diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 6764b58dc88d..fb0127f6f4db 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -234,6 +234,11 @@ jobs:
                 texlive-upquote \
                 texlive-capt-of \
                 texlive-needspace \
+      - name: Setup cppclean
+        run: |
+          git clone --depth 1 --branch suricata https://github.com/catenacyber/cppclean
+          cd cppclean
+          python3 setup.py install
       - name: Configuring
         run: |
           ./autogen.sh
@@ -242,6 +247,9 @@ jobs:
         env:
           DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-lua --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
       - run: test -e doc/userguide/suricata.1
+      - name: Checking includes
+        run: |
+          cppclean src/*.h | grep "does not need to be #included" | python3 scripts/cppclean_check.py
       - name: Building Rust documentation
         run: make doc
         working-directory: rust
diff --git a/scripts/cppclean_check.py b/scripts/cppclean_check.py
new file mode 100644
index 000000000000..6689ab392f7f
--- /dev/null
+++ b/scripts/cppclean_check.py
@@ -0,0 +1,30 @@
+import sys
+
+#cppclean src/*.h | grep "does not need to be #included"
+retcode = 0
+for l in sys.stdin:
+    includer = l.split(':')[0]
+    included = l.split("'")[1]
+
+    if included == "rust.h" or included == "suricata-common.h":
+        continue
+    if includer == "src/suricata-common.h" or includer == "src/rust-context.h" or includer == "src/rust.h" or includer == "src/threads.h":
+        continue
+
+    if included == "util-file.h" and includer == "src/detect.h":
+        # SigTableElmt structure field FileMatch being a function pointer using a parameter File defined in util-file.h
+        continue
+    if included == "conf.h" and includer == "src/suricata-plugin.h":
+        # SCEveFileType structure field Init being a function pointer using a parameter ConfNode defined in conf.h
+        continue
+    if included == "util-debug-filters.h" and includer == "src/util-debug.h":
+        # Macro SCEnter using SCLogCheckFDFilterEntry defined in util-debug-filters.h
+        continue
+    if included == "util-spm-bs.h" and includer == "src/util-spm.h":
+        # Macro SpmSearch using BasicSearch defined in util-spm-bs.h
+        continue
+
+    print("Unnecessary include from %s for %s" % (includer, included))
+    retcode = 1
+
+sys.exit(retcode)
diff --git a/src/Makefile.am b/src/Makefile.am
index a731eb1ad396..481d093b847a 100755
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -38,7 +38,6 @@ noinst_HEADERS = \
 	app-layer-modbus.h \
 	app-layer-quic.h \
 	app-layer-mqtt.h \
-	app-layer-nbss.h \
 	app-layer-nfs-tcp.h \
 	app-layer-nfs-udp.h \
 	app-layer-ntp.h \
@@ -81,7 +80,6 @@ noinst_HEADERS = \
 	decode-ipv6.h \
 	decode-mpls.h \
 	decode-nsh.h \
-	decode-null.h \
 	decode-ppp.h \
 	decode-pppoe.h \
 	decode-raw.h \
@@ -607,7 +605,6 @@ noinst_HEADERS = \
 	util-validate.h \
 	util-var.h \
 	util-var-name.h \
-	util-vector.h \
 	win32-misc.h \
 	win32-service.h \
 	win32-syscall.h \
diff --git a/src/alert-fastlog.c b/src/alert-fastlog.c
index 5800ea3075e6..2d24bd54919f 100644
--- a/src/alert-fastlog.c
+++ b/src/alert-fastlog.c
@@ -40,6 +40,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 #include "detect-engine-mpm.h"
 #include "detect-reference.h"
 #include "util-classification-config.h"
diff --git a/src/app-layer-dcerpc-common.h b/src/app-layer-dcerpc-common.h
index 0bbfc5540124..f140ec49a7d0 100644
--- a/src/app-layer-dcerpc-common.h
+++ b/src/app-layer-dcerpc-common.h
@@ -18,11 +18,6 @@
 #ifndef __APP_LAYER_DCERPC_COMMON_H__
 #define __APP_LAYER_DCERPC_COMMON_H__
 
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "flow.h"
-#include "queue.h"
-#include "util-byte.h"
 
 void RegisterDCERPCParsers(void);
 void DCERPCParserTests(void);
diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c
index 4398e0295986..468cfba9048a 100644
--- a/src/app-layer-detect-proto.c
+++ b/src/app-layer-detect-proto.c
@@ -31,6 +31,7 @@
 
 #include "detect.h"
 #include "detect-engine-port.h"
+#include "detect-engine-build.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-content.h"
diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c
index 88c3a16150bb..76e664f50393 100644
--- a/src/app-layer-dnp3.c
+++ b/src/app-layer-dnp3.c
@@ -16,12 +16,15 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "stream.h"
 #include "util-byte.h"
 #include "util-unittest.h"
 #include "util-hashlist.h"
 
 #include "util-print.h"
+#include "util-spm-bs.h"
+#include "util-enum.h"
 
 #include "app-layer.h"
 #include "app-layer-protos.h"
diff --git a/src/app-layer-dnp3.h b/src/app-layer-dnp3.h
index bf74e27aa9ad..220ef1016007 100644
--- a/src/app-layer-dnp3.h
+++ b/src/app-layer-dnp3.h
@@ -18,9 +18,6 @@
 #ifndef __APP_LAYER_DNP3_H__
 #define __APP_LAYER_DNP3_H__
 
-#include "detect-engine-state.h"
-#include "util-hashlist.h"
-#include "util-byte.h"
 #include "rust.h"
 
 /**
diff --git a/src/app-layer-enip-common.h b/src/app-layer-enip-common.h
index 90c744af0357..7cfd8d978540 100644
--- a/src/app-layer-enip-common.h
+++ b/src/app-layer-enip-common.h
@@ -24,10 +24,7 @@
 #ifndef __APP_LAYER_ENIP_COMMON_H__
 #define __APP_LAYER_ENIP_COMMON_H__
 
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "flow.h"
-#include "queue.h"
+#include "rust.h"
 
 // EtherNet/IP commands
 #define NOP                0x0000
diff --git a/src/app-layer-enip.h b/src/app-layer-enip.h
index d31cfb3aad0b..25cb1d5745da 100644
--- a/src/app-layer-enip.h
+++ b/src/app-layer-enip.h
@@ -24,9 +24,6 @@
 #ifndef __APP_LAYER_ENIP_H__
 #define __APP_LAYER_ENIP_H__
 
-#include "decode.h"
-#include "detect-engine-state.h"
-#include "queue.h"
 
 void RegisterENIPUDPParsers(void);
 void RegisterENIPTCPParsers(void);
diff --git a/src/app-layer-frames.c b/src/app-layer-frames.c
index 97ef816e795a..9a79edf50e7e 100644
--- a/src/app-layer-frames.c
+++ b/src/app-layer-frames.c
@@ -28,6 +28,7 @@
 
 #include "stream-tcp.h"
 #include "app-layer-frames.h"
+#include "app-layer-parser.h"
 
 static void FrameDebug(const char *prefix, const Frames *frames, const Frame *frame)
 {
diff --git a/src/app-layer-frames.h b/src/app-layer-frames.h
index 746c7296926c..23cba1753a74 100644
--- a/src/app-layer-frames.h
+++ b/src/app-layer-frames.h
@@ -24,12 +24,7 @@
 #ifndef __APP_LAYER_FRAMES_H__
 #define __APP_LAYER_FRAMES_H__
 
-#include "app-layer-events.h"
-#include "detect-engine-state.h"
-#include "util-file.h"
-#include "stream-tcp-private.h"
 #include "rust.h"
-#include "app-layer-parser.h"
 
 typedef int64_t FrameId;
 
diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c
index 6b3bc5c112af..6231ea514a81 100644
--- a/src/app-layer-ftp.c
+++ b/src/app-layer-ftp.c
@@ -48,6 +48,7 @@
 #include "app-layer-parser.h"
 #include "app-layer-ftp.h"
 #include "app-layer-expectation.h"
+#include "app-layer-detect-proto.h"
 
 #include "util-spm.h"
 #include "util-mpm.h"
diff --git a/src/app-layer-htp-body.c b/src/app-layer-htp-body.c
index 524aed3578e1..7e645f32fbbb 100644
--- a/src/app-layer-htp-body.c
+++ b/src/app-layer-htp-body.c
@@ -45,6 +45,7 @@
 #include "app-layer-parser.h"
 #include "app-layer-htp.h"
 #include "app-layer-htp-body.h"
+#include "app-layer-htp-mem.h"
 
 #include "util-spm.h"
 #include "util-debug.h"
diff --git a/src/app-layer-htp-file.c b/src/app-layer-htp-file.c
index 5d4ef9add899..8a79d9840cf9 100644
--- a/src/app-layer-htp-file.c
+++ b/src/app-layer-htp-file.c
@@ -45,6 +45,7 @@
 #include "app-layer-parser.h"
 #include "app-layer-htp.h"
 #include "app-layer-htp-file.h"
+#include "app-layer-htp-range.h"
 
 #include "util-spm.h"
 #include "util-debug.h"
diff --git a/src/app-layer-htp-libhtp.h b/src/app-layer-htp-libhtp.h
index 8f321152a2f2..c4a3c991f74b 100644
--- a/src/app-layer-htp-libhtp.h
+++ b/src/app-layer-htp-libhtp.h
@@ -42,7 +42,6 @@
 #ifndef __APP_LAYER_HTP_LIBHTP__H__
 #define __APP_LAYER_HTP_LIBHTP__H__
 
-#include "suricata.h"
 #include "suricata-common.h"
 
 bstr *SCHTPGenerateNormalizedUri(htp_tx_t *tx, htp_uri_t *uri, int uri_include_all);
diff --git a/src/app-layer-htp-mem.h b/src/app-layer-htp-mem.h
index 414b48821a74..5df67f824d87 100644
--- a/src/app-layer-htp-mem.h
+++ b/src/app-layer-htp-mem.h
@@ -15,7 +15,6 @@
  * 02110-1301, USA.
  */
 
-#include "stream-tcp-reassemble.h"
 
 void HTPParseMemcap(void);
 void *HTPMalloc(size_t size);
diff --git a/src/app-layer-htp-range.h b/src/app-layer-htp-range.h
index cda202294d2d..1770510b05dc 100644
--- a/src/app-layer-htp-range.h
+++ b/src/app-layer-htp-range.h
@@ -19,10 +19,9 @@
 #define __APP_LAYER_HTP_RANGE_H__
 
 #include "suricata-common.h"
-#include "app-layer-parser.h"
 
 #include "util-thash.h"
-#include "rust-bindings.h"
+#include "rust.h"
 
 void HttpRangeContainersInit(void);
 void HttpRangeContainersDestroy(void);
diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 9f64a05c6a81..cfe1302bb854 100644
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -56,23 +56,28 @@
 #include "app-layer-parser.h"
 
 #include "app-layer.h"
+#include "app-layer-detect-proto.h"
 #include "app-layer-frames.h"
 #include "app-layer-htp.h"
 #include "app-layer-htp-body.h"
 #include "app-layer-htp-file.h"
 #include "app-layer-htp-libhtp.h"
 #include "app-layer-htp-xff.h"
+#include "app-layer-htp-range.h"
+#include "app-layer-htp-mem.h"
 
 #include "util-spm.h"
 #include "util-debug.h"
 #include "util-time.h"
 #include "util-misc.h"
+#include "util-enum.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "flow-util.h"
 
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 #include "detect-engine-state.h"
 #include "detect-parse.h"
 
diff --git a/src/app-layer-htp.h b/src/app-layer-htp.h
index 0891711a3ec6..7f2389213c5d 100644
--- a/src/app-layer-htp.h
+++ b/src/app-layer-htp.h
@@ -33,13 +33,10 @@
 #ifndef __APP_LAYER_HTP_H__
 #define __APP_LAYER_HTP_H__
 
-#include "util-radix-tree.h"
 #include "util-file.h"
-#include "app-layer-htp-mem.h"
-#include "detect-engine-state.h"
 #include "util-streaming-buffer.h"
-#include "app-layer-htp-range.h"
 #include "rust.h"
+#include "app-layer-frames.h"
 
 #include <htp/htp.h>
 
diff --git a/src/app-layer-modbus.c b/src/app-layer-modbus.c
index 26e9b1120656..0f608c9c0931 100644
--- a/src/app-layer-modbus.c
+++ b/src/app-layer-modbus.c
@@ -40,6 +40,7 @@
 
 #include "app-layer-parser.h"
 #include "app-layer-modbus.h"
+#include "detect-engine-build.h"
 
 void ModbusParserRegisterTests(void);
 
diff --git a/src/app-layer-nbss.h b/src/app-layer-nbss.h
deleted file mode 100644
index 7ae8f2b44d60..000000000000
--- a/src/app-layer-nbss.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Kirby Kuehl <kkuehl@gmail.com>
- */
-
-#ifndef __APP_LAYER_NBSS_H__
-#define __APP_LAYER_NBSS_H__
-
-#include "suricata-common.h"
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "flow.h"
-#include "stream.h"
-
-/*
- http://ubiqx.org/cifs/rfc-draft/rfc1002.html#s4.3
- All session packets are of the following general structure:
-
-                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |      TYPE     |     FLAGS     |            LENGTH             |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                                                               |
-   /               TRAILER (Packet Type Dependent)                 /
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-   The TYPE, FLAGS, and LENGTH fields are present in every session
-   packet.
-*/
-
-#define NBSS_SESSION_MESSAGE            0x00
-#define NBSS_SESSION_REQUEST            0x81
-#define NBSS_POSITIVE_SESSION_RESPONSE  0x82
-#define NBSS_NEGATIVE_SESSION_RESPONSE  0x83
-#define NBSS_RETARGET_SESSION_RESPONSE  0x84
-#define NBSS_SESSION_KEEP_ALIVE         0x85
-
-typedef struct NBSSHdr_ {
-	uint8_t type;
-	uint8_t flags;
-	uint32_t length;
-} NBSSHdr;
-
-#define NBSS_HDR_LEN 4
-
-#endif /* __APP_LAYER_NBSS_H__ */
diff --git a/src/app-layer-nfs-udp.c b/src/app-layer-nfs-udp.c
index 5bfddeb96364..b972803034c6 100644
--- a/src/app-layer-nfs-udp.c
+++ b/src/app-layer-nfs-udp.c
@@ -33,6 +33,7 @@
 #include "app-layer-parser.h"
 
 #include "app-layer-nfs-udp.h"
+#include "util-enum.h"
 
 #include "rust.h"
 
diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index 59a0c13aeac7..57e19a057e6c 100644
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -44,6 +44,7 @@
 #include "stream-tcp-reassemble.h"
 
 #include "app-layer.h"
+#include "app-layer-detect-proto.h"
 #include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-smb.h"
diff --git a/src/app-layer-parser.h b/src/app-layer-parser.h
index daeaa31431ec..e47051753262 100644
--- a/src/app-layer-parser.h
+++ b/src/app-layer-parser.h
@@ -26,10 +26,7 @@
 #define __APP_LAYER_PARSER_H__
 
 #include "app-layer-events.h"
-#include "app-layer-frames.h"
-#include "detect-engine-state.h"
 #include "util-file.h"
-#include "stream-tcp-private.h"
 #include "rust.h"
 #include "util-config.h"
 
diff --git a/src/app-layer-register.c b/src/app-layer-register.c
index 70649e7a8495..12fd2bb31c36 100644
--- a/src/app-layer-register.c
+++ b/src/app-layer-register.c
@@ -24,6 +24,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "stream.h"
 #include "conf.h"
 
diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c
index f5ab4ca13ba9..efc918df7be6 100644
--- a/src/app-layer-smtp.c
+++ b/src/app-layer-smtp.c
@@ -38,6 +38,7 @@
 #include "app-layer-parser.h"
 #include "app-layer-smtp.h"
 
+#include "util-enum.h"
 #include "util-mpm.h"
 #include "util-debug.h"
 #include "util-print.h"
@@ -49,6 +50,7 @@
 
 #include "detect-engine.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 #include "detect-parse.h"
 
 #include "decode-events.h"
diff --git a/src/app-layer-smtp.h b/src/app-layer-smtp.h
index 148b2a1b75af..af6550b560d9 100644
--- a/src/app-layer-smtp.h
+++ b/src/app-layer-smtp.h
@@ -24,9 +24,7 @@
 #ifndef __APP_LAYER_SMTP_H__
 #define __APP_LAYER_SMTP_H__
 
-#include "decode-events.h"
 #include "util-decode-mime.h"
-#include "queue.h"
 #include "util-streaming-buffer.h"
 #include "rust.h"
 
diff --git a/src/app-layer-ssh.c b/src/app-layer-ssh.c
index cfc1a0c06df1..c573c5b55dc1 100644
--- a/src/app-layer-ssh.c
+++ b/src/app-layer-ssh.c
@@ -38,6 +38,7 @@
 #include "stream-tcp.h"
 #include "stream.h"
 
+#include "app-layer-detect-proto.h"
 #include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-ssh.h"
diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c
index 6ccc1c94e50b..1cebb2bd2c16 100644
--- a/src/app-layer-ssl.c
+++ b/src/app-layer-ssl.c
@@ -35,6 +35,7 @@
 #include "stream.h"
 
 #include "app-layer.h"
+#include "app-layer-detect-proto.h"
 #include "app-layer-protos.h"
 #include "app-layer-parser.h"
 #include "app-layer-frames.h"
@@ -50,6 +51,7 @@
 #include "util-pool.h"
 #include "util-byte.h"
 #include "util-ja3.h"
+#include "util-enum.h"
 #include "flow-util.h"
 #include "flow-private.h"
 #include "util-validate.h"
diff --git a/src/app-layer-ssl.h b/src/app-layer-ssl.h
index d7e769e5b905..0a8c0db35c10 100644
--- a/src/app-layer-ssl.h
+++ b/src/app-layer-ssl.h
@@ -26,11 +26,8 @@
 #ifndef __APP_LAYER_SSL_H__
 #define __APP_LAYER_SSL_H__
 
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "decode-events.h"
 #include "util-ja3.h"
-#include "queue.h"
+#include "rust.h"
 
 enum TlsFrameTypes {
     TLS_FRAME_PDU = 0, /**< whole PDU, so header + data */
diff --git a/src/app-layer-template.c b/src/app-layer-template.c
index c28706f156a9..d53a0e6cf786 100644
--- a/src/app-layer-template.c
+++ b/src/app-layer-template.c
@@ -34,6 +34,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "stream.h"
 #include "conf.h"
 #include "app-layer.h"
@@ -43,6 +44,7 @@
 
 #include "util-unittest.h"
 #include "util-validate.h"
+#include "util-enum.h"
 
 /* The default port to probe for echo traffic if not provided in the
  * configuration file. */
diff --git a/src/app-layer-template.h b/src/app-layer-template.h
index 461a7e46db45..3c28278426e5 100644
--- a/src/app-layer-template.h
+++ b/src/app-layer-template.h
@@ -24,9 +24,7 @@
 #ifndef __APP_LAYER_TEMPLATE_H__
 #define __APP_LAYER_TEMPLATE_H__
 
-#include "detect-engine-state.h"
 
-#include "queue.h"
 
 #include "rust.h"
 
diff --git a/src/app-layer-tftp.c b/src/app-layer-tftp.c
index 7c8ea7cce663..37b1846bbbb9 100644
--- a/src/app-layer-tftp.c
+++ b/src/app-layer-tftp.c
@@ -26,6 +26,7 @@
 
