diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 5c0cd6cafe..43f8c05a41 100644
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -587,15 +587,13 @@ static inline void PacketAlertFinalizeProcessQueue(
                 skip_td = true;
                 continue;
             }
-
-            // TODO we can also drop if alert is suppressed, right?
-            if (s->action & ACTION_DROP) {
-                SCLogDebug("sid:%u led to a drop that will skip any firewall alerts", s->id);
-                dropped = true;
-            }
         } else {
             p->alerts.discarded++;
         }
+
+        if (s->action & ACTION_DROP) {
+            dropped = true;
+        }
     }
 
     /* Set flag on flow to indicate that it has alerts. We use the bool to