.c b/src/util-thash.c
index 4c2071319998..e5eab61c880b 100644
--- a/src/util-thash.c
+++ b/src/util-thash.c
@@ -23,16 +23,13 @@
  */
 
 #include "suricata-common.h"
-#include "conf.h"
 
-#include "util-debug.h"
 #include "util-thash.h"
 
 #include "util-random.h"
 #include "util-misc.h"
 #include "util-byte.h"
 
-#include "util-hash-lookup3.h"
 #include "util-validate.h"
 
 static THashData *THashGetUsed(THashTableContext *ctx);
diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c
index 9b63e8447d89..9077238d7330 100644
--- a/src/util-threshold-config.c
+++ b/src/util-threshold-config.c
@@ -32,25 +32,17 @@
 
 #include "suricata-common.h"
 
-#include "host.h"
-#include "ippair.h"
-
-#include "detect.h"
 #include "detect-engine.h"
 #include "detect-engine-address.h"
 #include "detect-engine-threshold.h"
-#include "detect-threshold.h"
 #include "detect-parse.h"
 #include "detect-engine-build.h"
 
-#include "conf.h"
 #include "util-threshold-config.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-byte.h"
 #include "util-time.h"
-#include "util-error.h"
-#include "util-debug.h"
 #include "util-fmemopen.h"
 
 typedef enum ThresholdRuleType {
diff --git a/src/util-time.c b/src/util-time.c
index 8ab120729138..3377d0766311 100644
--- a/src/util-time.c
+++ b/src/util-time.c
@@ -60,10 +60,7 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
-#include "detect.h"
-#include "threads.h"
 #include "tm-threads.h"
-#include "util-debug.h"
 #include "util-time.h"
 
 #ifdef UNITTESTS
diff --git a/src/util-unittest-helper.c b/src/util-unittest-helper.c
index 05e313727706..6a39df6784f5 100644
--- a/src/util-unittest-helper.c
+++ b/src/util-unittest-helper.c
@@ -26,24 +26,17 @@
 
 #include "suricata-common.h"
 
-#include "decode.h"
-
-#include "flow-private.h"
 #include "flow-util.h"
 #include "flow-spare-pool.h"
 
-#include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-sigorder.h"
 #include "detect-engine-build.h"
 
 #include "stream-tcp.h"
-#include "stream-tcp-private.h"
 
-#include "util-debug.h"
 #include "util-time.h"
-#include "util-error.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
@@ -1000,7 +993,6 @@ void * UTHmemsearch(const void *big, size_t big_len, const void *little, size_t
     return memmem(big, big_len, little, little_len);
 }
 #else
-#include "util-spm-bs.h"
 void * UTHmemsearch(const void *big, size_t big_len, const void *little, size_t little_len) {
     return BasicSearch(big, big_len, little, little_len);
 }
diff --git a/src/util-unittest.c b/src/util-unittest.c
index 202d95bd1951..b3e50503285d 100644
--- a/src/util-unittest.c
+++ b/src/util-unittest.c
@@ -33,14 +33,10 @@
  */
 
 #include "suricata-common.h"
-#include "runmodes.h"
 #include "util-unittest.h"
-#include "util-debug.h"
 #include "util-time.h"
-#include "conf.h"
 
 #include "stream-tcp.h"
-#include "stream-tcp-reassemble.h"
 
 #ifdef UNITTESTS
 
diff --git a/src/util-var-name.c b/src/util-var-name.c
index 426ea146d27e..69733dd921ef 100644
--- a/src/util-var-name.c
+++ b/src/util-var-name.c
@@ -24,8 +24,6 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
-#include "util-hashlist.h"
 #include "util-var-name.h"
 
 /* the way this can be used w/o locking lookups:
diff --git a/src/util-var.c b/src/util-var.c
index 8a2df63f1fa7..862559fb5b53 100644
--- a/src/util-var.c
+++ b/src/util-var.c
@@ -24,17 +24,12 @@
  */
 
 #include "suricata-common.h"
-#include "detect.h"
 
 #include "util-var.h"
 
 #include "flow-var.h"
 #include "flow-bit.h"
 #include "pkt-var.h"
-#include "host-bit.h"
-#include "ippair-bit.h"
-
-#include "util-debug.h"
 
 void XBitFree(XBit *fb)
 {
diff --git a/src/win32-misc.c b/src/win32-misc.c
index 1dc28a69268a..38fde54c5dcb 100644
--- a/src/win32-misc.c
+++ b/src/win32-misc.c
@@ -27,8 +27,6 @@
 
 #include "suricata-common.h"
 #include "win32-misc.h"
-#include "direct.h"
-#include "util-ip.h"
 
 void setenv(const char *name, const char *value, int overwrite)
 {
diff --git a/src/win32-service.c b/src/win32-service.c
index 06191b197334..cf11524f10a1 100644
--- a/src/win32-service.c
+++ b/src/win32-service.c
@@ -28,7 +28,6 @@
 #include "suricata-common.h"
 #include "suricata.h"
 #include "win32-service.h"
-#include "util-debug.h"
 
 static SERVICE_STATUS_HANDLE service_status_handle = 0;
 
diff --git a/src/win32-syscall.c b/src/win32-syscall.c
index 0c2789264d97..b3c7fc9cab6e 100644
--- a/src/win32-syscall.c
+++ b/src/win32-syscall.c
@@ -52,12 +52,6 @@
 #define _snprintf StringCbPrintfA
 
 #include "suricata-common.h"
-#include "util-debug.h"
-#include "util-device.h"
-#include "util-mem.h"
-#include "util-unittest.h"
-
-#include "suricata.h"
 
 #include "win32-syscall.h"
 
@@ -1662,6 +1656,8 @@ int RestoreIfaceOffloadingWin32(LiveDevice *ldev)
 #endif /* NTDDI_VERSION >= NTDDI_VISTA */
 
 #ifdef UNITTESTS
+#include "util-unittest.h"
+
 static int Win32TestStripPcapPrefix(void)
 {
     int result = 1;