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "stream.h"
 #include "conf.h"
 
diff --git a/src/app-layer.h b/src/app-layer.h
index 27532dc8b40c..6a8889640cb5 100644
--- a/src/app-layer.h
+++ b/src/app-layer.h
@@ -29,9 +29,7 @@
 
 #include "stream-tcp-private.h"
 #include "stream-tcp-reassemble.h"
-#include "stream.h"
 
-#include "util-profiling.h"
 
 #include "rust.h"
 
diff --git a/src/decode-erspan.h b/src/decode-erspan.h
index 5b4af04ea89a..d92965db027f 100644
--- a/src/decode-erspan.h
+++ b/src/decode-erspan.h
@@ -25,8 +25,6 @@
 #ifndef __DECODE_ERSPAN_H__
 #define __DECODE_ERSPAN_H__
 
-#include "decode.h"
-#include "threadvars.h"
 
 typedef struct ErspanHdr_ {
     uint16_t ver_vlan;
diff --git a/src/decode-gre.h b/src/decode-gre.h
index 8cec9207f5a8..adf576fbd980 100644
--- a/src/decode-gre.h
+++ b/src/decode-gre.h
@@ -30,8 +30,6 @@
 #define IPPROTO_GRE 47
 #endif
 
-#include "decode.h"
-#include "threadvars.h"
 
 typedef struct GREHdr_
 {
diff --git a/src/decode-icmpv4.h b/src/decode-icmpv4.h
index ed24fce06665..f3a94ad2e594 100644
--- a/src/decode-icmpv4.h
+++ b/src/decode-icmpv4.h
@@ -24,9 +24,7 @@
 #ifndef __DECODE_ICMPV4_H__
 #define __DECODE_ICMPV4_H__
 
-#include "decode.h"
 #include "decode-tcp.h"
-#include "decode-sctp.h"
 #include "decode-udp.h"
 
 #define ICMPV4_HEADER_LEN       8
diff --git a/src/decode-icmpv6.h b/src/decode-icmpv6.h
index 3b836499b5d3..aa66c1f64a3e 100644
--- a/src/decode-icmpv6.h
+++ b/src/decode-icmpv6.h
@@ -25,7 +25,6 @@
 #define __DECODE_ICMPV6_H__
 
 #include "decode-tcp.h"
-#include "decode-sctp.h"
 #include "decode-udp.h"
 #include "decode-ipv6.h"
 
diff --git a/src/decode-nsh.h b/src/decode-nsh.h
index e9c6af065be9..a45cce3029e0 100644
--- a/src/decode-nsh.h
+++ b/src/decode-nsh.h
@@ -25,8 +25,6 @@
 #ifndef __DECODE_NSH_H__
 #define __DECODE_NSH_H__
 
-#include "decode.h"
-#include "threadvars.h"
 
 #define NSH_NEXT_PROTO_UNASSIGNED  0x0
 #define NSH_NEXT_PROTO_IPV4        0x1
diff --git a/src/decode-null.c b/src/decode-null.c
index efb4adf29b36..dc7051edc3f6 100644
--- a/src/decode-null.c
+++ b/src/decode-null.c
@@ -103,18 +103,6 @@ int DecodeNull(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
     return TM_ECODE_OK;
 }
 
-#ifdef UNITTESTS
-
-#endif /* UNITTESTS */
-
-/**
- * \brief Registers Null unit tests
- */
-void DecodeNullRegisterTests(void)
-{
-#ifdef UNITTESTS
-#endif /* UNITTESTS */
-}
 /**
  * @}
  */
diff --git a/src/decode-null.h b/src/decode-null.h
deleted file mode 100644
index 22d988c72481..000000000000
--- a/src/decode-null.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Victor Julien <victor@inliniac.net>
- */
-
-#ifndef __DECODE_NULL_H__
-#define __DECODE_NULL_H__
-void DecodeNullRegisterTests(void);
-#endif /* __DECODE_NULL_H__ */
diff --git a/src/decode-pppoe.h b/src/decode-pppoe.h
index 44550ad1122e..836d4a30c350 100644
--- a/src/decode-pppoe.h
+++ b/src/decode-pppoe.h
@@ -24,8 +24,6 @@
 #ifndef __DECODE_PPPOE_H__
 #define __DECODE_PPPOE_H__
 
-#include "decode.h"
-#include "threadvars.h"
 
 // Session header length minus the protocol field
 #define PPPOE_SESSION_HEADER_MIN_LEN     7
diff --git a/src/decode-template.h b/src/decode-template.h
index 5ee42e8cfe14..9ce0be415fb8 100644
--- a/src/decode-template.h
+++ b/src/decode-template.h
@@ -25,8 +25,6 @@
 #ifndef __DECODE_TEMPLATE_H__
 #define __DECODE_TEMPLATE_H__
 
-#include "decode.h"
-#include "threadvars.h"
 
 /* Header layout. Keep things like alignment and endianess in
  * mind while constructing this. */
diff --git a/src/decode.c b/src/decode.c
index 3f6a3a674bd3..df0c6ab37bbe 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -52,6 +52,9 @@
 #include "conf.h"
 #include "decode.h"
 #include "decode-teredo.h"
+#include "decode-erspan.h"
+#include "decode-geneve.h"
+#include "decode-vxlan.h"
 #include "util-debug.h"
 #include "util-mem.h"
 #include "app-layer-detect-proto.h"
diff --git a/src/decode.h b/src/decode.h
index 010c3ad62968..cc8ee21d84dc 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -32,7 +32,10 @@
 #include "threadvars.h"
 #include "util-debug.h"
 #include "decode-events.h"
+#ifdef PROFILING
 #include "flow-worker.h"
+#include "app-layer-protos.h"
+#endif
 
 #ifdef HAVE_NAPATECH
 #include "util-napatech.h"
@@ -78,14 +81,10 @@ enum PktSrcEnum {
 
 #include "action-globals.h"
 
-#include "decode-erspan.h"
 #include "decode-ethernet.h"
-#include "decode-chdlc.h"
 #include "decode-gre.h"
-#include "decode-geneve.h"
 #include "decode-ppp.h"
 #include "decode-pppoe.h"
-#include "decode-sll.h"
 #include "decode-ipv4.h"
 #include "decode-ipv6.h"
 #include "decode-icmpv4.h"
@@ -94,17 +93,9 @@ enum PktSrcEnum {
 #include "decode-udp.h"
 #include "decode-sctp.h"
 #include "decode-esp.h"
-#include "decode-raw.h"
-#include "decode-null.h"
 #include "decode-vlan.h"
-#include "decode-vntag.h"
-#include "decode-vxlan.h"
 #include "decode-mpls.h"
-#include "decode-nsh.h"
 
-#include "detect-reference.h"
-
-#include "app-layer-protos.h"
 
 /* forward declarations */
 struct DetectionEngineThreadCtx_;
diff --git a/src/defrag.h b/src/defrag.h
index 856e0d41f41e..fe452dec32e9 100644
--- a/src/defrag.h
+++ b/src/defrag.h
@@ -24,7 +24,6 @@
 #ifndef __DEFRAG_H__
 #define __DEFRAG_H__
 
-#include "tree.h"
 #include "util-pool.h"
 
 /**
diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c
index a581812e2114..bfa1c1323d5a 100644
--- a/src/detect-app-layer-event.c
+++ b/src/detect-app-layer-event.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2020 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -33,6 +33,7 @@
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 #include "detect-app-layer-event.h"
 
 #include "flow.h"
@@ -42,12 +43,25 @@
 #include "decode-events.h"
 #include "util-byte.h"
 #include "util-debug.h"
+#include "util-enum.h"
+#include "util-profiling.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "stream-tcp-util.h"
 
 #define MAX_ALPROTO_NAME 50
 
+typedef struct DetectAppLayerEventData_ {
+    AppProto alproto;
+    uint8_t event_id;
+
+    /* it's used to check if there are event set into the detect engine */
+    bool needs_detctx;
+
+    char *arg;
+} DetectAppLayerEventData;
+
+
 static int DetectAppLayerEventPktMatch(DetectEngineThreadCtx *det_ctx,
                                        Packet *p, const Signature *s, const SigMatchCtx *ctx);
 static int DetectAppLayerEventSetupP1(DetectEngineCtx *, Signature *, const char *);
diff --git a/src/detect-app-layer-event.h b/src/detect-app-layer-event.h
index 8db6eaa7efda..28580c60d072 100644
--- a/src/detect-app-layer-event.h
+++ b/src/detect-app-layer-event.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -24,16 +24,6 @@
 #ifndef __DETECT_APP_LAYER_EVENT_H__
 #define __DETECT_APP_LAYER_EVENT_H__
 
-typedef struct DetectAppLayerEventData_ {
-    AppProto alproto;
-    uint8_t event_id;
-
-    /* it's used to check if there are event set into the detect engine */
-    bool needs_detctx;
-
-    char *arg;
-} DetectAppLayerEventData;
-
 int DetectAppLayerEventPrepare(DetectEngineCtx *de_ctx, Signature *s);
 void DetectAppLayerEventRegister(void);
 
diff --git a/src/detect-app-layer-protocol.c b/src/detect-app-layer-protocol.c
index b99e8ecf34f8..0673eaac09de 100644
--- a/src/detect-app-layer-protocol.c
+++ b/src/detect-app-layer-protocol.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2013 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -23,6 +23,7 @@
 
 #include "suricata-common.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-parse.h"
@@ -37,6 +38,11 @@
 static void DetectAppLayerProtocolRegisterTests(void);
 #endif
 
+typedef struct DetectAppLayerProtocolData_ {
+    AppProto alproto;
+    uint8_t negated;
+} DetectAppLayerProtocolData;
+
 static int DetectAppLayerProtocolPacketMatch(
         DetectEngineThreadCtx *det_ctx,
         Packet *p, const Signature *s, const SigMatchCtx *ctx)
diff --git a/src/detect-app-layer-protocol.h b/src/detect-app-layer-protocol.h
index 616c4f2a5673..864bd671b266 100644
--- a/src/detect-app-layer-protocol.h
+++ b/src/detect-app-layer-protocol.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2013 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -24,11 +24,6 @@
 #ifndef __DETECT_APP_LAYER_PROTOCOL__H__
 #define __DETECT_APP_LAYER_PROTOCOL__H__
 
-typedef struct DetectAppLayerProtocolData_ {
-    AppProto alproto;
-    uint8_t negated;
-} DetectAppLayerProtocolData;
-
 void DetectAppLayerProtocolRegister(void);
 
 #endif /* __DETECT_APP_LAYER_PROTOCOL__H__ */
diff --git a/src/detect-asn1.c b/src/detect-asn1.c
index a8fb59389092..716d7bda222e 100644
--- a/src/detect-asn1.c
+++ b/src/detect-asn1.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2020 Open Information Security Foundation
+/* Copyright (C) 2020-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
diff --git a/src/detect-asn1.h b/src/detect-asn1.h
index eda36d4c2a38..a7b67340aa27 100644
--- a/src/detect-asn1.h
+++ b/src/detect-asn1.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2020 Open Information Security Foundation
+/* Copyright (C) 2020-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
diff --git a/src/detect-base64-data.c b/src/detect-base64-data.c
index d8df651e9298..b69dcdbb5b83 100644
--- a/src/detect-base64-data.c
+++ b/src/detect-base64-data.c
@@ -21,6 +21,7 @@
 #include "detect-engine-content-inspection.h"
 #include "detect-parse.h"
 #include "detect-base64-data.h"
+#include "detect-engine-build.h"
 
 #include "util-unittest.h"
 
diff --git a/src/detect-base64-decode.c b/src/detect-base64-decode.c
index d82d2da507bf..1fe49047933e 100644
--- a/src/detect-base64-decode.c
+++ b/src/detect-base64-decode.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2020 Open Information Security Foundation
+/* Copyright (C) 2020-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -22,10 +22,17 @@
 #include "util-base64.h"
 #include "util-byte.h"
 #include "util-print.h"
+#include "detect-engine-build.h"
 
 /* Arbitrary maximum buffer size for decoded base64 data. */
 #define BASE64_DECODE_MAX 65535
 
+typedef struct DetectBase64Decode_ {
+    uint32_t bytes;
+    uint32_t offset;
+    uint8_t relative;
+} DetectBase64Decode;
+
 static const char decode_pattern[] = "\\s*(bytes\\s+(\\d+),?)?"
     "\\s*(offset\\s+(\\d+),?)?"
     "\\s*(\\w+)?";
diff --git a/src/detect-base64-decode.h b/src/detect-base64-decode.h
index e8a117c215b2..58f4e526884c 100644
--- a/src/detect-base64-decode.h
+++ b/src/detect-base64-decode.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2015 Open Information Security Foundation
+/* Copyright (C) 2015-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -18,14 +18,6 @@
 #ifndef __DETECT_BASE64_DECODE_H__
 #define __DETECT_BASE64_DECODE_H__
 
-#include "app-layer-template.h"
-
-typedef struct DetectBase64Decode_ {
-    uint32_t bytes;
-    uint32_t offset;
-    uint8_t relative;
-} DetectBase64Decode;
-
 void DetectBase64DecodeRegister(void);
 int DetectBase64DecodeDoMatch(DetectEngineThreadCtx *, const Signature *,
     const SigMatchData *, const uint8_t *, uint32_t);
diff --git a/src/detect-byte-extract.c b/src/detect-byte-extract.c
index b96c43b225e8..e4e07952c489 100644
--- a/src/detect-byte-extract.c
+++ b/src/detect-byte-extract.c
@@ -36,6 +36,7 @@
 #include "detect-bytetest.h"
 #include "detect-byte-extract.h"
 #include "detect-isdataat.h"
+#include "detect-engine-build.h"
 
 #include "app-layer-protos.h"
 
diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c
index 02072bab57f6..9ca8da411f44 100644
--- a/src/detect-bytejump.c
+++ b/src/detect-bytejump.c
@@ -42,6 +42,7 @@
 #include "util-debug.h"
 #include "util-validate.h"
 #include "detect-pcre.h"
+#include "detect-engine-build.h"
 
 /**
  * \brief Regex for parsing our options
diff --git a/src/detect-bytemath.c b/src/detect-bytemath.c
index 316a4e0413cc..649b5dc09588 100644
--- a/src/detect-bytemath.c
+++ b/src/detect-bytemath.c
@@ -39,6 +39,7 @@
 #include "detect-byte.h"
 #include "detect-bytemath.h"
 #include "detect-isdataat.h"
+#include "detect-engine-build.h"
 
 #include "app-layer-protos.h"
 
diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c
index e84822d4e236..71506fd4eeb7 100644
--- a/src/detect-bytetest.c
+++ b/src/detect-bytetest.c
@@ -30,6 +30,7 @@
 #include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
+#include "detect-engine-build.h"
 
 #include "detect-content.h"
 #include "detect-uricontent.h"
diff --git a/src/detect-cipservice.h b/src/detect-cipservice.h
index fc6c5aaf7004..0f98b6ba550c 100644
--- a/src/detect-cipservice.h
+++ b/src/detect-cipservice.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2015 Open Information Security Foundation
+/* Copyright (C) 2015-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -24,14 +24,8 @@
 #ifndef _DETECT_CIPSERVICE_H
 #define	_DETECT_CIPSERVICE_H
 
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "flow.h"
-#include "queue.h"
 #include "app-layer-enip-common.h"
 
-#define ENIP_PORT 44818 //standard EtherNet/IP port
-
 /**
  * CIP Service rule data structure
  */
@@ -76,20 +70,4 @@ typedef struct CIPServiceData_
     struct CIPServiceData* next;
 } CIPServiceData;
 
-/**
- * ENIP data structure
- */
-typedef struct ENIPData_
-{
-    int direction;
-    ENIPEncapHdr header; //encapsulation header
-    ENIPEncapDataHdr encap_data_header; //encapsulation data header
-    ENIPEncapAddresItem encap_addr_item; //encapsulated address item
-    ENIPEncapDataItem encap_data_item; //encapsulated data item
-
-    CIPServiceData* service_head; //head of cip service data list
-    CIPServiceData* service_tail; //tail of cip service data list
-
-} ENIPData;
-
 #endif	/* _DETECT_CIPSERVICE_H */
diff --git a/src/detect-content.c b/src/detect-content.c
index b457a83a992b..d3c7935e116b 100644
--- a/src/detect-content.c
+++ b/src/detect-content.c
@@ -30,6 +30,7 @@
 #include "detect-uricontent.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 #include "detect-engine-state.h"
 #include "detect-parse.h"
 #include "detect-pcre.h"
diff --git a/src/detect-csum.c b/src/detect-csum.c
index ed4e58d854d9..03a3133b3a36 100644
--- a/src/detect-csum.c
+++ b/src/detect-csum.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2013 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -38,6 +38,16 @@
 #include "pkt-var.h"
 #include "host.h"
 #include "util-profiling.h"
+#include "detect-engine-build.h"
+
+#define DETECT_CSUM_VALID "valid"
+#define DETECT_CSUM_INVALID "invalid"
+
+typedef struct DetectCsumData_ {
+    /* Indicates if the csum-<protocol> keyword in a rule holds the
+       keyvalue "valid" or "invalid" */
+    int16_t valid;
+} DetectCsumData;
 
 /* prototypes for the "ipv4-csum" rule keyword */
 static int DetectIPV4CsumMatch(DetectEngineThreadCtx *,
diff --git a/src/detect-csum.h b/src/detect-csum.h
index 8a871745b24b..64914912fe8f 100644
--- a/src/detect-csum.h
+++ b/src/detect-csum.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -24,15 +24,6 @@
 #ifndef __DETECT_CSUM_H__
 #define __DETECT_CSUM_H__
 
-#define DETECT_CSUM_VALID "valid"
-#define DETECT_CSUM_INVALID "invalid"
-
-typedef struct DetectCsumData_ {
-    /* Indicates if the csum-<protocol> keyword in a rule holds the
-       keyvalue "valid" or "invalid" */
-    int16_t valid;
-} DetectCsumData;
-
 void DetectCsumRegister(void);
 
 #endif /* __DETECT_CSUM_H__ */
diff --git a/src/detect-dce-iface.c b/src/detect-dce-iface.c
index 6f28f3309fb3..431c1925f538 100644
--- a/src/detect-dce-iface.c
+++ b/src/detect-dce-iface.c
@@ -31,6 +31,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 #include "detect-dce-iface.h"
 
 #include "flow.h"
diff --git a/src/detect-dce-iface.h b/src/detect-dce-iface.h
index 0cbbb728f71d..edaded404442 100644
--- a/src/detect-dce-iface.h
+++ b/src/detect-dce-iface.h
@@ -18,7 +18,6 @@
 #ifndef __DETECT_DCE_IFACE_H__
 #define __DETECT_DCE_IFACE_H__
 
-#include "app-layer-dcerpc-common.h"
 
 void DetectDceIfaceRegister(void);
 
diff --git a/src/detect-dce-opnum.c b/src/detect-dce-opnum.c
index 09ea401bdae7..6b91cefa85b4 100644
--- a/src/detect-dce-opnum.c
+++ b/src/detect-dce-opnum.c
@@ -31,6 +31,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "flow.h"
 #include "flow-var.h"
diff --git a/src/detect-dce-opnum.h b/src/detect-dce-opnum.h
index 5f3db11802e8..1072a60bba62 100644
--- a/src/detect-dce-opnum.h
+++ b/src/detect-dce-opnum.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_DCE_OPNUM_H__
 #define __DETECT_DCE_OPNUM_H__
 
