diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 6764b58dc8..fb0127f6f4 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -234,6 +234,11 @@ jobs:
                 texlive-upquote \
                 texlive-capt-of \
                 texlive-needspace \
+      - name: Setup cppclean
+        run: |
+          git clone --depth 1 --branch suricata https://github.com/catenacyber/cppclean
+          cd cppclean
+          python3 setup.py install
       - name: Configuring
         run: |
           ./autogen.sh
@@ -242,6 +247,9 @@ jobs:
         env:
           DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-lua --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
       - run: test -e doc/userguide/suricata.1
+      - name: Checking includes
+        run: |
+          cppclean src/*.h | grep "does not need to be #included" | python3 scripts/cppclean_check.py
       - name: Building Rust documentation
         run: make doc
         working-directory: rust
diff --git a/scripts/cppclean_check.py b/scripts/cppclean_check.py
new file mode 100644
index 0000000000..6689ab392f
--- /dev/null
+++ b/scripts/cppclean_check.py
@@ -0,0 +1,30 @@
+import sys
+
+#cppclean src/*.h | grep "does not need to be #included"
+retcode = 0
+for l in sys.stdin:
+    includer = l.split(':')[0]
+    included = l.split("'")[1]
+
+    if included == "rust.h" or included == "suricata-common.h":
+        continue
+    if includer == "src/suricata-common.h" or includer == "src/rust-context.h" or includer == "src/rust.h" or includer == "src/threads.h":
+        continue
+
+    if included == "util-file.h" and includer == "src/detect.h":
+        # SigTableElmt structure field FileMatch being a function pointer using a parameter File defined in util-file.h
+        continue
+    if included == "conf.h" and includer == "src/suricata-plugin.h":
+        # SCEveFileType structure field Init being a function pointer using a parameter ConfNode defined in conf.h
+        continue
+    if included == "util-debug-filters.h" and includer == "src/util-debug.h":
+        # Macro SCEnter using SCLogCheckFDFilterEntry defined in util-debug-filters.h
+        continue
+    if included == "util-spm-bs.h" and includer == "src/util-spm.h":
+        # Macro SpmSearch using BasicSearch defined in util-spm-bs.h
+        continue
+
+    print("Unnecessary include from %s for %s" % (includer, included))
+    retcode = 1
+
+sys.exit(retcode)