diff --git a/scripts/cppclean_check.py b/scripts/cppclean_check.py
index 6689ab392f..ccd2a4d9ea 100644
--- a/scripts/cppclean_check.py
+++ b/scripts/cppclean_check.py
@@ -17,12 +17,27 @@ for l in sys.stdin:
     if included == "conf.h" and includer == "src/suricata-plugin.h":
         # SCEveFileType structure field Init being a function pointer using a parameter ConfNode defined in conf.h
         continue
+    if included == "util-prefilter.h" and includer == "src/util-mpm.h":
+        # MpmTableElmt_ structure field Search being a function pointer using a parameter PrefilterRuleStore
+        continue
+    if included == "flow.h" and includer == "src/output-tx.h":
+        # TxLogger type being a function pointer using a parameter Flow
+        continue
     if included == "util-debug-filters.h" and includer == "src/util-debug.h":
         # Macro SCEnter using SCLogCheckFDFilterEntry defined in util-debug-filters.h
         continue
     if included == "util-spm-bs.h" and includer == "src/util-spm.h":
         # Macro SpmSearch using BasicSearch defined in util-spm-bs.h
         continue
+    if included == "util-cpu.h" and includer == "src/threads-profile.h":
+        # Macro SCSpinLock_profile using UtilCpuGetTicks
+        continue
+    if included == "util-profiling-locks.h" and includer == "src/util-profiling.h":
+        # Macro SCSpinLock_profile using SCProfilingAddPacketLocks
+        continue
+    if included == "threads.h" and includer == "src/util-debug-filters.h":
+        # pthread_t needed on Windows
+        continue
 
     print("Unnecessary include from %s for %s" % (includer, included))
     retcode = 1
diff --git a/src/alert-fastlog.c b/src/alert-fastlog.c
index d0b5e5353c..f717446981 100644
--- a/src/alert-fastlog.c
+++ b/src/alert-fastlog.c
@@ -54,6 +54,8 @@
 #include "util-logopenfile.h"
 #include "util-time.h"
 
+#include "action-globals.h"
+
 #define DEFAULT_LOG_FILENAME "fast.log"
 
 #define MODULE_NAME "AlertFastLog"
diff --git a/src/alert-syslog.c b/src/alert-syslog.c
index d1397fd85d..86593f54da 100644
--- a/src/alert-syslog.c
+++ b/src/alert-syslog.c
@@ -48,6 +48,7 @@
 #include "util-syslog.h"
 #include "util-optimize.h"
 #include "util-logopenfile.h"
+#include "action-globals.h"
 
 #ifndef OS_WIN32
 
diff --git a/src/decode.c b/src/decode.c
index 3ffb7a54f4..a4e7e2a16a 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -67,6 +67,7 @@
 #include "util-print.h"
 #include "util-profiling.h"
 #include "util-validate.h"
+#include "action-globals.h"
 
 uint32_t default_packet_size = 0;
 extern bool stats_decoder_events;
diff --git a/src/decode.h b/src/decode.h
index 92ba3a2926..df2613aefa 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -79,8 +79,6 @@ enum PktSrcEnum {
 #include "source-pfring.h"
 #endif
 
-#include "action-globals.h"
-
 #include "decode-ethernet.h"
 #include "decode-gre.h"
 #include "decode-ppp.h"
diff --git a/src/defrag-queue.h b/src/defrag-queue.h
index 4607770bdf..63a58d0786 100644
--- a/src/defrag-queue.h
+++ b/src/defrag-queue.h
@@ -25,7 +25,6 @@
 #define __DEFRAG_QUEUE_H__
 
 #include "suricata-common.h"
-#include "decode.h"
 #include "defrag.h"
 
 /** Spinlocks or Mutex for the defrag tracker queues. */
diff --git a/src/defrag.h b/src/defrag.h
index ac964823b8..854766299c 100644
--- a/src/defrag.h
+++ b/src/defrag.h
@@ -26,6 +26,8 @@
 
 #include "threads.h"
 #include "util-pool.h"
+#include "threadvars.h"
+#include "decode.h"
 
 /**
  * A context for an instance of a fragmentation re-assembler, in case
diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index cc917a5a84..b9440b8abf 100644
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -35,6 +35,8 @@
 #include "util-profiling.h"
 #include "util-validate.h"
 