-#include "app-layer-dcerpc-common.h"
 
 void DetectDceOpnumRegister(void);
 
diff --git a/src/detect-dce-stub-data.c b/src/detect-dce-stub-data.c
index c87ca9d078e6..411009d320a7 100644
--- a/src/detect-dce-stub-data.c
+++ b/src/detect-dce-stub-data.c
@@ -30,6 +30,7 @@
 #include "detect-parse.h"
 
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
@@ -40,6 +41,7 @@
 #include "flow-util.h"
 
 #include "app-layer.h"
+#include "app-layer-parser.h"
 #include "queue.h"
 #include "stream-tcp-reassemble.h"
 
diff --git a/src/detect-dce-stub-data.h b/src/detect-dce-stub-data.h
index 13de6ff56a80..035fa258a558 100644
--- a/src/detect-dce-stub-data.h
+++ b/src/detect-dce-stub-data.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_DCE_STUB_DATA_H__
 #define __DETECT_DCE_STUB_DATA_H__
 
-#include "app-layer-dcerpc-common.h"
 
 void DetectDceStubDataRegister(void);
 
diff --git a/src/detect-detection-filter.c b/src/detect-detection-filter.c
index 557f72b89ba5..61198bcbabbe 100644
--- a/src/detect-detection-filter.c
+++ b/src/detect-detection-filter.c
@@ -39,6 +39,7 @@
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-debug.h"
+#include "detect-engine-build.h"
 
 #define TRACK_DST      1
 #define TRACK_SRC      2
diff --git a/src/detect-dnp3.c b/src/detect-dnp3.c
index ee73ebf89f2f..042dc058ebd5 100644
--- a/src/detect-dnp3.c
+++ b/src/detect-dnp3.c
@@ -28,6 +28,7 @@
 #include "detect-engine-content-inspection.h"
 
 #include "app-layer-dnp3.h"
+#include "util-byte.h"
 
 static int g_dnp3_match_buffer_id = 0;
 static int g_dnp3_data_buffer_id = 0;
diff --git a/src/detect-dns-query.c b/src/detect-dns-query.c
index 8faa935fe4bd..10cd19b00856 100644
--- a/src/detect-dns-query.c
+++ b/src/detect-dns-query.c
@@ -36,6 +36,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-dsize.c b/src/detect-dsize.c
index b2e84c063583..8702f9949314 100644
--- a/src/detect-dsize.c
+++ b/src/detect-dsize.c
@@ -29,6 +29,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
 
 #include "flow-var.h"
 
diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index 103bbc8f713b..8376286612a5 100644
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -38,6 +38,7 @@
 #include "detect-tcp-flags.h"
 #include "feature.h"
 #include "util-print.h"
+#include "util-time.h"
 #include "util-validate.h"
 
 static int rule_warnings_only = 0;
diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index b9fb4ca6c79d..5458ec4a26bb 100644
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -19,7 +19,9 @@
 #include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
+#include "detect-content.h"
 
+#include "detect-engine-build.h"
 #include "detect-engine-address.h"
 #include "detect-engine-analyzer.h"
 #include "detect-engine-iponly.h"
@@ -38,6 +40,7 @@
 
 #include "util-profiling.h"
 #include "util-validate.h"
+#include "util-var-name.h"
 
 void SigCleanSignatures(DetectEngineCtx *de_ctx)
 {
diff --git a/src/detect-engine-dcepayload.c b/src/detect-engine-dcepayload.c
index a44fb75e4275..1e865ced25f2 100644
--- a/src/detect-engine-dcepayload.c
+++ b/src/detect-engine-dcepayload.c
@@ -37,6 +37,8 @@
 #include "detect-content.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-engine-dcepayload.h"
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
 
 #include "stream-tcp.h"
 
diff --git a/src/detect-engine-event.h b/src/detect-engine-event.h
index 3f52753bc546..178af0472ffb 100644
--- a/src/detect-engine-event.h
+++ b/src/detect-engine-event.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_ENGINE_EVENT_H__
 #define __DETECT_ENGINE_EVENT_H__
 
-#include "decode-events.h"
 
 typedef struct DetectEngineEventData_ {
     uint8_t event;
diff --git a/src/detect-engine-iponly.c b/src/detect-engine-iponly.c
index 29c98cc80237..e6bbbca36576 100644
--- a/src/detect-engine-iponly.c
+++ b/src/detect-engine-iponly.c
@@ -41,6 +41,7 @@
 #include "detect-engine-proto.h"
 #include "detect-engine-port.h"
 #include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
 
 #include "detect-engine-threshold.h"
 #include "detect-engine-iponly.h"
diff --git a/src/detect-engine-loader.c b/src/detect-engine-loader.c
index f6c6b74739b5..1ae1a5e28cd8 100644
--- a/src/detect-engine-loader.c
+++ b/src/detect-engine-loader.c
@@ -36,6 +36,7 @@
 #include "util-signal.h"
 
 #include "detect-engine-loader.h"
+#include "detect-engine-build.h"
 #include "detect-engine-analyzer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-sigorder.h"
diff --git a/src/detect-engine-mpm.h b/src/detect-engine-mpm.h
index 2aa2e1a66664..15746ae34103 100644
--- a/src/detect-engine-mpm.h
+++ b/src/detect-engine-mpm.h
@@ -24,13 +24,9 @@
 #ifndef __DETECT_ENGINE_MPM_H__
 #define __DETECT_ENGINE_MPM_H__
 
-#include "tm-threads.h"
 
 #include "detect.h"
-#include "detect-content.h"
-#include "detect-uricontent.h"
 
-#include "stream.h"
 
 void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx);
 int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx);
diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c
index 110ac6c26faa..a0d4aea98108 100644
--- a/src/detect-engine-payload.c
+++ b/src/detect-engine-payload.c
@@ -36,6 +36,7 @@
 #include "detect-engine-prefilter.h"
 #include "detect-engine-state.h"
 #include "detect-engine-payload.h"
+#include "detect-engine-build.h"
 
 #include "stream.h"
 #include "stream-tcp.h"
diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c
index d473fb06c1cf..e0d8eefa6173 100644
--- a/src/detect-engine-register.c
+++ b/src/detect-engine-register.c
@@ -65,6 +65,7 @@
 #include "detect-http-ua.h"
 #include "detect-http-host.h"
 
+#include "detect-mark.h"
 #include "detect-nfs-procedure.h"
 #include "detect-nfs-version.h"
 
diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c
index b9e00f777ebe..7a895104f276 100644
--- a/src/detect-engine-siggroup.c
+++ b/src/detect-engine-siggroup.c
@@ -33,6 +33,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 #include "detect-engine-address.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-siggroup.h"
diff --git a/src/detect-engine-sigorder.c b/src/detect-engine-sigorder.c
index 469af1f60b82..53ac1fdbe51a 100644
--- a/src/detect-engine-sigorder.c
+++ b/src/detect-engine-sigorder.c
@@ -31,6 +31,7 @@
 #include "detect-parse.h"
 #include "detect-engine-sigorder.h"
 #include "detect-pcre.h"
+#include "detect-engine-build.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
diff --git a/src/detect-engine-state.c b/src/detect-engine-state.c
index e18ade0f1fb5..9d55d8abfaa8 100644
--- a/src/detect-engine-state.c
+++ b/src/detect-engine-state.c
@@ -45,6 +45,7 @@
 #include "detect-parse.h"
 #include "detect-engine-state.h"
 #include "detect-engine-dcepayload.h"
+#include "detect-engine-build.h"
 
 #include "detect-flowvar.h"
 
diff --git a/src/detect-engine-tag.c b/src/detect-engine-tag.c
index 66409d17bdc9..d445560f3914 100644
--- a/src/detect-engine-tag.c
+++ b/src/detect-engine-tag.c
@@ -32,6 +32,7 @@
 #include "util-time.h"
 #include "util-hashlist.h"
 #include "detect-engine-tag.h"
+#include "detect-engine-build.h"
 #include "detect-tag.h"
 #include "host.h"
 #include "host-storage.h"
diff --git a/src/detect-engine-tag.h b/src/detect-engine-tag.h
index 93243cef1ed0..19ddaa121b21 100644
--- a/src/detect-engine-tag.h
+++ b/src/detect-engine-tag.h
@@ -29,6 +29,7 @@
 
 #include "host.h"
 #include "detect.h"
+#include "detect-tag.h"
 
 /* This limit should be overwriten/predefined at the config file
  * to limit the options to prevent possible DOS situations. We should also
diff --git a/src/detect-engine.c b/src/detect-engine.c
index 2189721f79cc..81250cc758a1 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -39,6 +39,7 @@
 #include "detect-parse.h"
 #include "detect-engine-sigorder.h"
 
+#include "detect-engine-build.h"
 #include "detect-engine-siggroup.h"
 #include "detect-engine-address.h"
 #include "detect-engine-port.h"
@@ -46,6 +47,7 @@
 #include "detect-engine-mpm.h"
 #include "detect-engine-iponly.h"
 #include "detect-engine-tag.h"
+#include "detect-engine-frame.h"
 
 #include "detect-engine-file.h"
 
@@ -79,6 +81,7 @@
 #include "util-profiling.h"
 #include "util-validate.h"
 #include "util-hash-string.h"
+#include "util-enum.h"
 
 #include "tm-threads.h"
 #include "runmodes.h"
@@ -3237,6 +3240,8 @@ DetectEngineThreadCtx *DetectEngineThreadCtxInitForReload(
 
     /** alert counter setup */
     det_ctx->counter_alerts = StatsRegisterCounter("detect.alert", tv);
+    det_ctx->counter_alerts_overflow = StatsRegisterCounter("detect.alert_queue_overflow", tv);
+    det_ctx->counter_alerts_suppressed = StatsRegisterCounter("detect.alerts_suppressed", tv);
 #ifdef PROFILING
     uint16_t counter_mpm_list = StatsRegisterAvgCounter("detect.mpm_list", tv);
     uint16_t counter_nonmpm_list = StatsRegisterAvgCounter("detect.nonmpm_list", tv);
diff --git a/src/detect-engine.h b/src/detect-engine.h
index a55b140d956f..ab1e05ce954b 100644
--- a/src/detect-engine.h
+++ b/src/detect-engine.h
@@ -25,10 +25,7 @@
 #define __DETECT_ENGINE_H__
 
 #include "detect.h"
-#include "tm-threads.h"
-#include "flow-private.h"
-
-#include "detect-engine-frame.h"
+#include "suricata.h"
 
 void InspectionBufferInit(InspectionBuffer *buffer, uint32_t initial_size);
 void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id,
diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c
index f6302af6ecb7..373682bf0028 100644
--- a/src/detect-fast-pattern.c
+++ b/src/detect-fast-pattern.c
@@ -30,6 +30,7 @@
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
 #include "detect-fast-pattern.h"
 
 #include "util-error.h"
diff --git a/src/detect-fileext.c b/src/detect-fileext.c
index 2ddd55ccc85f..b2be82d7e004 100644
--- a/src/detect-fileext.c
+++ b/src/detect-fileext.c
@@ -30,6 +30,7 @@
 
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-fileext.h b/src/detect-fileext.h
index 4981763bba4f..f202fca0eeb7 100644
--- a/src/detect-fileext.h
+++ b/src/detect-fileext.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_FILEEXT_H__
 #define __DETECT_FILEEXT_H__
 
-#include "util-spm-bm.h"
 
 typedef struct DetectFileextData_ {
     uint8_t *ext;  /** file extension to match */
diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 8b40f06ab49f..502383b39ee2 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -29,6 +29,7 @@
 
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-filename.c b/src/detect-filename.c
index 382881034eb6..5dda5db58042 100644
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -30,6 +30,7 @@
 
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-filesize.c b/src/detect-filesize.c
index 044dc8bbfe2c..50e84671fe62 100644
--- a/src/detect-filesize.c
+++ b/src/detect-filesize.c
@@ -35,6 +35,7 @@
 #include "detect-engine.h"
 #include "detect-engine-state.h"
 #include "detect-engine-uint.h"
+#include "detect-engine-build.h"
 
 #include "detect-filesize.h"
 #include "util-debug.h"
diff --git a/src/detect-flow.c b/src/detect-flow.c
index 897d5d3ac3ce..e6bcab26addf 100644
--- a/src/detect-flow.c
+++ b/src/detect-flow.c
@@ -31,6 +31,7 @@
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
 
 #include "flow.h"
 #include "flow-var.h"
diff --git a/src/detect-flowbits.c b/src/detect-flowbits.c
index 92944574684e..c7516f765261 100644
--- a/src/detect-flowbits.c
+++ b/src/detect-flowbits.c
@@ -40,6 +40,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "util-var-name.h"
 #include "util-unittest.h"
diff --git a/src/detect-flowint.c b/src/detect-flowint.c
index ad80c122c186..631fafc10618 100644
--- a/src/detect-flowint.c
+++ b/src/detect-flowint.c
@@ -41,6 +41,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-sigorder.h"
+#include "detect-engine-build.h"
 
 #include "pkt-var.h"
 #include "host.h"
diff --git a/src/detect-flowvar.c b/src/detect-flowvar.c
index 751e48ac7265..c997276beafd 100644
--- a/src/detect-flowvar.c
+++ b/src/detect-flowvar.c
@@ -40,6 +40,7 @@
 #include "util-var-name.h"
 #include "util-debug.h"
 #include "util-print.h"
+#include "util-spm.h"
 
 #define PARSE_REGEX         "(.*),(.*)"
 static DetectParseRegex parse_regex;
diff --git a/src/detect-fragbits.h b/src/detect-fragbits.h
index e2d77cc29b14..1ab6cae310e3 100644
--- a/src/detect-fragbits.h
+++ b/src/detect-fragbits.h
@@ -24,9 +24,6 @@
 #ifndef __DETECT_FRAGBITS_H__
 #define __DETECT_FRAGBITS_H__
 
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
 
 /**
  * \struct DetectFragBitsData_
diff --git a/src/detect-fragoffset.c b/src/detect-fragoffset.c
index f2f1eb2d4223..c3e4268bf8b7 100644
--- a/src/detect-fragoffset.c
+++ b/src/detect-fragoffset.c
@@ -32,6 +32,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
 
 #include "detect-fragoffset.h"
 
diff --git a/src/detect-ftpbounce.c b/src/detect-ftpbounce.c
index 3f556cedaa12..cf74dd59f5f8 100644
--- a/src/detect-ftpbounce.c
+++ b/src/detect-ftpbounce.c
@@ -32,6 +32,7 @@
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-content.h"
+#include "detect-engine-build.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
diff --git a/src/detect-ftpdata.h b/src/detect-ftpdata.h
index 0f03ee1c9727..aa16215973c9 100644
--- a/src/detect-ftpdata.h
+++ b/src/detect-ftpdata.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_FTPDATA_H__
 #define __DETECT_FTPDATA_H__
 
-#include "detect-engine.h"
 #include "app-layer-ftp.h"
 
 /** Per keyword data. This is set up by the DetectFtpcommandSetup() function.
diff --git a/src/detect-geoip.h b/src/detect-geoip.h
index 24ba075734d0..4ec97b5df868 100644
--- a/src/detect-geoip.h
+++ b/src/detect-geoip.h
@@ -28,7 +28,6 @@
 #ifdef HAVE_GEOIP
 
 #include <maxminddb.h>
-#include "util-spm-bm.h"
 
 #define GEOOPTION_MAXSIZE 3 /* Country Code (2 chars) + NULL */
 #define GEOOPTION_MAXLOCATIONS 64
diff --git a/src/detect-gid.h b/src/detect-gid.h
index aa9a8f9d1f0f..fa714ef8f5cf 100644
--- a/src/detect-gid.h
+++ b/src/detect-gid.h
@@ -26,9 +26,6 @@
 #ifndef __DETECT_GID_H__
 #define __DETECT_GID_H__
 
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
 
 /**
  * Registration function for gid: keyword
diff --git a/src/detect-hostbits.c b/src/detect-hostbits.c
index af3287b4f2f2..cb3747aeb893 100644
--- a/src/detect-hostbits.c
+++ b/src/detect-hostbits.c
@@ -40,6 +40,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "flow-bit.h"
 #include "host-bit.h"
diff --git a/src/detect-http-headers-stub.h b/src/detect-http-headers-stub.h
index 9cae4433e7b9..d1f472718acf 100644
--- a/src/detect-http-headers-stub.h
+++ b/src/detect-http-headers-stub.h
@@ -27,25 +27,16 @@
  */
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
 #include "flow.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-protos.h"
-#include "app-layer-htp.h"
 
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
-#include "detect-http-header.h"
 
 #include "util-debug.h"
+#include "rust.h"
 
 static int g_buffer_id = 0;
 
diff --git a/src/detect-http2.c b/src/detect-http2.c
index 75af58c43f9f..bcc23a398861 100644
--- a/src/detect-http2.c
+++ b/src/detect-http2.c
@@ -26,6 +26,8 @@
 
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-content.h"
+
 #include "detect-engine.h"
 #include "detect-engine-uint.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-icmp-id.c b/src/detect-icmp-id.c
index 7e943ca0b422..31cd636a94f8 100644
--- a/src/detect-icmp-id.c
+++ b/src/detect-icmp-id.c
@@ -30,6 +30,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
 
 #include "detect-icmp-id.h"
 
diff --git a/src/detect-icmp-seq.c b/src/detect-icmp-seq.c
index d4f2fcf7b2bf..69814b43a9dc 100644
--- a/src/detect-icmp-seq.c
+++ b/src/detect-icmp-seq.c
@@ -30,6 +30,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
 
 #include "detect-icmp-seq.h"
 
diff --git a/src/detect-icode.c b/src/detect-icode.c
index 6a42c0c40ba2..1bf6cf07bd4e 100644
--- a/src/detect-icode.c
+++ b/src/detect-icode.c
@@ -31,6 +31,7 @@
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
 #include "detect-engine-uint.h"
+#include "detect-engine-build.h"
 
 #include "detect-icode.h"
 
diff --git a/src/detect-ipopts.h b/src/detect-ipopts.h
index 2c599d82e2e4..4089ea5ad655 100644
--- a/src/detect-ipopts.h
+++ b/src/detect-ipopts.h
@@ -24,8 +24,6 @@
 #ifndef __DETECT_IPOPTS_H__
 #define __DETECT_IPOPTS_H__
 
-#include "decode-events.h"
-#include "decode-ipv4.h"
 
 /**
  * \struct DetectIpOptsData_
diff --git a/src/detect-ipproto.c b/src/detect-ipproto.c
index f8174194de7b..33f7a82ea661 100644
--- a/src/detect-ipproto.c
+++ b/src/detect-ipproto.c
@@ -33,6 +33,7 @@
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
 
 #include "detect-engine-siggroup.h"
 #include "detect-engine-address.h"
diff --git a/src/detect-iprep.c b/src/detect-iprep.c
index 2474ff17d7aa..59c3d1aec39d 100644
--- a/src/detect-iprep.c
+++ b/src/detect-iprep.c
@@ -40,6 +40,7 @@
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-uint.h"
+#include "detect-engine-build.h"
 
 #include "util-debug.h"
 #include "util-byte.h"
diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c
index 67dfd7464044..91d50e1a0f75 100644
--- a/src/detect-isdataat.c
+++ b/src/detect-isdataat.c
@@ -37,6 +37,7 @@
 #include "detect-isdataat.h"
 #include "detect-content.h"
 #include "detect-uricontent.h"
+#include "detect-engine-build.h"
 
 #include "flow.h"
 #include "flow-var.h"
diff --git a/src/detect-itype.c b/src/detect-itype.c
index 0a404bef2a70..03fa5462aa7b 100644
--- a/src/detect-itype.c
+++ b/src/detect-itype.c
@@ -30,6 +30,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
 
 #include "detect-itype.h"
 #include "detect-engine-uint.h"
diff --git a/src/detect-l3proto.c b/src/detect-l3proto.c
index 87ef8b6cf8f2..78e7c07e8c20 100644
--- a/src/detect-l3proto.c
+++ b/src/detect-l3proto.c
@@ -34,6 +34,7 @@
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
 
 #include "detect-engine-siggroup.h"
 #include "detect-engine-address.h"
@@ -369,4 +370,4 @@ static void DetectL3protoRegisterTests(void)
     UtRegisterTest("DetectL3protoTestSig2", DetectL3protoTestSig2);
     UtRegisterTest("DetectL3protoTestSig3", DetectL3protoTestSig3);
 }
-#endif /* UNITTESTS */
\ No newline at end of file
+#endif /* UNITTESTS */
diff --git a/src/detect-lua.c b/src/detect-lua.c
index 4d055981ed63..e3c27228408e 100644
--- a/src/detect-lua.c
+++ b/src/detect-lua.c
@@ -35,6 +35,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "flow.h"
 #include "flow-var.h"
diff --git a/src/detect-mark.h b/src/detect-mark.h
index 1c456a484367..b8de378fd20d 100644
--- a/src/detect-mark.h
+++ b/src/detect-mark.h
@@ -28,8 +28,6 @@
 #ifndef __DETECT_MARK_H__
 #define __DETECT_MARK_H__
 
-#include "decode.h"
-#include "detect.h"
 
 /**
  * \struct DetectMarkData_
diff --git a/src/detect-nocase.c b/src/detect-nocase.c
index 60f7330597aa..b2d8b834a0c9 100644
--- a/src/detect-nocase.c
+++ b/src/detect-nocase.c
@@ -24,6 +24,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "decode.h"
 
 #include "detect.h"
diff --git a/src/detect-parse.c b/src/detect-parse.c
index 32d7a5ee5296..3fd1d9934cac 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -32,6 +32,7 @@
 #include "detect-engine-port.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "detect-content.h"
 #include "detect-pcre.h"
diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index ea5da8b3a9a4..2df85d871104 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -36,10 +36,12 @@
 #include "detect-flowvar.h"
 
 #include "detect-parse.h"
+#include "detect-content.h"
 #include "detect-engine.h"
 #include "detect-engine-sigorder.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "util-var-name.h"
 #include "util-unittest-helper.h"
diff --git a/src/detect-pktvar.c b/src/detect-pktvar.c
index ca2e61a8ff82..2b3abac1d781 100644
--- a/src/detect-pktvar.c
+++ b/src/detect-pktvar.c
@@ -35,6 +35,7 @@
 #include "detect-content.h"
 #include "util-spm.h"
 #include "util-debug.h"
+#include "util-var-name.h"
 
 #define PARSE_REGEX         "(.*),(.*)"
 static DetectParseRegex parse_regex;
diff --git a/src/detect-quic-cyu-hash.c b/src/detect-quic-cyu-hash.c
index 50a8170ac12e..095453037a60 100644
--- a/src/detect-quic-cyu-hash.c
+++ b/src/detect-quic-cyu-hash.c
@@ -23,11 +23,14 @@
 #include "suricata-common.h"
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-content.h"
+
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-quic-cyu-hash.h"
+#include "detect-engine-build.h"
 #include "rust.h"
 
 #ifdef UNITTESTS
diff --git a/src/detect-quic-cyu-string.c b/src/detect-quic-cyu-string.c
index 7e27ecd698dc..6a49f2667a20 100644
--- a/src/detect-quic-cyu-string.c
+++ b/src/detect-quic-cyu-string.c
@@ -28,6 +28,7 @@
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-quic-cyu-string.h"
+#include "detect-engine-build.h"
 #include "rust.h"
 
 #ifdef UNITTESTS
diff --git a/src/detect-reference.h b/src/detect-reference.h
index dbab5af00a56..ddf9233987cb 100644
--- a/src/detect-reference.h
+++ b/src/detect-reference.h
@@ -24,9 +24,6 @@
 #ifndef __DETECT_REFERENCE_H__
 #define __DETECT_REFERENCE_H__
 
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
 
 /**
  * \brief Signature reference list.
diff --git a/src/detect-replace.c b/src/detect-replace.c
index a7384475a0e8..4164a651a93f 100644
--- a/src/detect-replace.c
+++ b/src/detect-replace.c
@@ -45,6 +45,7 @@ extern int run_mode;
 #include "detect-engine-mpm.h"
 #include "detect-engine.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "util-checksum.h"
 
@@ -862,4 +863,4 @@ void DetectReplaceRegisterTests(void)
     UtRegisterTest("DetectReplaceParseTest06", DetectReplaceParseTest06);
     UtRegisterTest("DetectReplaceParseTest07", DetectReplaceParseTest07);
 }
-#endif /* UNITTESTS */
\ No newline at end of file
+#endif /* UNITTESTS */
diff --git a/src/detect-replace.h b/src/detect-replace.h
index ab858419c9f8..c444188c0948 100644
--- a/src/detect-replace.h
+++ b/src/detect-replace.h
@@ -24,6 +24,8 @@
 #ifndef __DETECT_REPLACE_H__
 #define __DETECT_REPLACE_H__
 
+#include "detect-content.h"
+
 DetectReplaceList * DetectReplaceAddToList(DetectReplaceList *replist, uint8_t *found, DetectContentData *cd);
 
 /* Internal functions are only called via the inline functions below. */
diff --git a/src/detect-rpc.c b/src/detect-rpc.c
index 8f56f723a04f..6ccc7086dfe1 100644
--- a/src/detect-rpc.c
+++ b/src/detect-rpc.c
@@ -34,6 +34,7 @@
 #include "detect-engine-mpm.h"
 #include "detect-engine-siggroup.h"
 #include "detect-engine-address.h"
+#include "detect-engine-build.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
diff --git a/src/detect-sameip.c b/src/detect-sameip.c
index 15363365ca80..d15c48d3eb31 100644
--- a/src/detect-sameip.c
+++ b/src/detect-sameip.c
@@ -31,6 +31,7 @@
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
 
 #include "detect-sameip.h"
 
@@ -174,4 +175,4 @@ static void DetectSameipRegisterTests(void)
 {
     UtRegisterTest("DetectSameipSigTest01", DetectSameipSigTest01);
 }
-#endif /* UNITTESTS */
\ No newline at end of file
+#endif /* UNITTESTS */
diff --git a/src/detect-snmp-community.h b/src/detect-snmp-community.h
index c7b82c86f3dd..11de2abbf99a 100644
--- a/src/detect-snmp-community.h
+++ b/src/detect-snmp-community.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_SNMP_COMMUNITY_H__
 #define __DETECT_SNMP_COMMUNITY_H__
 
-#include "app-layer-snmp.h"
 
 void DetectSNMPCommunityRegister(void);
 
diff --git a/src/detect-snmp-pdu_type.h b/src/detect-snmp-pdu_type.h
index 8aee17fb0d74..5197885a588b 100644
--- a/src/detect-snmp-pdu_type.h
+++ b/src/detect-snmp-pdu_type.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_SNMP_PDU_TYPE_H__
 #define __DETECT_SNMP_PDU_TYPE_H__
 
-#include "app-layer-snmp.h"
 
 void DetectSNMPPduTypeRegister(void);
 
diff --git a/src/detect-snmp-version.h b/src/detect-snmp-version.h
index 281ae51450ab..3c8d5915d82e 100644
--- a/src/detect-snmp-version.h
+++ b/src/detect-snmp-version.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_SNMP_VERSION_H__
 #define __DETECT_SNMP_VERSION_H__
 
-#include "app-layer-snmp.h"
 
 void DetectSNMPVersionRegister(void);
 
diff --git a/src/detect-ssh-hassh-server.c b/src/detect-ssh-hassh-server.c
index 34aaecdb1dfa..679ca8583b3e 100644
--- a/src/detect-ssh-hassh-server.c
+++ b/src/detect-ssh-hassh-server.c
@@ -28,6 +28,7 @@
 
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-ssh-hassh.c b/src/detect-ssh-hassh.c
index 12404e29912e..d7cc837e318a 100644
--- a/src/detect-ssh-hassh.c
+++ b/src/detect-ssh-hassh.c
@@ -28,6 +28,7 @@
 
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-ssh-proto-version.c b/src/detect-ssh-proto-version.c
index d1e9eda845c8..056db6fc8974 100644
--- a/src/detect-ssh-proto-version.c
+++ b/src/detect-ssh-proto-version.c
@@ -38,6 +38,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "flow.h"
 #include "flow-var.h"
diff --git a/src/detect-ssh-software-version.c b/src/detect-ssh-software-version.c
index 35be28ee4441..b85ad7203a41 100644
--- a/src/detect-ssh-software-version.c
+++ b/src/detect-ssh-software-version.c
@@ -42,6 +42,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "flow.h"
 #include "flow-var.h"
diff --git a/src/detect-ssl-state.h b/src/detect-ssl-state.h
index 9246d8f34767..39179612ad9c 100644
--- a/src/detect-ssl-state.h
+++ b/src/detect-ssl-state.h
@@ -24,7 +24,6 @@
 #ifndef DETECT_SSL_STATE_H
 #define	DETECT_SSL_STATE_H
 
-#include "app-layer-ssl.h"
 
 /* we pick these flags flags from the parser */
 #define DETECT_SSL_STATE_CLIENT_HELLO SSL_AL_FLAG_STATE_CLIENT_HELLO
diff --git a/src/detect-tag.h b/src/detect-tag.h
index 6db80e4096d9..642e58d2c62f 100644
--- a/src/detect-tag.h
+++ b/src/detect-tag.h
@@ -26,8 +26,6 @@
 #define __DETECT_TAG_H__
 
 #include "suricata-common.h"
-#include "suricata.h"
-#include "util-time.h"
 
 /* Limit the number of times a session can be tagged by the
  * same rule without finishing older tags */
diff --git a/src/detect-tcp-ack.c b/src/detect-tcp-ack.c
index 963b6a20564c..3e5046d23139 100644
--- a/src/detect-tcp-ack.c
+++ b/src/detect-tcp-ack.c
@@ -34,6 +34,7 @@
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
 
 #include "detect-tcp-ack.h"
 
diff --git a/src/detect-tcp-flags.h b/src/detect-tcp-flags.h
index 9b6b24021fc9..994def6261f3 100644
--- a/src/detect-tcp-flags.h
+++ b/src/detect-tcp-flags.h
@@ -24,9 +24,6 @@
 #ifndef __DETECT_FLAGS_H__
 #define __DETECT_FLAGS_H__
 
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
 
 /**
  * \struct DetectFlagsData_
diff --git a/src/detect-tcp-seq.c b/src/detect-tcp-seq.c
index bbb597a5b7b6..0f7025d5681f 100644
--- a/src/detect-tcp-seq.c
+++ b/src/detect-tcp-seq.c
@@ -32,6 +32,7 @@
 #include "detect-engine.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
 
 #include "detect-tcp-seq.h"
 
diff --git a/src/detect-template-buffer.h b/src/detect-template-buffer.h
index c23062a40656..0c974cfeac60 100644
--- a/src/detect-template-buffer.h
+++ b/src/detect-template-buffer.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_TEMPLATE_BUFFER_H__
 #define __DETECT_TEMPLATE_BUFFER_H__
 
-#include "app-layer-template.h"
 
 void DetectTemplateBufferRegister(void);
 
diff --git a/src/detect-template-rust-buffer.c b/src/detect-template-rust-buffer.c
index 5e118655aa75..24f81f6245c7 100644
--- a/src/detect-template-rust-buffer.c
+++ b/src/detect-template-rust-buffer.c
@@ -38,6 +38,7 @@
 #include "detect-engine-content-inspection.h"
 #include "detect-template-rust-buffer.h"
 #include "app-layer-parser.h"
+#include "detect-engine-build.h"
 #include "rust.h"
 
 
diff --git a/src/detect-template-rust-buffer.h b/src/detect-template-rust-buffer.h
index 59059a76b861..8778a6efe627 100644
--- a/src/detect-template-rust-buffer.h
+++ b/src/detect-template-rust-buffer.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_TEMPLATE_RUST_BUFFER_H__
 #define __DETECT_TEMPLATE_RUST_BUFFER_H__
 
-#include "app-layer-template.h"
 
 void DetectTemplateRustBufferRegister(void);
 
diff --git a/src/detect-threshold.c b/src/detect-threshold.c
index e3991b41a2b9..1395a33898a7 100644
--- a/src/detect-threshold.c
+++ b/src/detect-threshold.c
@@ -49,6 +49,7 @@
 #include "detect-threshold.h"
 #include "detect-engine-threshold.h"
 #include "detect-engine-address.h"
+#include "detect-engine-build.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
diff --git a/src/detect-threshold.h b/src/detect-threshold.h
index 4accda399c95..69da3c9773b5 100644
--- a/src/detect-threshold.h
+++ b/src/detect-threshold.h
@@ -24,9 +24,6 @@
 #ifndef __DETECT_THRESHOLD_H__
 #define __DETECT_THRESHOLD_H__
 
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
 
 #define TYPE_LIMIT     1
 #define TYPE_BOTH      2
diff --git a/src/detect-tls-cert-issuer.h b/src/detect-tls-cert-issuer.h
index 8e26cb75965c..fdfda510da26 100644
--- a/src/detect-tls-cert-issuer.h
+++ b/src/detect-tls-cert-issuer.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_TLS_ISSUER_H__
 #define __DETECT_TLS_ISSUER_H__
 
-#include "app-layer-ssl.h"
 
 void DetectTlsIssuerRegister(void);
 
diff --git a/src/detect-tls-cert-subject.h b/src/detect-tls-cert-subject.h
index 8d037275e34b..23f3e77859c7 100644
--- a/src/detect-tls-cert-subject.h
+++ b/src/detect-tls-cert-subject.h
@@ -24,7 +24,6 @@
 #ifndef __DETECT_TLS_SUBJECT_H__
 #define __DETECT_TLS_SUBJECT_H__
 
-#include "app-layer-ssl.h"
 
 void DetectTlsSubjectRegister(void);
 
diff --git a/src/detect-tls.c b/src/detect-tls.c
index afa4a34a60c0..74f076236bb6 100644
--- a/src/detect-tls.c
+++ b/src/detect-tls.c
@@ -40,6 +40,7 @@
 
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-content.h"
 
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-transform-dotprefix.c b/src/detect-transform-dotprefix.c
index 061b0f1925b2..52a263372b43 100644
--- a/src/detect-transform-dotprefix.c
+++ b/src/detect-transform-dotprefix.c
@@ -30,6 +30,7 @@
 #include "detect-engine-prefilter.h"
 #include "detect-parse.h"
 #include "detect-transform-dotprefix.h"
+#include "detect-engine-build.h"
 
 #include "util-unittest.h"
 #include "util-print.h"
diff --git a/src/detect-transform-strip-whitespace.c b/src/detect-transform-strip-whitespace.c
index 055a7e00d061..7ca48b104851 100644
--- a/src/detect-transform-strip-whitespace.c
+++ b/src/detect-transform-strip-whitespace.c
@@ -28,6 +28,7 @@
 #include "detect.h"
 #include "detect-engine.h"
 #include "detect-engine-prefilter.h"
+#include "detect-engine-build.h"
 #include "detect-parse.h"
 #include "detect-transform-strip-whitespace.h"
 
diff --git a/src/detect-transform-urldecode.c b/src/detect-transform-urldecode.c
index 70717aac7332..f74e69497003 100644
--- a/src/detect-transform-urldecode.c
+++ b/src/detect-transform-urldecode.c
@@ -28,6 +28,7 @@
 #include "detect.h"
 #include "detect-engine.h"
 #include "detect-engine-prefilter.h"
+#include "detect-engine-build.h"
 #include "detect-parse.h"
 #include "detect-transform-urldecode.h"
 
diff --git a/src/detect-urilen.c b/src/detect-urilen.c
index 518f216fca6f..ad4ca72f6bf5 100644
--- a/src/detect-urilen.c
+++ b/src/detect-urilen.c
@@ -34,6 +34,7 @@
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 #include "detect-content.h"
 #include "detect-engine-uint.h"
 
diff --git a/src/detect-xbits.c b/src/detect-xbits.c
index 8fc2b0315d3f..6dc3dd425c15 100644
--- a/src/detect-xbits.c
+++ b/src/detect-xbits.c
@@ -42,6 +42,7 @@
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
+#include "detect-engine-build.h"
 
 #include "flow-bit.h"
 #include "host-bit.h"
diff --git a/src/detect.c b/src/detect.c
index 2888fb363629..0a6662859170 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -32,10 +32,13 @@
 #include "stream-tcp.h"
 #include "app-layer.h"
 #include "app-layer-parser.h"
+#include "app-layer-frames.h"
 
 #include "detect.h"
 #include "detect-dsize.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
+#include "detect-engine-frame.h"
 #include "detect-engine-profile.h"
 
 #include "detect-engine-alert.h"
@@ -59,6 +62,7 @@
 
 #include "util-validate.h"
 #include "util-detect.h"
+#include "util-profiling.h"
 
 typedef struct DetectRunScratchpad {
     const AppProto alproto;
diff --git a/src/detect.h b/src/detect.h
index 6f3744529aae..b483d48ba3ab 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -32,25 +32,16 @@
 #include "detect-reference.h"
 #include "detect-metadata.h"
 #include "detect-engine-register.h"
-#include "packet-queue.h"
 
 #include "util-prefilter.h"
 #include "util-mpm.h"
 #include "util-spm.h"
 #include "util-hash.h"
 #include "util-hashlist.h"
-#include "util-debug.h"
-#include "util-error.h"
 #include "util-radix-tree.h"
 #include "util-file.h"
 #include "reputation.h"
 
-#include "detect-mark.h"
-
-#include "stream.h"
-
-#include "util-var-name.h"
-
 #include "app-layer-events.h"
 
 #define DETECT_MAX_RULE_SIZE 8192
@@ -1567,8 +1558,6 @@ int DetectEngineGetEventInfo(const char *event_name, int *event_id,
 
 void DumpPatterns(DetectEngineCtx *de_ctx);
 
-#include "detect-engine-build.h"
-#include "detect-engine-register.h"
 
 #endif /* __DETECT_H__ */
 
diff --git a/src/device-storage.h b/src/device-storage.h
index 046c8dd45433..49fb59761df4 100644
--- a/src/device-storage.h
+++ b/src/device-storage.h
@@ -26,7 +26,6 @@
 #ifndef __DEVICE_STORAGE_H__
 #define __DEVICE_STORAGE_H__
 
-#include "util-storage.h"
 #include "util-device.h"
 
 typedef struct LiveDevStorageId_ {
diff --git a/src/feature.c b/src/feature.c
index a6ea9bc9d325..0cc27861261e 100644
--- a/src/feature.c
+++ b/src/feature.c
@@ -24,6 +24,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "feature.h"
 
 #include "util-hash.h"
diff --git a/src/flow-bypass.c b/src/flow-bypass.c
index 9b4e75e702fe..98e62f519e25 100644
--- a/src/flow-bypass.c
+++ b/src/flow-bypass.c
@@ -27,6 +27,7 @@
 #include "flow-bypass.h"
 #include "flow-private.h"
 #include "util-ebpf.h"
+#include "runmodes.h"
 
 #ifdef CAPTURE_OFFLOAD_MANAGER
 
diff --git a/src/flow-manager.c b/src/flow-manager.c
index d65505eb8211..b68eb22ffc17 100644
--- a/src/flow-manager.c
+++ b/src/flow-manager.c
@@ -51,6 +51,7 @@
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-byte.h"
+#include "util-device.h"
 