+#include "action-globals.h"
+
 /** tag signature we use for tag alerts */
 static Signature g_tag_signature;
 /** tag packet alert structure for tag alerts */
diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c
index 3952ecc2cd..c007197c07 100644
--- a/src/detect-engine-threshold.c
+++ b/src/detect-engine-threshold.c
@@ -68,6 +68,8 @@
 #include "util-var-name.h"
 #include "tm-threads.h"
 
+#include "action-globals.h"
+
 static HostStorageId host_threshold_id = { .id = -1 };     /**< host storage id for thresholds */
 static IPPairStorageId ippair_threshold_id = { .id = -1 }; /**< ip pair storage id for thresholds */
 
diff --git a/src/detect-http-headers-stub.h b/src/detect-http-headers-stub.h
index f158a2c0e0..ef3712b671 100644
--- a/src/detect-http-headers-stub.h
+++ b/src/detect-http-headers-stub.h
@@ -29,7 +29,7 @@
 #include "suricata-common.h"
 #include "flow.h"
 
-#include "app-layer-htp.h"
+#include <htp/htp.h>
 
 #include "detect.h"
 #include "detect-parse.h"
diff --git a/src/detect-parse.c b/src/detect-parse.c
index b0c3e5a574..dca3b3e06d 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -70,6 +70,8 @@
 #include "detect-engine-iponly.h"
 #include "app-layer-detect-proto.h"
 
+#include "action-globals.h"
+
 /* Table with all SigMatch registrations */
 SigTableElmt sigmatch_table[DETECT_TBLSIZE];
 
diff --git a/src/detect.c b/src/detect.c
index 298fb22df2..083af5c87a 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -65,6 +65,8 @@
 #include "util-detect.h"
 #include "util-profiling.h"
 
+#include "action-globals.h"
+
 typedef struct DetectRunScratchpad {
     const AppProto alproto;
     const uint8_t flow_flags; /* flow/state flags: STREAM_* */
diff --git a/src/device-storage.c b/src/device-storage.c
index d01ff41f2b..f424888ecf 100644
--- a/src/device-storage.c
+++ b/src/device-storage.c
@@ -25,6 +25,7 @@
 
 #include "suricata-common.h"
 #include "device-storage.h"
+#include "util-storage.h"
 #include "util-unittest.h"
 
 unsigned int LiveDevStorageSize(void)
diff --git a/src/device-storage.h b/src/device-storage.h
index 87ef61ff44..49fb59761d 100644
--- a/src/device-storage.h
+++ b/src/device-storage.h
@@ -27,7 +27,6 @@
 #define __DEVICE_STORAGE_H__
 
 #include "util-device.h"
-#include "util-storage.h"
 
 typedef struct LiveDevStorageId_ {
     int id;
diff --git a/src/flow-bypass.h b/src/flow-bypass.h
index 4e2721583f..d1a764b50d 100644
--- a/src/flow-bypass.h
+++ b/src/flow-bypass.h
@@ -24,7 +24,6 @@
 #ifndef __FLOW_BYPASS_H__
 #define __FLOW_BYPASS_H__
 
-#include "threadvars.h"
 #include "flow.h"
 
 struct flows_stats {
diff --git a/src/flow-storage.c b/src/flow-storage.c
index d1146542d9..1ce9c07948 100644
--- a/src/flow-storage.c
+++ b/src/flow-storage.c
@@ -29,6 +29,7 @@
 #include "flow-storage.h"
 #include "flow-hash.h"
 #include "flow-util.h"
+#include "util-storage.h"
 #include "util-unittest.h"
 
 unsigned int FlowStorageSize(void)
diff --git a/src/flow-storage.h b/src/flow-storage.h
index 29a0496a38..6fd8beef32 100644
--- a/src/flow-storage.h
+++ b/src/flow-storage.h
@@ -27,7 +27,6 @@
 #define __FLOW_STORAGE_H__
 
 #include "flow.h"
-#include "util-storage.h"
 
 typedef struct FlowStorageId {
     int id;
diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index bedf12e13a..824e7ea680 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -88,6 +88,8 @@
 #include "util-buffer.h"
 #include "util-validate.h"
 
+#include "action-globals.h"
+
 #define MODULE_NAME "JsonAlertLog"
 
 #define LOG_JSON_PAYLOAD           BIT_U16(0)
diff --git a/src/output-json-drop.c b/src/output-json-drop.c
index 1177c32607..0b7609c435 100644
--- a/src/output-json-drop.c
+++ b/src/output-json-drop.c
@@ -56,6 +56,8 @@
 #include "util-time.h"
 #include "util-buffer.h"
 
+#include "action-globals.h"
+
 #define MODULE_NAME "JsonDropLog"
 
 #define LOG_DROP_ALERTS 1
diff --git a/src/packet.c b/src/packet.c
index b85e3dcff0..6619df47f5 100644
--- a/src/packet.c
+++ b/src/packet.c
@@ -21,6 +21,7 @@
 #include "host.h"
 #include "util-profiling.h"
 #include "util-validate.h"
+#include "action-globals.h"
 
 /** \brief issue drop action
  *
diff --git a/src/reputation.c b/src/reputation.c
index 18c5c15741..e6907c8b15 100644
--- a/src/reputation.c
+++ b/src/reputation.c
@@ -26,6 +26,7 @@
  */
 
 #include "suricata-common.h"
+#include "detect.h"
 #include "reputation.h"
 #include "threads.h"
 #include "conf.h"
diff --git a/src/reputation.h b/src/reputation.h
index 8c8369dd74..3ed94d9851 100644
--- a/src/reputation.h
+++ b/src/reputation.h
@@ -42,8 +42,6 @@ typedef struct SReputation_ {
     uint8_t rep[SREP_MAX_CATS];
 } SReputation;
 
-#include "detect.h"
-
 void SRepFreeHostData(Host *h);
 uint8_t SRepCatGetByShortname(char *shortname);
 int SRepInit(struct DetectEngineCtx_ *de_ctx);
diff --git a/src/source-af-packet.c b/src/source-af-packet.c
index b0445eef23..dcdce96501 100644
--- a/src/source-af-packet.c
+++ b/src/source-af-packet.c
@@ -60,6 +60,7 @@
 #include "runmodes.h"
 #include "flow-storage.h"
 #include "util-validate.h"
+#include "action-globals.h"
 
 #ifdef HAVE_AF_PACKET
 
diff --git a/src/source-dpdk.c b/src/source-dpdk.c
index ce9cc8618f..207d56d701 100644
--- a/src/source-dpdk.c
+++ b/src/source-dpdk.c
@@ -41,6 +41,7 @@
 #include "tm-threads.h"
 #include "tmqh-packetpool.h"
 #include "util-privs.h"
+#include "action-globals.h"
 
 #ifndef HAVE_DPDK
 
diff --git a/src/stream-tcp-cache.c b/src/stream-tcp-cache.c
index 60b0aa2afe..c5a9e30e47 100644
--- a/src/stream-tcp-cache.c
+++ b/src/stream-tcp-cache.c
@@ -25,6 +25,7 @@
 #include "suricata.h"
 #include "stream-tcp-private.h"
 #include "stream-tcp-cache.h"
+#include "util-debug.h"
 
 typedef struct TcpPoolCache {
     bool cache_enabled; /**< cache should only be enabled for worker threads */
diff --git a/src/stream-tcp-cache.h b/src/stream-tcp-cache.h
index 1a61532a15..fc67bc82eb 100644
--- a/src/stream-tcp-cache.h
+++ b/src/stream-tcp-cache.h
@@ -24,8 +24,6 @@
 #ifndef __STREAM_TCP_CACHE_H__
 #define __STREAM_TCP_CACHE_H__
 
-#include "suricata.h"
-#include "flow.h"
 #include "stream-tcp-private.h"
 
 void StreamTcpThreadCacheEnable(void);
diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 36a5151119..ddd0f89f19 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -78,6 +78,7 @@
 #include "util-time.h"
 
 #include "source-pcap-file.h"
+#include "action-globals.h"
 
 //#define DEBUG
 
diff --git a/src/threads-profile.h b/src/threads-profile.h
index 6df3b4be67..43606ae982 100644
--- a/src/threads-profile.h
+++ b/src/threads-profile.h
@@ -26,6 +26,7 @@
 #ifndef __THREADS_PROFILE_H__
 #define __THREADS_PROFILE_H__
 