 #include "util-debug.h"
 #include "util-privs.h"
diff --git a/src/flow-storage.h b/src/flow-storage.h
index fb4958dc08f1..f6111ab9bc24 100644
--- a/src/flow-storage.h
+++ b/src/flow-storage.h
@@ -26,7 +26,6 @@
 #ifndef __FLOW_STORAGE_H__
 #define __FLOW_STORAGE_H__
 
-#include "util-storage.h"
 #include "flow.h"
 
 typedef struct FlowStorageId {
diff --git a/src/flow-util.c b/src/flow-util.c
index ec449a96038e..91c14eb3ebe6 100644
--- a/src/flow-util.c
+++ b/src/flow-util.c
@@ -34,6 +34,7 @@
 
 #include "util-var.h"
 #include "util-debug.h"
+#include "util-macset.h"
 #include "flow-storage.h"
 
 #include "detect.h"
diff --git a/src/flow-util.h b/src/flow-util.h
index 7ef542ea2668..919ab95ef326 100644
--- a/src/flow-util.h
+++ b/src/flow-util.h
@@ -24,8 +24,6 @@
 #ifndef __FLOW_UTIL_H__
 #define __FLOW_UTIL_H__
 
-#include "detect-engine-state.h"
-#include "tmqh-flow.h"
 #include "stream-tcp-private.h"
 
 #define COPY_TIMESTAMP(src,dst) ((dst)->tv_sec = (src)->tv_sec, (dst)->tv_usec = (src)->tv_usec)
diff --git a/src/flow-worker.c b/src/flow-worker.c
index 97f3f192a7e7..66fa73baad39 100644
--- a/src/flow-worker.c
+++ b/src/flow-worker.c
@@ -41,13 +41,18 @@
 #include "detect-engine.h"
 #include "output.h"
 #include "app-layer-parser.h"
+#include "app-layer-frames.h"
 
+#include "util-profiling.h"
 #include "util-validate.h"
+#include "util-time.h"
+#include "tmqh-packetpool.h"
 
 #include "flow-util.h"
 #include "flow-manager.h"
 #include "flow-timeout.h"
 #include "flow-spare-pool.h"
+#include "flow-worker.h"
 
 typedef DetectEngineThreadCtx *DetectEngineThreadCtxPtr;
 
diff --git a/src/flow.c b/src/flow.c
index a785290800a2..9f4d1450845f 100644
--- a/src/flow.c
+++ b/src/flow.c
@@ -54,6 +54,7 @@
 #include "util-unittest-helper.h"
 #include "util-byte.h"
 #include "util-misc.h"
+#include "util-macset.h"
 
 #include "util-debug.h"
 #include "util-privs.h"
diff --git a/src/flow.h b/src/flow.h
index 2ec7f531fcfa..8bbe6e600aad 100644
--- a/src/flow.h
+++ b/src/flow.h
@@ -30,11 +30,8 @@ typedef struct FlowStorageId FlowStorageId;
 #include "decode.h"
 #include "util-exception-policy.h"
 #include "util-var.h"
-#include "util-atomic.h"
-#include "util-device.h"
-#include "detect-tag.h"
-#include "util-macset.h"
 #include "util-optimize.h"
+#include "app-layer-protos.h"
 
 /* Part of the flow structure, so we declare it here.
  * The actual declaration is in app-layer-parser.c */
diff --git a/src/host-storage.h b/src/host-storage.h
index 25e8b962c110..e315b33f63e8 100644
--- a/src/host-storage.h
+++ b/src/host-storage.h
@@ -26,7 +26,6 @@
 #ifndef __HOST_STORAGE_H__
 #define __HOST_STORAGE_H__
 
-#include "util-storage.h"
 #include "host.h"
 
 typedef struct HostStorageId_ {
diff --git a/src/ippair-bit.h b/src/ippair-bit.h
index cbc7cb739be8..6b2476a887fb 100644
--- a/src/ippair-bit.h
+++ b/src/ippair-bit.h
@@ -25,7 +25,6 @@
 #define __IPPAIR_BIT_H__
 
 #include "ippair.h"
-#include "util-var.h"
 
 void IPPairBitInitCtx(void);
 void IPPairBitRegisterTests(void);
diff --git a/src/ippair-storage.h b/src/ippair-storage.h
index 6175084c3426..1d5ba7d2ea24 100644
--- a/src/ippair-storage.h
+++ b/src/ippair-storage.h
@@ -26,7 +26,6 @@
 #ifndef __IPPAIR_STORAGE_H__
 #define __IPPAIR_STORAGE_H__
 
-#include "util-storage.h"
 #include "ippair.h"
 
 typedef struct IPPairStorageId {
diff --git a/src/log-cf-common.c b/src/log-cf-common.c
index 35a3168eafcc..236926613a5c 100644
--- a/src/log-cf-common.c
+++ b/src/log-cf-common.c
@@ -28,6 +28,7 @@
 #include "log-cf-common.h"
 #include "util-print.h"
 #include "util-unittest.h"
+#include "util-time.h"
 
 /**
  *  \brief Creates a custom format node
diff --git a/src/log-pcap.c b/src/log-pcap.c
index 982c3acaa2ba..61b2ba2779d6 100644
--- a/src/log-pcap.c
+++ b/src/log-pcap.c
@@ -29,6 +29,7 @@
 #include "util-fmemopen.h"
 #include "util-datalink.h"
 #include "stream-tcp-util.h"
+#include "stream.h"
 
 #ifdef HAVE_LIBLZ4
 #include <lz4frame.h>
diff --git a/src/output-flow.h b/src/output-flow.h
index 8445d6fa1346..04f878419213 100644
--- a/src/output-flow.h
+++ b/src/output-flow.h
@@ -26,7 +26,6 @@
 #ifndef __OUTPUT_FLOW_H__
 #define __OUTPUT_FLOW_H__
 
-#include "decode.h"
 
 /** flow logger function pointer type */
 typedef int (*FlowLogger)(ThreadVars *, void *thread_data, Flow *f);
diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index 3e0f69e8a916..69d6f7c30f36 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -30,6 +30,7 @@
 #include "flow.h"
 #include "conf.h"
 
+#include "stream.h"
 #include "threads.h"
 #include "tm-threads.h"
 #include "threadvars.h"
@@ -37,6 +38,7 @@
 
 #include "util-logopenfile.h"
 #include "util-misc.h"
+#include "util-time.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
diff --git a/src/output-json-email-common.c b/src/output-json-email-common.c
index 5d110c0ea308..cadad2c1c2d5 100644
--- a/src/output-json-email-common.c
+++ b/src/output-json-email-common.c
@@ -29,6 +29,7 @@
 #include "detect.h"
 #include "pkt-var.h"
 #include "conf.h"
+#include "suricata.h"
 
 #include "threads.h"
 #include "threadvars.h"
diff --git a/src/output-json-flow.c b/src/output-json-flow.c
index 1a999da4df0d..17b4c0f33a65 100644
--- a/src/output-json-flow.c
+++ b/src/output-json-flow.c
@@ -41,6 +41,7 @@
 #include "output.h"
 #include "util-privs.h"
 #include "util-buffer.h"
+#include "util-device.h"
 #include "util-proto-name.h"
 #include "util-logopenfile.h"
 #include "util-time.h"
diff --git a/src/output-json-frame.h b/src/output-json-frame.h
index 5560a07eea53..009e7b6426bb 100644
--- a/src/output-json-frame.h
+++ b/src/output-json-frame.h
@@ -27,6 +27,9 @@
 #ifndef __OUTPUT_JSON_FRAME_H__
 #define __OUTPUT_JSON_FRAME_H__
 
+#include "app-layer-frames.h"
+#include "stream-tcp-private.h"
+
 void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, const Flow *f,
         const TcpStream *stream, const Packet *p, JsonBuilder *jb);
 void JsonFrameLogRegister(void);
diff --git a/src/output-json-netflow.c b/src/output-json-netflow.c
index 16267a9f3b58..0aa90a49bbbe 100644
--- a/src/output-json-netflow.c
+++ b/src/output-json-netflow.c
@@ -41,6 +41,7 @@
 #include "output.h"
 #include "util-privs.h"
 #include "util-buffer.h"
+#include "util-device.h"
 #include "util-proto-name.h"
 #include "util-logopenfile.h"
 #include "util-time.h"
diff --git a/src/output-json-stats.c b/src/output-json-stats.c
index 181bb54106c3..9b9c22151b8c 100644
--- a/src/output-json-stats.c
+++ b/src/output-json-stats.c
@@ -35,6 +35,7 @@
 #include "tm-threads.h"
 
 #include "util-print.h"
+#include "util-time.h"
 #include "util-unittest.h"
 
 #include "util-debug.h"
diff --git a/src/output-json-tls.c b/src/output-json-tls.c
index 4cc13b4cac2b..fce953ae38bf 100644
--- a/src/output-json-tls.c
+++ b/src/output-json-tls.c
@@ -34,6 +34,7 @@
 #include "tm-threads.h"
 
 #include "util-print.h"
+#include "util-time.h"
 #include "util-unittest.h"
 
 #include "util-debug.h"
diff --git a/src/output-json.c b/src/output-json.c
index 4a89c1030bd3..de322104c519 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -34,6 +34,9 @@
 #include "tm-threads.h"
 #include "threadvars.h"
 #include "util-debug.h"
+#include "util-time.h"
+#include "util-var-name.h"
+#include "util-macset.h"
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
@@ -45,6 +48,7 @@
 #include "app-layer-parser.h"
 #include "util-classification-config.h"
 #include "util-syslog.h"
+#include "output-eve-syslog.h"
 
 #include "output.h"
 #include "output-json.h"
diff --git a/src/output-packet.h b/src/output-packet.h
index d51f85545375..3953b9d939ad 100644
--- a/src/output-packet.h
+++ b/src/output-packet.h
@@ -27,7 +27,7 @@
 #define __OUTPUT_PACKET_H__
 
 #include "decode.h"
-#include "output.h"
+#include "tm-modules.h"
 
 /** packet logger function pointer type */
 typedef int (*PacketLogger)(ThreadVars *, void *thread_data, const Packet *);
diff --git a/src/output-streaming.h b/src/output-streaming.h
index d47a3e432c52..07c3722d8e3d 100644
--- a/src/output-streaming.h
+++ b/src/output-streaming.h
@@ -26,8 +26,6 @@
 #ifndef __OUTPUT_STREAMING_H__
 #define __OUTPUT_STREAMING_H__
 
-#include "decode.h"
-#include "util-file.h"
 
 #define OUTPUT_STREAMING_FLAG_OPEN          0x01
 #define OUTPUT_STREAMING_FLAG_CLOSE         0x02
diff --git a/src/output.h b/src/output.h
index 3f73a1bada15..62d3f6b90f6b 100644
--- a/src/output.h
+++ b/src/output.h
@@ -24,9 +24,6 @@
 #ifndef __OUTPUT_H__
 #define __OUTPUT_H__
 
-#include "suricata.h"
-#include "tm-threads.h"
-
 #define DEFAULT_LOG_MODE_APPEND     "yes"
 #define DEFAULT_LOG_FILETYPE        "regular"
 
@@ -38,7 +35,6 @@
 #include "output-streaming.h"
 #include "output-stats.h"
 
-#include "util-config.h"
 
 typedef struct OutputLoggerThreadStore_ {
     void *thread_data;
diff --git a/src/packet-queue.h b/src/packet-queue.h
index b61a5a59c82c..c7070d3e51f7 100644
--- a/src/packet-queue.h
+++ b/src/packet-queue.h
@@ -55,7 +55,6 @@ typedef struct PacketQueue_ {
     SCCondT cond_q;
 } PacketQueue;
 
-#include "decode.h"
 
 void PacketEnqueueNoLock(PacketQueueNoLock *qnl, struct Packet_ *p);
 void PacketEnqueue (PacketQueue *, struct Packet_ *);
diff --git a/src/queue.h b/src/queue.h
index 1ece2d101c2f..3ba7062f556b 100644
--- a/src/queue.h
+++ b/src/queue.h
@@ -49,7 +49,6 @@
  * from queue.h instead the Suricata copy.
  */
 
-#include "autoconf.h"
 
 #if defined(HAVE_SYS_QUEUE_H) && !defined(__clang_analyzer__)
 #include <sys/queue.h>
diff --git a/src/respond-reject-libnet11.c b/src/respond-reject-libnet11.c
index 4c7be9dfb54f..9a646bc013fd 100644
--- a/src/respond-reject-libnet11.c
+++ b/src/respond-reject-libnet11.c
@@ -33,6 +33,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 
 #include "decode.h"
 #include "decode-ipv4.h"
diff --git a/src/respond-reject.h b/src/respond-reject.h
index 9baeaf753193..0df165591cee 100644
--- a/src/respond-reject.h
+++ b/src/respond-reject.h
@@ -24,7 +24,6 @@
 #ifndef __RESPOND_REJECT_H__
 #define __RESPOND_REJECT_H__
 
-#include "tm-threads.h"
 
 enum RejectDirection {
     REJECT_DIR_SRC = 0,
diff --git a/src/runmode-dpdk.c b/src/runmode-dpdk.c
index f58e4506c045..170679ae3229 100644
--- a/src/runmode-dpdk.c
+++ b/src/runmode-dpdk.c
@@ -41,6 +41,7 @@
 #include "util-dpdk-i40e.h"
 #include "util-dpdk-ice.h"
 #include "util-dpdk-ixgbe.h"
+#include "util-time.h"
 
 #ifdef HAVE_DPDK
 
diff --git a/src/runmode-napatech.h b/src/runmode-napatech.h
index b80d77732500..d77133addaa2 100644
--- a/src/runmode-napatech.h
+++ b/src/runmode-napatech.h
@@ -27,7 +27,6 @@
 #define __RUNMODE_NAPATECH_H__
 
 #ifdef HAVE_NAPATECH
-#include "util-napatech.h"
 #include <nt.h>
 #endif /* HAVE_NAPATECH */
 
diff --git a/src/runmode-unittests.c b/src/runmode-unittests.c
index d55c7b814108..851de186e90e 100644
--- a/src/runmode-unittests.c
+++ b/src/runmode-unittests.c
@@ -103,6 +103,14 @@
 
 #include "util-streaming-buffer.h"
 #include "util-lua.h"
+#include "tm-modules.h"
+#include "tmqh-packetpool.h"
+#include "decode-chdlc.h"
+#include "decode-geneve.h"
+#include "decode-nsh.h"
+#include "decode-raw.h"
+#include "decode-vntag.h"
+#include "decode-vxlan.h"
 
 #ifdef OS_WIN32
 #include "win32-syscall.h"
diff --git a/src/runmode-unix-socket.c b/src/runmode-unix-socket.c
index 6fedc5d391c5..24ac172179fe 100644
--- a/src/runmode-unix-socket.c
+++ b/src/runmode-unix-socket.c
@@ -27,6 +27,7 @@
 #include "util-time.h"
 #include "util-cpu.h"
 #include "util-affinity.h"
+#include "util-var-name.h"
 #include "unix-manager.h"
 
 #include "detect-engine.h"
@@ -50,6 +51,7 @@
 #include "conf-yaml-loader.h"
 
 #include "datasets.h"
+#include "runmode-unix-socket.h"
 
 int unix_socket_mode_is_running = 0;
 
diff --git a/src/runmodes.c b/src/runmodes.c
index 0e88dae30821..8f729a46a913 100644
--- a/src/runmodes.c
+++ b/src/runmodes.c
@@ -36,6 +36,20 @@
 #include "conf.h"
 #include "queue.h"
 #include "runmodes.h"
+#include "runmode-af-packet.h"
+#include "runmode-dpdk.h"
+#include "runmode-erf-dag.h"
+#include "runmode-erf-file.h"
+#include "runmode-ipfw.h"
+#include "runmode-napatech.h"
+#include "runmode-netmap.h"
+#include "runmode-nflog.h"
+#include "runmode-nfq.h"
+#include "runmode-pcap.h"
+#include "runmode-pcap-file.h"
+#include "runmode-pfring.h"
+#include "runmode-unix-socket.h"
+#include "runmode-windivert.h"
 #include "util-unittest.h"
 #include "util-misc.h"
 #include "util-plugin.h"
diff --git a/src/runmodes.h b/src/runmodes.h
index d9eb24e988c3..026b05f5c557 100644
--- a/src/runmodes.h
+++ b/src/runmodes.h
@@ -98,20 +98,6 @@ bool IsRunModeSystem(enum RunModes run_mode_to_check);
 void RunModeEnablesBypassManager(void);
 int RunModeNeedsBypassManager(void);
 
-#include "runmode-pcap.h"
-#include "runmode-pcap-file.h"
-#include "runmode-pfring.h"
-#include "runmode-nfq.h"
-#include "runmode-ipfw.h"
-#include "runmode-erf-file.h"
-#include "runmode-erf-dag.h"
-#include "runmode-napatech.h"
-#include "runmode-af-packet.h"
-#include "runmode-nflog.h"
-#include "runmode-unix-socket.h"
-#include "runmode-netmap.h"
-#include "runmode-windivert.h"
-#include "runmode-dpdk.h"
 
 extern int threading_set_cpu_affinity;
 extern float threading_detect_ratio;
diff --git a/src/rust.h b/src/rust.h
index a01e6e602b51..dc345412a9bb 100644
--- a/src/rust.h
+++ b/src/rust.h
@@ -21,6 +21,7 @@
 #include "util-lua.h"
 // hack for include orders cf SCSha256
 typedef struct HttpRangeContainerBlock HttpRangeContainerBlock;
+#include "detect-engine-state.h"
 #include "rust-context.h"
 #include "rust-bindings.h"
 
diff --git a/src/source-dpdk.h b/src/source-dpdk.h
index afde13ec738d..b20b7fc6097e 100644
--- a/src/source-dpdk.h
+++ b/src/source-dpdk.h
@@ -24,8 +24,9 @@
 #ifndef __SOURCE_DPDK_H__
 #define __SOURCE_DPDK_H__
 
-#include "queue.h"
-#include "util-dpdk.h"
+#ifdef HAVE_DPDK
+#include <rte_ethdev.h>
+#endif
 
 typedef enum { DPDK_COPY_MODE_NONE, DPDK_COPY_MODE_TAP, DPDK_COPY_MODE_IPS } DpdkCopyModeEnum;
 
diff --git a/src/source-pcap-file-directory-helper.c b/src/source-pcap-file-directory-helper.c
index 7cdad3625470..43ccadf69772 100644
--- a/src/source-pcap-file-directory-helper.c
+++ b/src/source-pcap-file-directory-helper.c
@@ -24,8 +24,10 @@
  */
 
 #include "source-pcap-file-directory-helper.h"
+#include "suricata.h"
 #include "runmode-unix-socket.h"
 #include "util-mem.h"
+#include "util-time.h"
 #include "source-pcap-file.h"
 
 static void GetTime(struct timespec *tm);
diff --git a/src/source-pcap-file-helper.c b/src/source-pcap-file-helper.c
index d19c456244d5..91341facfb2a 100644
--- a/src/source-pcap-file-helper.c
+++ b/src/source-pcap-file-helper.c
@@ -24,6 +24,7 @@
  */
 
 #include "source-pcap-file-helper.h"
+#include "suricata.h"
 #include "util-datalink.h"
 #include "util-checksum.h"
 #include "util-profiling.h"
diff --git a/src/source-pcap-file.c b/src/source-pcap-file.c
index f1865f17342e..eb2683378951 100644
--- a/src/source-pcap-file.c
+++ b/src/source-pcap-file.c
@@ -29,6 +29,8 @@
 #include "source-pcap-file-directory-helper.h"
 #include "flow-manager.h"
 #include "util-checksum.h"
+#include "runmode-unix-socket.h"
+#include "suricata.h"
 
 extern int max_pending_packets;
 PcapFileGlobalVars pcap_g;
diff --git a/src/source-pcap.c b/src/source-pcap.c
index 97b2085cdc52..5e7ebc5f8874 100644
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -41,6 +41,7 @@
 #include "util-optimize.h"
 #include "util-checksum.h"
 #include "util-ioctl.h"
+#include "util-time.h"
 #include "tmqh-packetpool.h"
 
 #define PCAP_STATE_DOWN 0
diff --git a/src/stream-tcp-list.h b/src/stream-tcp-list.h
index a910bb95ecab..5612354a86a1 100644
--- a/src/stream-tcp-list.h
+++ b/src/stream-tcp-list.h
@@ -24,7 +24,6 @@
 #ifndef __STREAM_TCP_LIST_H__
 #define __STREAM_TCP_LIST_H__
 
-#include "stream-tcp-private.h"
 
 #ifdef UNITTESTS
 void StreamTcpListRegisterTests(void);
diff --git a/src/stream-tcp-private.h b/src/stream-tcp-private.h
index b1f431667c80..cf7f882eeb6c 100644
--- a/src/stream-tcp-private.h
+++ b/src/stream-tcp-private.h
@@ -24,9 +24,6 @@
 #ifndef __STREAM_TCP_PRIVATE_H__
 #define __STREAM_TCP_PRIVATE_H__
 
-#include "tree.h"
-#include "decode.h"
-#include "util-pool.h"
 #include "util-pool-thread.h"
 #include "util-streaming-buffer.h"
 
diff --git a/src/stream-tcp-reassemble.h b/src/stream-tcp-reassemble.h
index 49bff569d050..ce7cf16bcb05 100644
--- a/src/stream-tcp-reassemble.h
+++ b/src/stream-tcp-reassemble.h
@@ -26,10 +26,12 @@
 #define __STREAM_TCP_REASSEMBLE_H__
 
 #include "stream-tcp-private.h"
-#include "stream.h"
-#include "app-layer-detect-proto.h"
 #include "stream-tcp-private.h"
 
+#ifdef UNITTESTS
+#include "suricata.h"
+#endif
+
 /** Supported OS list and default OS policy is BSD */
 enum
 {
diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 44e2e425342a..5378d86c8176 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -75,6 +75,7 @@
 #include "util-runmodes.h"
 #include "util-random.h"
 #include "util-exception-policy.h"
+#include "util-time.h"
 
 #include "source-pcap-file.h"
 
diff --git a/src/stream-tcp.h b/src/stream-tcp.h
index 15cfee210d91..62a14f008469 100644
--- a/src/stream-tcp.h
+++ b/src/stream-tcp.h
@@ -29,6 +29,7 @@
 
 #include "stream.h"
 #include "stream-tcp-reassemble.h"
+#include "suricata.h"
 
 #define STREAM_VERBOSE false
 /* Flag to indicate that the checksum validation for the stream engine
diff --git a/src/stream.h b/src/stream.h
index 583747ca5586..53f1f6e0cc24 100644
--- a/src/stream.h
+++ b/src/stream.h
@@ -24,7 +24,6 @@
 #ifndef __STREAM_H__
 #define __STREAM_H__
 
-#include "flow.h"
 #include "stream-tcp-private.h"
 
 #define STREAM_FLAGS_FOR_PACKET(p) PKT_IS_TOSERVER((p)) ? STREAM_TOSERVER : STREAM_TOCLIENT
diff --git a/src/suricata.c b/src/suricata.c
index de6d7e22c689..14a65e0fcb65 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -48,6 +48,7 @@
 #include "util-ioctl.h"
 #include "util-device.h"
 #include "util-misc.h"
+#include "util-macset.h"
 #include "util-running-modes.h"
 
 #include "detect-engine.h"
@@ -153,11 +154,13 @@
 
 #include "runmodes.h"
 #include "runmode-unittests.h"
+#include "runmode-af-packet.h"
 
 #include "util-debug.h"
 #include "util-error.h"
 #include "util-daemon.h"
 #include "util-byte.h"
+#include "util-luajit.h"
 #include "reputation.h"
 
 #include "output.h"
diff --git a/src/suricata.h b/src/suricata.h
index 5d15424809fd..321f21a786b7 100644
--- a/src/suricata.h
+++ b/src/suricata.h
@@ -65,7 +65,6 @@
 #define __SURICATA_H__
 
 #include "suricata-common.h"
-#include "packet-queue.h"
 
 /* the name of our binary */
 #define PROG_NAME "Suricata"
diff --git a/src/tests/detect-engine-content-inspection.c b/src/tests/detect-engine-content-inspection.c
index aea1c95c9dcd..43cf0b805eb0 100644
--- a/src/tests/detect-engine-content-inspection.c
+++ b/src/tests/detect-engine-content-inspection.c
@@ -27,6 +27,7 @@
 #include "../decode.h"
 #include "../flow.h"
 #include "../detect.h"
+#include "detect-engine-build.h"
 
 #define TEST_HEADER                                     \
     ThreadVars tv;                                      \
diff --git a/src/tests/detect-http-client-body.c b/src/tests/detect-http-client-body.c
index bdd560b82557..6bcb4ff325bb 100644
--- a/src/tests/detect-http-client-body.c
+++ b/src/tests/detect-http-client-body.c
@@ -45,7 +45,7 @@
 #include "detect-engine-prefilter.h"
 #include "detect-isdataat.h"
 #include "stream-tcp-reassemble.h"
-
+#include "detect-engine-build.h"
 
 #include "flow-util.h"
 #include "util-debug.h"
diff --git a/src/tests/detect-http-cookie.c b/src/tests/detect-http-cookie.c
index 93b0ac8b6ba1..a85c33137296 100644
--- a/src/tests/detect-http-cookie.c
+++ b/src/tests/detect-http-cookie.c
@@ -42,6 +42,7 @@
 #include "../app-layer-htp.h"
 #include "../app-layer-protos.h"
 #include "../detect-isdataat.h"
+#include "../detect-engine-build.h"
 
 /***********************************Unittests**********************************/
 
diff --git a/src/tests/detect-http-header.c b/src/tests/detect-http-header.c
index c4baf937a16c..687eb2b1d8a0 100644
--- a/src/tests/detect-http-header.c
+++ b/src/tests/detect-http-header.c
@@ -41,6 +41,7 @@
 #include "../app-layer-htp.h"
 #include "../detect-http-header.h"
 #include "../detect-http-header-common.h"
+#include "../detect-engine-build.h"
 
 #include "../detect-isdataat.h"
 
diff --git a/src/tests/detect-http-host.c b/src/tests/detect-http-host.c
index 60b437ca16e6..f4365a92f3e1 100644
--- a/src/tests/detect-http-host.c
+++ b/src/tests/detect-http-host.c
@@ -42,6 +42,7 @@
 #include "app-layer.h"
 #include "app-layer-htp.h"
 #include "app-layer-protos.h"
+#include "detect-engine-build.h"
 
 /**
  * \test Test that the http_host content matches against a http request
diff --git a/src/tests/detect-http-method.c b/src/tests/detect-http-method.c
index 44ee21f21c4c..530a60e5758f 100644
--- a/src/tests/detect-http-method.c
+++ b/src/tests/detect-http-method.c
@@ -42,6 +42,7 @@
 #include "../app-layer-htp.h"
 #include "../app-layer-protos.h"
 #include "../detect-isdataat.h"
+#include "../detect-engine-build.h"
 
 /**
  * \test Test that the http_method content matches against a http request
diff --git a/src/tests/detect-http-raw-header.c b/src/tests/detect-http-raw-header.c
index 484bd5757bad..cab73ed8a41d 100644
--- a/src/tests/detect-http-raw-header.c
+++ b/src/tests/detect-http-raw-header.c
@@ -39,6 +39,7 @@
 #include "../detect-engine.h"
 #include "../detect-isdataat.h"
 #include "../detect-pcre.h"
+#include "../detect-engine-build.h"
 
 #include "../stream-tcp.h"
 #include "../app-layer.h"
diff --git a/src/tests/detect-http-server-body.c b/src/tests/detect-http-server-body.c
index 5f797b1cda04..42f3b5e055b8 100644
--- a/src/tests/detect-http-server-body.c
+++ b/src/tests/detect-http-server-body.c
@@ -28,6 +28,7 @@
 #include "../decode.h"
 #include "../flow.h"
 #include "../detect.h"
+#include "../detect-engine-build.h"
 
 /**
  * \test Test parser accepting valid rules and rejecting invalid rules
diff --git a/src/tests/detect-http-stat-code.c b/src/tests/detect-http-stat-code.c
index a2c693fd9e10..9f16d9963d46 100644
--- a/src/tests/detect-http-stat-code.c
+++ b/src/tests/detect-http-stat-code.c
@@ -38,6 +38,7 @@
 #include "../app-layer.h"
 #include "../app-layer-htp.h"
 #include "../app-layer-protos.h"
+#include "../detect-engine-build.h"
 
 static int DetectEngineHttpStatCodeTest01(void)
 {
diff --git a/src/tests/detect-http-stat-msg.c b/src/tests/detect-http-stat-msg.c
index 6346a0276cf5..e4317181e90a 100644
--- a/src/tests/detect-http-stat-msg.c
+++ b/src/tests/detect-http-stat-msg.c
@@ -38,6 +38,7 @@
 #include "../app-layer.h"
 #include "../app-layer-htp.h"
 #include "../app-layer-protos.h"
+#include "../detect-engine-build.h"
 
 static int DetectEngineHttpStatMsgTest01(void)
  {
diff --git a/src/tests/detect-http-uri.c b/src/tests/detect-http-uri.c
index b6a5ca9edee9..9bd5b63d57a1 100644
--- a/src/tests/detect-http-uri.c
+++ b/src/tests/detect-http-uri.c
@@ -32,6 +32,7 @@
 #include "../flow-util.h"
 
 #include "../detect-isdataat.h"
+#include "../detect-engine-build.h"
 
 /** \test Test a simple uricontent option */
 static int UriTestSig01(void)
diff --git a/src/tests/detect-http-user-agent.c b/src/tests/detect-http-user-agent.c
index dda97fa81984..f0c6fcc5df62 100644
--- a/src/tests/detect-http-user-agent.c
+++ b/src/tests/detect-http-user-agent.c
@@ -41,6 +41,7 @@
 #include "app-layer.h"
 #include "app-layer-htp.h"
 #include "app-layer-protos.h"
+#include "detect-engine-build.h"
 
 static int DetectEngineHttpUATest(
         const uint8_t *buf, const uint32_t buf_len, const char *sig, const bool expect)
diff --git a/src/tests/detect-snmp-community.c b/src/tests/detect-snmp-community.c
index 3589255a3f87..9b978168dd28 100644
--- a/src/tests/detect-snmp-community.c
+++ b/src/tests/detect-snmp-community.c
@@ -22,6 +22,7 @@
 #include "detect-parse.h"
 #include "flow-util.h"
 #include "stream-tcp.h"
+#include "detect-engine-build.h"
 
 static int DetectSNMPCommunityTest(void)
 {
diff --git a/src/tests/detect-ssl-state.c b/src/tests/detect-ssl-state.c
index ef594d035546..eba25b07d2c5 100644
--- a/src/tests/detect-ssl-state.c
+++ b/src/tests/detect-ssl-state.c
@@ -22,6 +22,8 @@
  *
  */
 
+#include "detect-engine-build.h"
+
 static int DetectSslStateTest01(void)
 {
     DetectSslStateData *ssd = DetectSslStateParse("client_hello");
diff --git a/src/tests/detect-ssl-version.c b/src/tests/detect-ssl-version.c
index 2e16b2b0337a..3923ff8d67ef 100644
--- a/src/tests/detect-ssl-version.c
+++ b/src/tests/detect-ssl-version.c
@@ -22,6 +22,8 @@
  *
  */
 
+#include "detect-engine-build.h"
+
 /**
  * \test DetectSslVersionTestParse01 is a test to make sure that we parse the
  *      "ssl_version" option correctly when given valid ssl_version option
diff --git a/src/tests/detect-template-buffer.c b/src/tests/detect-template-buffer.c
index 9fca91b3ce50..7e04025a96da 100644
--- a/src/tests/detect-template-buffer.c
+++ b/src/tests/detect-template-buffer.c
@@ -22,6 +22,7 @@
 #include "../detect-parse.h"
 #include "../flow-util.h"
 #include "../stream-tcp.h"
+#include "../detect-engine-build.h"
 
 static int DetectTemplateBufferTest(void)
 {
diff --git a/src/tests/detect-tls-cert-fingerprint.c b/src/tests/detect-tls-cert-fingerprint.c
index 7da2daa07fda..735a7ab771ef 100644
--- a/src/tests/detect-tls-cert-fingerprint.c
+++ b/src/tests/detect-tls-cert-fingerprint.c
@@ -22,6 +22,8 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
 /**
  * \test Test that a signature containing tls_cert_fingerprint is correctly parsed
  *       and that the keyword is registered.
diff --git a/src/tests/detect-tls-cert-issuer.c b/src/tests/detect-tls-cert-issuer.c
index 118ff04575d7..f46520d1a9cc 100644
--- a/src/tests/detect-tls-cert-issuer.c
+++ b/src/tests/detect-tls-cert-issuer.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test that a signature containing a tls_cert_issuer is correctly parsed
  *       and that the keyword is registered.
diff --git a/src/tests/detect-tls-cert-serial.c b/src/tests/detect-tls-cert-serial.c
index 2acf5c884f69..fbcb9ceb6c06 100644
--- a/src/tests/detect-tls-cert-serial.c
+++ b/src/tests/detect-tls-cert-serial.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test that a signature containing tls.cert_serial is correctly parsed
  *       and that the keyword is registered.
diff --git a/src/tests/detect-tls-cert-subject.c b/src/tests/detect-tls-cert-subject.c
index 29e514efab5e..5f7c1f812def 100644
--- a/src/tests/detect-tls-cert-subject.c
+++ b/src/tests/detect-tls-cert-subject.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test that a signature containing a tls.cert_subject is correctly parsed
  *       and that the keyword is registered.
diff --git a/src/tests/detect-tls-cert-validity.c b/src/tests/detect-tls-cert-validity.c
index 3865e3b59d85..fa05412553f7 100644
--- a/src/tests/detect-tls-cert-validity.c
+++ b/src/tests/detect-tls-cert-validity.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test This is a test for a valid value 1430000000.
  *
diff --git a/src/tests/detect-tls-certs.c b/src/tests/detect-tls-certs.c
index 6521e714ca36..dac9c9eadf62 100644
--- a/src/tests/detect-tls-certs.c
+++ b/src/tests/detect-tls-certs.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test that a signature containing tls.certs is correctly parsed
  *       and that the keyword is registred.
diff --git a/src/tests/detect-tls-ja3-hash.c b/src/tests/detect-tls-ja3-hash.c
index a49b849acf85..1a562fe7094c 100644
--- a/src/tests/detect-tls-ja3-hash.c
+++ b/src/tests/detect-tls-ja3-hash.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test matching on a simple client hello packet
  */
diff --git a/src/tests/detect-tls-ja3-string.c b/src/tests/detect-tls-ja3-string.c
index 048744678b3d..ef3dcef0ff4b 100644
--- a/src/tests/detect-tls-ja3-string.c
+++ b/src/tests/detect-tls-ja3-string.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test matching on a simple client hello packet
  */
diff --git a/src/tests/detect-tls-ja3s-hash.c b/src/tests/detect-tls-ja3s-hash.c
index ed8019105aa0..cf9fedec274a 100644
--- a/src/tests/detect-tls-ja3s-hash.c
+++ b/src/tests/detect-tls-ja3s-hash.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test matching on a JA3S hash from a ServerHello record
  */
diff --git a/src/tests/detect-tls-ja3s-string.c b/src/tests/detect-tls-ja3s-string.c
index 86a08fb38d73..e61ccb7bd337 100644
--- a/src/tests/detect-tls-ja3s-string.c
+++ b/src/tests/detect-tls-ja3s-string.c
@@ -15,6 +15,9 @@
  * 02110-1301, USA.
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test matching on a simple client hello packet
  */
diff --git a/src/tests/detect-tls-sni.c b/src/tests/detect-tls-sni.c
index 78824007594d..a9b45e894e74 100644
--- a/src/tests/detect-tls-sni.c
+++ b/src/tests/detect-tls-sni.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test Test matching on a simple google.com SNI
  */
diff --git a/src/tests/detect-tls-version.c b/src/tests/detect-tls-version.c
index 946a459bcf0d..a0a42909d476 100644
--- a/src/tests/detect-tls-version.c
+++ b/src/tests/detect-tls-version.c
@@ -22,6 +22,9 @@
  *
  */
 
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
 /**
  * \test DetectTlsVersionTestParse01 is a test to make sure that we parse the "id"
  *       option correctly when given valid id option
diff --git a/src/tests/detect-ttl.c b/src/tests/detect-ttl.c
index 0d014582f821..d8052ecd7a0b 100644
--- a/src/tests/detect-ttl.c
+++ b/src/tests/detect-ttl.c
@@ -18,6 +18,7 @@
 
 #include "../detect-engine.h"
 #include "../util-unittest.h"
+#include "../detect-engine-build.h"
 
 /**
  * \test DetectTtlParseTest01 is a test for setting up an valid ttl value.
diff --git a/src/tests/detect.c b/src/tests/detect.c
index 3445459dfde5..30d653fa9e77 100644
--- a/src/tests/detect.c
+++ b/src/tests/detect.c
@@ -21,10 +21,12 @@
 #include "../conf-yaml-loader.h"
 #include "../detect-parse.h"
 #include "../detect-engine-content-inspection.h"
+#include "../detect-engine-build.h"
 #include "../pkt-var.h"
 #include "../flow-util.h"
 #include "../stream-tcp-reassemble.h"
 #include "../util-unittest.h"
+#include "../util-var-name.h"
 #include "../util-unittest-helper.h"
 
 static const char *dummy_conf_string =
diff --git a/src/tests/fuzz/fuzz_applayerparserparse.c b/src/tests/fuzz/fuzz_applayerparserparse.c
index 1a501eb430e1..b1bfdbdee153 100644
--- a/src/tests/fuzz/fuzz_applayerparserparse.c
+++ b/src/tests/fuzz/fuzz_applayerparserparse.c
@@ -5,6 +5,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "app-layer-detect-proto.h"
 #include "flow-util.h"
 #include "app-layer-parser.h"
diff --git a/src/tests/fuzz/fuzz_applayerprotodetectgetproto.c b/src/tests/fuzz/fuzz_applayerprotodetectgetproto.c
index 7f30d459e84a..6106a5905e7c 100644
--- a/src/tests/fuzz/fuzz_applayerprotodetectgetproto.c
+++ b/src/tests/fuzz/fuzz_applayerprotodetectgetproto.c
@@ -6,6 +6,7 @@
 
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "app-layer-detect-proto.h"
 #include "flow-util.h"
 #include "app-layer-parser.h"
diff --git a/src/tests/fuzz/fuzz_confyamlloadstring.c b/src/tests/fuzz/fuzz_confyamlloadstring.c
index 2f897ccc389c..f5f9ed39831e 100644
--- a/src/tests/fuzz/fuzz_confyamlloadstring.c
+++ b/src/tests/fuzz/fuzz_confyamlloadstring.c
@@ -6,6 +6,7 @@
 