+// UtilCpuGetTicks
 #include "util-cpu.h"
 
 #define PROFILING_MAX_LOCKS 64
diff --git a/src/tmqh-packetpool.c b/src/tmqh-packetpool.c
index 7e36e0fef9..a7d33b8b6d 100644
--- a/src/tmqh-packetpool.c
+++ b/src/tmqh-packetpool.c
@@ -33,6 +33,7 @@
 #include "packet.h"
 #include "util-profiling.h"
 #include "util-validate.h"
+#include "action-globals.h"
 
 /* Number of freed packet to save for one pool before freeing them. */
 #define MAX_PENDING_RETURN_PACKETS 32
diff --git a/src/util-debug-filters.h b/src/util-debug-filters.h
index a7994dccd0..e8e8e3fb13 100644
--- a/src/util-debug-filters.h
+++ b/src/util-debug-filters.h
@@ -24,6 +24,7 @@
 #ifndef __DEBUG_FILTERS_H__
 #define __DEBUG_FILTERS_H__
 
+// pthread_t
 #include "threads.h"
 
 /**
diff --git a/src/util-exception-policy.c b/src/util-exception-policy.c
index 79f72013eb..2b0eaf3790 100644
--- a/src/util-exception-policy.c
+++ b/src/util-exception-policy.c
@@ -25,6 +25,7 @@
 #include "util-exception-policy.h"
 #include "util-misc.h"
 #include "stream-tcp-reassemble.h"
+#include "action-globals.h"
 
 void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
 {
diff --git a/src/util-lua-common.c b/src/util-lua-common.c
index a014ae7bba..604c99e4b6 100644
--- a/src/util-lua-common.c
+++ b/src/util-lua-common.c
@@ -56,6 +56,7 @@
 
 #include "util-lua.h"
 #include "util-lua-common.h"
+#include "action-globals.h"
 
 int LuaCallbackError(lua_State *luastate, const char *msg)
 {
diff --git a/src/util-privs.h b/src/util-privs.h
index 05592f63f9..739b0926eb 100644
--- a/src/util-privs.h
+++ b/src/util-privs.h
@@ -24,8 +24,6 @@
 #ifndef _UTIL_PRIVS_H
 #define	_UTIL_PRIVS_H
 
-#include "threadvars.h"
-
 #define SC_CAP_NONE             0x01
 #define SC_CAP_SYS_ADMIN        0x02
 #define SC_CAP_SYS_RAW_IO       0x04
@@ -35,11 +33,9 @@
 #define SC_CAP_NET_BIND_SERVICE 0x40
 #define SC_CAP_NET_BROADCAST    0x80
 
-#ifndef HAVE_LIBCAP_NG
-#define SCDropCaps(...)
-#define SCDropMainThreadCaps(...)
-#else
+#ifdef HAVE_LIBCAP_NG
 #include <cap-ng.h>
+#include "threadvars.h"
 
 /**Drop the previliges of the given thread tv, based on the thread cap_flags
  * which implies the capability requirement of the given thread. Initially all
@@ -89,6 +85,9 @@ void SCDropCaps(ThreadVars *tv);
 */
 void SCDropMainThreadCaps(uint32_t , uint32_t );
 
+#else
+#define SCDropCaps(...)
+#define SCDropMainThreadCaps(...)
 #endif /* HAVE_LIBCAP_NG */
 
 int SCGetUserID(const char *, const char *, uint32_t *, uint32_t *);
diff --git a/src/util-profiling.h b/src/util-profiling.h
index b54f764d3a..11eb4c804a 100644
--- a/src/util-profiling.h
+++ b/src/util-profiling.h
@@ -28,7 +28,6 @@
 #ifdef PROFILING
 
 #include "detect.h"
-#include "util-cpu.h"
 #include "util-profiling-locks.h"
 
 extern int profiling_rules_enabled;
diff --git a/src/util-unittest-helper.h b/src/util-unittest-helper.h
index edae52893c..b3b6d18aa4 100644
--- a/src/util-unittest-helper.h
+++ b/src/util-unittest-helper.h
@@ -25,7 +25,6 @@
 #define __UTIL_UNITTEST_HELPER__
 
 #if defined(UNITTESTS)
-#include "packet.h"
 #include "flow.h"
 #include "detect.h"
 #elif defined(FUZZ)