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "conf-yaml-loader.h"
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
diff --git a/src/tests/fuzz/fuzz_decodepcapfile.c b/src/tests/fuzz/fuzz_decodepcapfile.c
index c0c5ae4e5248..3bf60af573bf 100644
--- a/src/tests/fuzz/fuzz_decodepcapfile.c
+++ b/src/tests/fuzz/fuzz_decodepcapfile.c
@@ -5,6 +5,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "app-layer-detect-proto.h"
 #include "defrag.h"
 #include "tm-modules.h"
@@ -12,6 +13,7 @@
 #include "source-pcap-file.h"
 #include "util-unittest-helper.h"
 #include "conf-yaml-loader.h"
+#include "util-time.h"
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/src/tests/fuzz/fuzz_mimedecparseline.c b/src/tests/fuzz/fuzz_mimedecparseline.c
index e07f5ea31dbb..5c79d8e52056 100644
--- a/src/tests/fuzz/fuzz_mimedecparseline.c
+++ b/src/tests/fuzz/fuzz_mimedecparseline.c
@@ -6,6 +6,7 @@
 
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "util-decode-mime.h"
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
diff --git a/src/tests/fuzz/fuzz_predefpcap_aware.c b/src/tests/fuzz/fuzz_predefpcap_aware.c
index fbdc5648c0fb..80dc3bb7e1e0 100644
--- a/src/tests/fuzz/fuzz_predefpcap_aware.c
+++ b/src/tests/fuzz/fuzz_predefpcap_aware.c
@@ -12,6 +12,7 @@
 #include "app-layer.h"
 #include "tm-queuehandlers.h"
 #include "util-cidr.h"
+#include "util-profiling.h"
 #include "util-proto-name.h"
 #include "detect-engine-tag.h"
 #include "detect-engine-threshold.h"
@@ -23,6 +24,8 @@
 #include "conf-yaml-loader.h"
 #include "pkt-var.h"
 #include "flow-util.h"
+#include "tm-modules.h"
+#include "tmqh-packetpool.h"
 
 #include <fuzz_pcap.h>
 
diff --git a/src/tests/fuzz/fuzz_sigpcap.c b/src/tests/fuzz/fuzz_sigpcap.c
index 5c4fb02eae3f..04f2be6a1f51 100644
--- a/src/tests/fuzz/fuzz_sigpcap.c
+++ b/src/tests/fuzz/fuzz_sigpcap.c
@@ -12,6 +12,7 @@
 #include "app-layer.h"
 #include "tm-queuehandlers.h"
 #include "util-cidr.h"
+#include "util-profiling.h"
 #include "util-proto-name.h"
 #include "detect-engine-tag.h"
 #include "detect-engine-threshold.h"
@@ -23,6 +24,9 @@
 #include "conf-yaml-loader.h"
 #include "pkt-var.h"
 #include "flow-util.h"
+#include "flow-worker.h"
+#include "tm-modules.h"
+#include "tmqh-packetpool.h"
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/src/tests/fuzz/fuzz_sigpcap_aware.c b/src/tests/fuzz/fuzz_sigpcap_aware.c
index fb69d66189db..611dba1e2933 100644
--- a/src/tests/fuzz/fuzz_sigpcap_aware.c
+++ b/src/tests/fuzz/fuzz_sigpcap_aware.c
@@ -12,6 +12,7 @@
 #include "app-layer.h"
 #include "tm-queuehandlers.h"
 #include "util-cidr.h"
+#include "util-profiling.h"
 #include "util-proto-name.h"
 #include "detect-engine-tag.h"
 #include "detect-engine-threshold.h"
@@ -23,6 +24,9 @@
 #include "conf-yaml-loader.h"
 #include "pkt-var.h"
 #include "flow-util.h"
+#include "flow-worker.h"
+#include "tm-modules.h"
+#include "tmqh-packetpool.h"
 
 #include <fuzz_pcap.h>
 
diff --git a/src/threadvars.h b/src/threadvars.h
index 8b604445ed55..3827a73fe72a 100644
--- a/src/threadvars.h
+++ b/src/threadvars.h
@@ -24,10 +24,8 @@
 #ifndef __THREADVARS_H__
 #define __THREADVARS_H__
 
-#include "util-affinity.h"
 #include "tm-queues.h"
 #include "counters.h"
-#include "threads.h"
 #include "packet-queue.h"
 #include "util-atomic.h"
 
diff --git a/src/tm-threads.c b/src/tm-threads.c
index 36d9e4ad0fad..80915f33dd20 100644
--- a/src/tm-threads.c
+++ b/src/tm-threads.c
@@ -35,6 +35,7 @@
 #include "tm-threads.h"
 #include "tmqh-packetpool.h"
 #include "threads.h"
+#include "util-affinity.h"
 #include "util-debug.h"
 #include "util-privs.h"
 #include "util-cpu.h"
diff --git a/src/tmqh-packetpool.h b/src/tmqh-packetpool.h
index 2b6b90b04e95..0cabb69dfd2a 100644
--- a/src/tmqh-packetpool.h
+++ b/src/tmqh-packetpool.h
@@ -26,7 +26,6 @@
 
 #include "decode.h"
 #include "threads.h"
-#include "util-atomic.h"
 
     /* Return stack, onto which other threads free packets. */
 typedef struct PktPoolLockedStack_{
diff --git a/src/unix-manager.c b/src/unix-manager.c
index 9213039db93c..0f0c846c88a5 100644
--- a/src/unix-manager.c
+++ b/src/unix-manager.c
@@ -28,6 +28,7 @@
 #include "tm-threads.h"
 #include "runmodes.h"
 #include "conf.h"
+#include "runmode-unix-socket.h"
 
 #include "output-json-stats.h"
 
diff --git a/src/util-base64.h b/src/util-base64.h
index ac78d0806dc6..3b66cddb55cf 100644
--- a/src/util-base64.h
+++ b/src/util-base64.h
@@ -26,23 +26,10 @@
 #define __UTIL_BASE64_H_
 
 #include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
 
-#include "detect.h"
-#include "detect-parse.h"
 
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
 
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
 
-#include "util-debug.h"
-#include "util-spm-bm.h"
 
 /* Constants */
 #define ASCII_BLOCK         3
diff --git a/src/util-conf.c b/src/util-conf.c
index a135b4b3884a..4abdeca7c840 100644
--- a/src/util-conf.c
+++ b/src/util-conf.c
@@ -23,6 +23,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "conf.h"
 #include "runmodes.h"
 #include "util-conf.h"
diff --git a/src/util-debug-filters.c b/src/util-debug-filters.c
index a94db699a5d2..cbf8d5426211 100644
--- a/src/util-debug-filters.c
+++ b/src/util-debug-filters.c
@@ -24,6 +24,7 @@
  */
 
 #include "suricata-common.h"
+#include "util-debug-filters.h"
 
 /* both of these are defined in util-debug.c */
 extern int sc_log_module_initialized;
diff --git a/src/util-debug-filters.h b/src/util-debug-filters.h
index bbbcf9afc2da..5c6764c71207 100644
--- a/src/util-debug-filters.h
+++ b/src/util-debug-filters.h
@@ -25,8 +25,6 @@
 #define __DEBUG_FILTERS_H__
 
 #include <pthread.h>
-#include "threads.h"
-#include "util-mem.h"
 
 /**
  * \brief Enum that holds the different kinds of filters available
diff --git a/src/util-debug.c b/src/util-debug.c
index 3c8a95f35f55..f2beabd6cbdd 100644
--- a/src/util-debug.c
+++ b/src/util-debug.c
@@ -29,6 +29,7 @@
 #include "util-error.h"
 #include "util-enum.h"
 #include "util-debug-filters.h"
+#include "suricata.h"
 
 #include "decode.h"
 #include "detect.h"
@@ -42,6 +43,7 @@
 
 #include "util-unittest.h"
 #include "util-syslog.h"
+#include "util-time.h"
 #include "rust.h"
 
 
diff --git a/src/util-debug.h b/src/util-debug.h
index c23256938a11..2e4a69f34eae 100644
--- a/src/util-debug.h
+++ b/src/util-debug.h
@@ -27,10 +27,8 @@
 #include "suricata-common.h"
 
 #include "threads.h"
-#include "util-enum.h"
 #include "util-error.h"
 #include "util-debug-filters.h"
-#include "util-atomic.h"
 
 /**
  * \brief ENV vars that can be used to set the properties for the logging module
diff --git a/src/util-decode-mime.h b/src/util-decode-mime.h
index d6aeb1547236..657a90b9d61b 100644
--- a/src/util-decode-mime.h
+++ b/src/util-decode-mime.h
@@ -30,9 +30,7 @@
 #include <stdlib.h>
 #include <stdint.h>
 
-#include "suricata.h"
 #include "util-base64.h"
-#include "util-debug.h"
 
 /* Content Flags */
 #define CTNT_IS_MSG           1
diff --git a/src/util-device.h b/src/util-device.h
index b43479b06aa6..ec6fc65bcd39 100644
--- a/src/util-device.h
+++ b/src/util-device.h
@@ -19,7 +19,6 @@
 #define __UTIL_DEVICE_H__
 
 #include "queue.h"
-#include "unix-manager.h"
 
 #define OFFLOAD_FLAG_SG     (1<<0)
 #define OFFLOAD_FLAG_TSO    (1<<1)
diff --git a/src/util-dpdk-i40e.h b/src/util-dpdk-i40e.h
index 3d77b1152f7d..6b1eb7fd13cf 100644
--- a/src/util-dpdk-i40e.h
+++ b/src/util-dpdk-i40e.h
@@ -25,7 +25,6 @@
 #define UTIL_DPDK_I40E_H
 
 #include "suricata-common.h"
-#include "util-dpdk.h"
 
 #ifdef HAVE_DPDK
 
diff --git a/src/util-dpdk-ice.h b/src/util-dpdk-ice.h
index 0049dbcba59e..cdc2185cca12 100644
--- a/src/util-dpdk-ice.h
+++ b/src/util-dpdk-ice.h
@@ -25,7 +25,6 @@
 #define UTIL_DPDK_ICE_H
 
 #include "suricata-common.h"
-#include "util-dpdk.h"
 
 #ifdef HAVE_DPDK
 
diff --git a/src/util-dpdk-ixgbe.h b/src/util-dpdk-ixgbe.h
index bbd984acd171..3cb18fa55d75 100644
--- a/src/util-dpdk-ixgbe.h
+++ b/src/util-dpdk-ixgbe.h
@@ -25,7 +25,6 @@
 #define UTIL_DPDK_IXGBE_H
 
 #include "suricata-common.h"
-#include "util-dpdk.h"
 
 #ifdef HAVE_DPDK
 
diff --git a/src/util-ebpf.c b/src/util-ebpf.c
index c616346f2ac8..407a436013dc 100644
--- a/src/util-ebpf.c
+++ b/src/util-ebpf.c
@@ -42,6 +42,7 @@
 #include <sys/resource.h>
 
 #include "util-ebpf.h"
+#include "util-affinity.h"
 #include "util-cpu.h"
 #include "util-device.h"
 
diff --git a/src/util-ebpf.h b/src/util-ebpf.h
index 2f411ddeadfc..39e154dda1cb 100644
--- a/src/util-ebpf.h
+++ b/src/util-ebpf.h
@@ -24,6 +24,8 @@
 #ifndef __UTIL_EBPF_H__
 #define __UTIL_EBPF_H__
 
+#include "flow-bypass.h"
+
 #ifdef HAVE_PACKET_EBPF
 
 #define XDP_FLAGS_UPDATE_IF_NOEXIST	(1U << 0)
@@ -31,7 +33,6 @@
 #define XDP_FLAGS_DRV_MODE		(1U << 2)
 #define XDP_FLAGS_HW_MODE		(1U << 3)
 
-#include "flow-bypass.h"
 
 struct flowv4_keys {
     __be32 src;
diff --git a/src/util-exception-policy.c b/src/util-exception-policy.c
index a21490070207..9afddaee42ad 100644
--- a/src/util-exception-policy.c
+++ b/src/util-exception-policy.c
@@ -20,6 +20,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "util-exception-policy.h"
 #include "util-misc.h"
 
diff --git a/src/util-ioctl.c b/src/util-ioctl.c
index 83ae688f6305..e0f7009e3297 100644
--- a/src/util-ioctl.c
+++ b/src/util-ioctl.c
@@ -25,6 +25,7 @@
 #include "suricata-common.h"
 #include "conf.h"
 #include "util-device.h"
+#include "decode-sll.h"
 
 #ifdef HAVE_SYS_IOCTL_H
 #include <sys/ioctl.h>
diff --git a/src/util-ioctl.h b/src/util-ioctl.h
index 508843897246..2d0c74740dd8 100644
--- a/src/util-ioctl.h
+++ b/src/util-ioctl.h
@@ -24,10 +24,6 @@
 #include "suricata-common.h"
 #include "util-device.h"
 
-#ifdef OS_WIN32
-#include "win32-syscall.h"
-#endif
-
 int GetIfaceMTU(const char *pcap_dev);
 int GetIfaceMaxPacketSize(const char *pcap_dev);
 int GetIfaceOffloading(const char *dev, int csum, int other);
diff --git a/src/util-logopenfile.c b/src/util-logopenfile.c
index 8e0f89dd16ac..d46168458656 100644
--- a/src/util-logopenfile.c
+++ b/src/util-logopenfile.c
@@ -25,10 +25,12 @@
  */
 
 #include "suricata-common.h" /* errno.h, string.h, etc. */
+#include "util-logopenfile.h"
+#include "suricata.h"
 #include "conf.h"            /* ConfNode, etc. */
 #include "output.h"          /* DEFAULT_LOG_* */
 #include "util-byte.h"
-#include "util-logopenfile.h"
+#include "util-time.h"
 
 #if defined(HAVE_SYS_UN_H) && defined(HAVE_SYS_SOCKET_H) && defined(HAVE_SYS_TYPES_H)
 #define BUILD_WITH_UNIXSOCKET
diff --git a/src/util-lua.c b/src/util-lua.c
index 86969348f9d2..084a3e132dd2 100644
--- a/src/util-lua.c
+++ b/src/util-lua.c
@@ -35,6 +35,7 @@
 
 #include "util-print.h"
 #include "util-unittest.h"
+#include "util-luajit.h"
 
 #include "util-debug.h"
 
diff --git a/src/util-lua.h b/src/util-lua.h
index 273b786eae28..fa4737955518 100644
--- a/src/util-lua.h
+++ b/src/util-lua.h
@@ -36,7 +36,6 @@ typedef void lua_State;
 #include <lualib.h>
 #include <lauxlib.h>
 
-#include "util-luajit.h"
 
 typedef struct LuaStreamingBuffer_ {
     const uint8_t *data;
diff --git a/src/util-luajit.c b/src/util-luajit.c
index 31e5117b7358..5ecaf9447e45 100644
--- a/src/util-luajit.c
+++ b/src/util-luajit.c
@@ -28,6 +28,7 @@
 #include "conf.h"
 #include "util-pool.h"
 #include "util-lua.h"
+#include "util-luajit.h"
 
 /** \brief lua_State pool
  *
diff --git a/src/util-luajit.h b/src/util-luajit.h
index 5aa810b1eaa9..b90cef431b47 100644
--- a/src/util-luajit.h
+++ b/src/util-luajit.h
@@ -26,6 +26,8 @@
 
 #ifdef HAVE_LUAJIT
 
+#include "util-lua.h"
+
 int LuajitSetupStatesPool(void);
 void LuajitFreeStatesPool(void);
 lua_State *LuajitGetState(void);
diff --git a/src/util-memcmp.h b/src/util-memcmp.h
index bb6df864966b..1ab636abae2e 100644
--- a/src/util-memcmp.h
+++ b/src/util-memcmp.h
@@ -30,6 +30,7 @@
 #define __UTIL_MEMCMP_H__
 
 #include "util-optimize.h"
+#include "suricata.h"
 
 /** \brief compare two patterns, converting the 2nd to lowercase
  *  \warning *ONLY* the 2nd pattern is converted to lowercase
diff --git a/src/util-misc.h b/src/util-misc.h
index 8ae730931af7..5bd2d03e1bca 100644
--- a/src/util-misc.h
+++ b/src/util-misc.h
@@ -24,7 +24,6 @@
 #ifndef __UTIL_MISC_H__
 #define __UTIL_MISC_H__
 
-#include "util-error.h"
 
 /**
  * \brief Generic API that can be used by all to log an
diff --git a/src/util-mpm-ac-bs.c b/src/util-mpm-ac-bs.c
index 3fd35bd44029..8a51c59811d2 100644
--- a/src/util-mpm-ac-bs.c
+++ b/src/util-mpm-ac-bs.c
@@ -51,6 +51,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 #include "util-mpm-ac-bs.h"
 
 #include "conf.h"
diff --git a/src/util-mpm-ac-ks.c b/src/util-mpm-ac-ks.c
index 5f6dbf9d328e..dc699a79c7c5 100644
--- a/src/util-mpm-ac-ks.c
+++ b/src/util-mpm-ac-ks.c
@@ -71,6 +71,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 
 #include "conf.h"
 #include "util-debug.h"
diff --git a/src/util-mpm-ac.c b/src/util-mpm-ac.c
index c6f5f9b0d44e..8b9f5107b9e8 100644
--- a/src/util-mpm-ac.c
+++ b/src/util-mpm-ac.c
@@ -51,6 +51,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 
 #include "conf.h"
 #include "util-debug.h"
diff --git a/src/util-mpm-hs.c b/src/util-mpm-hs.c
index 420c091dd1a2..2fff553bc7c5 100644
--- a/src/util-mpm-hs.c
+++ b/src/util-mpm-hs.c
@@ -30,6 +30,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-build.h"
 
 #include "conf.h"
 #include "util-debug.h"
diff --git a/src/util-plugin.c b/src/util-plugin.c
index f7a96fcbced4..6a59f257c367 100644
--- a/src/util-plugin.c
+++ b/src/util-plugin.c
@@ -17,6 +17,8 @@
 
 #include "suricata-common.h"
 #include "suricata-plugin.h"
+#include "suricata.h"
+#include "runmodes.h"
 #include "output-eve-syslog.h"
 #include "util-plugin.h"
 
diff --git a/src/util-plugin.h b/src/util-plugin.h
index cafe314f75a3..c958f2d79ccd 100644
--- a/src/util-plugin.h
+++ b/src/util-plugin.h
@@ -19,7 +19,6 @@
 #define __UTIL_PLUGIN_H__
 
 #include "suricata-plugin.h"
-#include "output-eve-syslog.h"
 
 void SCPluginsLoad(const char *capture_plugin_name, const char *capture_plugin_args);
 SCEveFileType *SCPluginFindFileType(const char *name);
diff --git a/src/util-pool-thread.h b/src/util-pool-thread.h
index b1ca22306d51..a67fdf5d64c2 100644
--- a/src/util-pool-thread.h
+++ b/src/util-pool-thread.h
@@ -39,6 +39,8 @@
 #ifndef __UTIL_POOL_THREAD_H__
 #define __UTIL_POOL_THREAD_H__
 
+#include "util-pool.h"
+
 struct PoolThreadElement_ {
     SCMutex lock;                   /**< lock, should have low contention */
     Pool *pool;                     /**< actual pool */
diff --git a/src/util-privs.h b/src/util-privs.h
index 1464731a1c33..6d1f0c60f988 100644
--- a/src/util-privs.h
+++ b/src/util-privs.h
@@ -37,8 +37,6 @@
 #define SCDropCaps(...)
 #define SCDropMainThreadCaps(...)
 #else
-#include "threadvars.h"
-#include "util-debug.h"
 #include <cap-ng.h>
 
 /**Drop the previliges of the given thread tv, based on the thread cap_flags
diff --git a/src/util-profiling-keywords.c b/src/util-profiling-keywords.c
index 417517529c98..3aba66c09400 100644
--- a/src/util-profiling-keywords.c
+++ b/src/util-profiling-keywords.c
@@ -36,6 +36,7 @@
 #include "util-byte.h"
 #include "util-profiling.h"
 #include "util-profiling-locks.h"
+#include "util-time.h"
 
 #ifdef PROFILING
 
diff --git a/src/util-profiling-prefilter.c b/src/util-profiling-prefilter.c
index 737eaf3fcc86..1831a5dd52d2 100644
--- a/src/util-profiling-prefilter.c
+++ b/src/util-profiling-prefilter.c
@@ -37,6 +37,7 @@
 #include "util-byte.h"
 #include "util-profiling.h"
 #include "util-profiling-locks.h"
+#include "util-time.h"
 
 #ifdef PROFILING
 
diff --git a/src/util-profiling-rulegroups.c b/src/util-profiling-rulegroups.c
index 11ef3bd569fd..1a89908cd462 100644
--- a/src/util-profiling-rulegroups.c
+++ b/src/util-profiling-rulegroups.c
@@ -36,6 +36,7 @@
 #include "util-byte.h"
 #include "util-profiling.h"
 #include "util-profiling-locks.h"
+#include "util-time.h"
 
 #ifdef PROFILING
 
diff --git a/src/util-profiling-rules.c b/src/util-profiling-rules.c
index af2cd9b43a77..6c3f31d967a2 100644
--- a/src/util-profiling-rules.c
+++ b/src/util-profiling-rules.c
@@ -35,6 +35,7 @@
 #include "util-byte.h"
 #include "util-profiling.h"
 #include "util-profiling-locks.h"
+#include "util-time.h"
 
 #ifdef PROFILING
 
@@ -54,7 +55,7 @@ typedef struct SCProfileData_ {
 
 typedef struct SCProfileDetectCtx_ {
     uint32_t size;
-    uint32_t id;
+    uint16_t id;
     SCProfileData *data;
     pthread_mutex_t data_m;
 } SCProfileDetectCtx;
diff --git a/src/util-profiling.c b/src/util-profiling.c
index faeb3b6cc2a3..3ed9750b92cc 100644
--- a/src/util-profiling.c
+++ b/src/util-profiling.c
@@ -348,7 +348,6 @@ static void DumpFlowWorker(FILE *fp)
 
 void SCProfilingDumpPacketStats(void)
 {
-    int i;
     FILE *fp;
     char totalstr[256];
     uint64_t total;
@@ -375,16 +374,15 @@ void SCProfilingDumpPacketStats(void)
     fprintf(fp, "%-6s   %-5s   %-12s   %-12s   %-12s   %-12s   %-12s  %-3s\n",
             "------", "-----", "----------", "------------", "------------", "-----------", "-----------", "---");
     total = 0;
-    for (i = 0; i < 257; i++) {
+    for (int i = 0; i < 257; i++) {
         SCProfilePacketData *pd = &packet_profile_data4[i];
         total += pd->tot;
         pd = &packet_profile_data6[i];
         total += pd->tot;
     }
 
-    for (i = 0; i < 257; i++) {
+    for (int i = 0; i < 257; i++) {
         SCProfilePacketData *pd = &packet_profile_data4[i];
-
         if (pd->cnt == 0) {
             continue;
         }
@@ -397,9 +395,8 @@ void SCProfilingDumpPacketStats(void)
             pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
     }
 
-    for (i = 0; i < 257; i++) {
+    for (int i = 0; i < 257; i++) {
         SCProfilePacketData *pd = &packet_profile_data6[i];
-
         if (pd->cnt == 0) {
             continue;
         }
@@ -431,14 +428,12 @@ void SCProfilingDumpPacketStats(void)
 #else
     fprintf(fp, "\n");
 #endif
-    int m;
     total = 0;
-    for (m = 0; m < TMM_SIZE; m++) {
+    for (int m = 0; m < TMM_SIZE; m++) {
         if (tmm_modules[m].flags & TM_FLAG_LOGAPI_TM)
             continue;
 
-        int p;
-        for (p = 0; p < 257; p++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p];
             total += pd->tot;
 
@@ -447,14 +442,12 @@ void SCProfilingDumpPacketStats(void)
         }
     }
 
-    for (m = 0; m < TMM_SIZE; m++) {
+    for (int m = 0; m < TMM_SIZE; m++) {
         if (tmm_modules[m].flags & TM_FLAG_LOGAPI_TM)
             continue;
 
-        int p;
-        for (p = 0; p < 257; p++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -474,14 +467,12 @@ void SCProfilingDumpPacketStats(void)
         }
     }
 
-    for (m = 0; m < TMM_SIZE; m++) {
+    for (int m = 0; m < TMM_SIZE; m++) {
         if (tmm_modules[m].flags & TM_FLAG_LOGAPI_TM)
             continue;
 
-        int p;
-        for (p = 0; p < 257; p++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_tmm_data6[m][p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -505,21 +496,18 @@ void SCProfilingDumpPacketStats(void)
             "--------------------", "------", "-----", "----------", "------------", "------------", "-----------");
 
     total = 0;
-    for (m = 0; m < ALPROTO_MAX; m++) {
-        int p;
-        for (p = 0; p < 257; p++) {
-            SCProfilePacketData *pd = &packet_profile_app_data4[m][p];
+    for (AppProto a = 0; a < ALPROTO_MAX; a++) {
+        for (int p = 0; p < 257; p++) {
+            SCProfilePacketData *pd = &packet_profile_app_data4[a][p];
             total += pd->tot;
 
-            pd = &packet_profile_app_data6[m][p];
+            pd = &packet_profile_app_data6[a][p];
             total += pd->tot;
         }
     }
-    for (m = 0; m < ALPROTO_MAX; m++) {
-        int p;
-        for (p = 0; p < 257; p++) {
-            SCProfilePacketData *pd = &packet_profile_app_data4[m][p];
-
+    for (AppProto a = 0; a < ALPROTO_MAX; a++) {
+        for (int p = 0; p < 257; p++) {
+            SCProfilePacketData *pd = &packet_profile_app_data4[a][p];
             if (pd->cnt == 0) {
                 continue;
             }
@@ -528,16 +516,17 @@ void SCProfilingDumpPacketStats(void)
             double percent = (long double)pd->tot /
                 (long double)total * 100;
 
-            fprintf(fp, "%-20s    IPv4     %3d  %12"PRIu64"     %12"PRIu64"   %12"PRIu64"  %12"PRIu64"  %12s  %-6.2f\n",
-                    AppProtoToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
+            fprintf(fp,
+                    "%-20s    IPv4     %3d  %12" PRIu64 "     %12" PRIu64 "   %12" PRIu64
+                    "  %12" PRIu64 "  %12s  %-6.2f\n",
+                    AppProtoToString(a), p, pd->cnt, pd->min, pd->max,
+                    (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
         }
     }
 
-    for (m = 0; m < ALPROTO_MAX; m++) {
-        int p;
-        for (p = 0; p < 257; p++) {
-            SCProfilePacketData *pd = &packet_profile_app_data6[m][p];
-
+    for (AppProto a = 0; a < ALPROTO_MAX; a++) {
+        for (int p = 0; p < 257; p++) {
+            SCProfilePacketData *pd = &packet_profile_app_data6[a][p];
             if (pd->cnt == 0) {
                 continue;
             }
@@ -546,17 +535,18 @@ void SCProfilingDumpPacketStats(void)
             double percent = (long double)pd->tot /
                 (long double)total * 100;
 
-            fprintf(fp, "%-20s    IPv6     %3d  %12"PRIu64"     %12"PRIu64"   %12"PRIu64"  %12"PRIu64"  %12s  %-6.2f\n",
-                    AppProtoToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
+            fprintf(fp,
+                    "%-20s    IPv6     %3d  %12" PRIu64 "     %12" PRIu64 "   %12" PRIu64
+                    "  %12" PRIu64 "  %12s  %-6.2f\n",
+                    AppProtoToString(a), p, pd->cnt, pd->min, pd->max,
+                    (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
         }
     }
 
     /* proto detect output */
     {
-        int p;
-        for (p = 0; p < 257; p++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_app_pd_data4[p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -566,9 +556,8 @@ void SCProfilingDumpPacketStats(void)
                     "Proto detect", p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr);
         }
 
-        for (p = 0; p < 257; p++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_app_pd_data6[p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -580,9 +569,8 @@ void SCProfilingDumpPacketStats(void)
     }
 
     total = 0;
-    for (m = 0; m < PROF_DETECT_SIZE; m++) {
-        int p;
-        for (p = 0; p < 257; p++) {
+    for (int m = 0; m < PROF_DETECT_SIZE; m++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_detect_data4[m][p];
             total += pd->tot;
 
@@ -609,12 +597,11 @@ void SCProfilingDumpPacketStats(void)
     fprintf(fp, "\n");
 #endif
     total = 0;
-    for (m = 0; m < TMM_SIZE; m++) {
+    for (int m = 0; m < TMM_SIZE; m++) {
         if (!(tmm_modules[m].flags & TM_FLAG_LOGAPI_TM))
             continue;
 
-        int p;
-        for (p = 0; p < 257; p++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p];
             total += pd->tot;
 
@@ -623,14 +610,12 @@ void SCProfilingDumpPacketStats(void)
         }
     }
 
-    for (m = 0; m < TMM_SIZE; m++) {
+    for (int m = 0; m < TMM_SIZE; m++) {
         if (!(tmm_modules[m].flags & TM_FLAG_LOGAPI_TM))
             continue;
 
-        int p;
-        for (p = 0; p < 257; p++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -650,14 +635,12 @@ void SCProfilingDumpPacketStats(void)
         }
     }
 
-    for (m = 0; m < TMM_SIZE; m++) {
+    for (int m = 0; m < TMM_SIZE; m++) {
         if (!(tmm_modules[m].flags & TM_FLAG_LOGAPI_TM))
             continue;
 
-        int p;
-        for (p = 0; p < 257; p++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_tmm_data6[m][p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -674,9 +657,8 @@ void SCProfilingDumpPacketStats(void)
     fprintf(fp, "\nLogger/output stats:\n");
 
     total = 0;
-    for (m = 0; m < LOGGER_SIZE; m++) {
-        int p;
-        for (p = 0; p < 256; p++) {
+    for (int m = 0; m < LOGGER_SIZE; m++) {
+        for (int p = 0; p < 256; p++) {
             SCProfilePacketData *pd = &packet_profile_log_data4[m][p];
             total += pd->tot;
             pd = &packet_profile_log_data6[m][p];
@@ -688,11 +670,9 @@ void SCProfilingDumpPacketStats(void)
             "Logger", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot");
     fprintf(fp, "%-24s   %-6s   %-5s   %-12s   %-12s   %-12s   %-12s   %-12s\n",
             "------------------------", "------", "-----", "----------", "------------", "------------", "-----------", "-----------");
-    for (m = 0; m < LOGGER_SIZE; m++) {
-        int p;
-        for (p = 0; p < 256; p++) {
+    for (int m = 0; m < LOGGER_SIZE; m++) {
+        for (int p = 0; p < 256; p++) {
             SCProfilePacketData *pd = &packet_profile_log_data4[m][p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -705,11 +685,9 @@ void SCProfilingDumpPacketStats(void)
                     PacketProfileLoggertIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
         }
     }
-    for (m = 0; m < LOGGER_SIZE; m++) {
-        int p;
-        for (p = 0; p < 256; p++) {
+    for (int m = 0; m < LOGGER_SIZE; m++) {
+        for (int p = 0; p < 256; p++) {
             SCProfilePacketData *pd = &packet_profile_log_data6[m][p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -726,9 +704,8 @@ void SCProfilingDumpPacketStats(void)
     fprintf(fp, "\nGeneral detection engine stats:\n");
 
     total = 0;
-    for (m = 0; m < PROF_DETECT_SIZE; m++) {
-        int p;
-        for (p = 0; p < 257; p++) {
+    for (int m = 0; m < PROF_DETECT_SIZE; m++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_detect_data4[m][p];
             total += pd->tot;
             pd = &packet_profile_detect_data6[m][p];
@@ -740,11 +717,9 @@ void SCProfilingDumpPacketStats(void)
             "Detection phase", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot");
     fprintf(fp, "%-24s   %-6s   %-5s   %-12s   %-12s   %-12s   %-12s   %-12s\n",
             "------------------------", "------", "-----", "----------", "------------", "------------", "-----------", "-----------");
-    for (m = 0; m < PROF_DETECT_SIZE; m++) {
-        int p;
-        for (p = 0; p < 257; p++) {
+    for (int m = 0; m < PROF_DETECT_SIZE; m++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_detect_data4[m][p];
-
             if (pd->cnt == 0) {
                 continue;
             }
@@ -757,11 +732,9 @@ void SCProfilingDumpPacketStats(void)
                     PacketProfileDetectIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent);
         }
     }
-    for (m = 0; m < PROF_DETECT_SIZE; m++) {
-        int p;
-        for (p = 0; p < 257; p++) {
+    for (int m = 0; m < PROF_DETECT_SIZE; m++) {
+        for (int p = 0; p < 257; p++) {
             SCProfilePacketData *pd = &packet_profile_detect_data6[m][p];
-
             if (pd->cnt == 0) {
                 continue;
             }
diff --git a/src/util-profiling.h b/src/util-profiling.h
index ee0a88b5a5c3..3ef032d5d862 100644
--- a/src/util-profiling.h
+++ b/src/util-profiling.h
@@ -27,8 +27,6 @@
 
 #ifdef PROFILING
 
-#include "util-profiling-locks.h"
-#include "util-cpu.h"
 
 extern int profiling_rules_enabled;
 extern int profiling_packets_enabled;
diff --git a/src/util-random.c b/src/util-random.c
index 1bade5428b0f..cac3f2864d26 100644
--- a/src/util-random.c
+++ b/src/util-random.c
@@ -25,6 +25,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "util-random.h"
 
 
diff --git a/src/util-rohash.h b/src/util-rohash.h
index 720eace5f60a..3b044274a54b 100644
--- a/src/util-rohash.h
+++ b/src/util-rohash.h
@@ -24,7 +24,6 @@
 #ifndef __UTIL_ROHASH_H__
 #define __UTIL_ROHASH_H__
 
-#include "queue.h"
 
 typedef struct ROHashTable_ {
     uint8_t locked;
diff --git a/src/util-spm-bm.h b/src/util-spm-bm.h
index 0512b096177b..de7cc492e6d9 100644
--- a/src/util-spm-bm.h
+++ b/src/util-spm-bm.h
@@ -26,7 +26,6 @@
 #define __UTIL_SPM_BM__
 
 #include "suricata-common.h"
-#include "suricata.h"
 
 #define ALPHABET_SIZE 256
 
diff --git a/src/util-spm-bs.h b/src/util-spm-bs.h
index 1e97f0baa07c..ddd930239052 100644
--- a/src/util-spm-bs.h
+++ b/src/util-spm-bs.h
@@ -26,7 +26,6 @@
 #define __UTIL_SPM_BS__
 
 #include "suricata-common.h"
-#include "suricata.h"
 
 uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint16_t);
 uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint16_t);
diff --git a/src/util-spm-bs2bm.h b/src/util-spm-bs2bm.h
index 99cd7abfd780..74df96aae1e2 100644
--- a/src/util-spm-bs2bm.h
+++ b/src/util-spm-bs2bm.h
@@ -25,7 +25,6 @@
 #define __UTIL_SPM_BS2BM__
 
 #include "suricata-common.h"
-#include "suricata.h"
 
 #define ALPHABET_SIZE 256
 
diff --git a/src/util-spm.h b/src/util-spm.h
index 6e4372f40a39..ae3fe7f025d2 100644
--- a/src/util-spm.h
+++ b/src/util-spm.h
@@ -25,8 +25,6 @@
 #define __UTIL_SPM_H__
 
 #include "util-spm-bs.h"
-#include "util-spm-bs2bm.h"
-#include "util-spm-bm.h"
 
 enum {
     SPM_BM, /* Boyer-Moore */
diff --git a/src/util-syslog.h b/src/util-syslog.h
index ebbc8478c0d5..473057a102a0 100644
--- a/src/util-syslog.h
+++ b/src/util-syslog.h
@@ -25,6 +25,8 @@
 #ifndef UTIL_SYSLOG_H
 #define	UTIL_SYSLOG_H
 
+#include "util-enum.h"
+
 SCEnumCharMap *SCSyslogGetFacilityMap(void);
 SCEnumCharMap *SCSyslogGetLogLevelMap(void);
 
diff --git a/src/util-thash.h b/src/util-thash.h
index 34fa9c20a44b..644d7ac2018e 100644
--- a/src/util-thash.h
+++ b/src/util-thash.h
@@ -26,8 +26,6 @@
 #ifndef __THASH_H__
 #define __THASH_H__
 
-#include "decode.h"
-#include "util-storage.h"
 
 /** Spinlocks or Mutex for the buckets. */
 //#define HRLOCK_SPIN
diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c
index 84dd61ecd1f1..9b63e8447d89 100644
--- a/src/util-threshold-config.c
+++ b/src/util-threshold-config.c
@@ -41,6 +41,7 @@
 #include "detect-engine-threshold.h"
 #include "detect-threshold.h"
 #include "detect-parse.h"
+#include "detect-engine-build.h"
 
 #include "conf.h"
 #include "util-threshold-config.h"
diff --git a/src/util-time.c b/src/util-time.c
index dacd01d8d5e9..8ab120729138 100644
--- a/src/util-time.c
+++ b/src/util-time.c
@@ -59,10 +59,12 @@
 #endif
 
 #include "suricata-common.h"
+#include "suricata.h"
 #include "detect.h"
 #include "threads.h"
 #include "tm-threads.h"
 #include "util-debug.h"
+#include "util-time.h"
 
 #ifdef UNITTESTS
 static struct timeval current_time = { 0, 0 };
diff --git a/src/util-unittest-helper.c b/src/util-unittest-helper.c
index 493c7cae3210..05e313727706 100644
--- a/src/util-unittest-helper.c
+++ b/src/util-unittest-helper.c
@@ -36,6 +36,7 @@
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-sigorder.h"
+#include "detect-engine-build.h"
 
 #include "stream-tcp.h"
 #include "stream-tcp-private.h"
diff --git a/src/util-vector.h b/src/util-vector.h
deleted file mode 100644
index c826964dd539..000000000000
--- a/src/util-vector.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/* Copyright (C) 2007-2011 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Victor Julien <victor@inliniac.net>
- */
-
-#ifndef __UTIL_VECTOR_H__
-#define __UTIL_VECTOR_H__
-
-#if defined(__SSE3__)
-
-#include <pmmintrin.h>
-
-typedef struct Vector_ {
-    union {
-        __m128i v;          /**< vector */
-        uint8_t c[16];      /**< character */
-        uint16_t w[8];      /**< word */
-        uint32_t dw[4];     /**< double word */
-        uint64_t qw[2];     /**< quad word */
-    };
-} Vector __attribute((aligned(16)));
-
-#endif /* defined(__SSE3__) */
-
-#endif /* __UTIL_VECTOR_H__ */