---
title: header.filter_except
summary: null
url: >-
  https://www.fastly.com/documentation/reference/vcl/functions/headers/header-filter-except
---

```
VOID header.filter_except(ID where, STRING headers...)
```

**Available in:** all subroutines

Removes all headers from the provided request, response, or cached object
variable, except for protected headers and those listed as parameters. This
function call is equivalent to using the `unset` statement or the
`header.unset()` function for every header except those listed as parameters.
Header names are not case sensitive.

Note that unlike
[querystring.filter_except()](https://www.fastly.com/documentation/reference/vcl/functions/query-string/querystring-filter-except/),
header names are passed as individual arguments rather than a single string
with header names separated by an equivalent to `querystring.filtersep()`.

The _where_ argument is one of the literal identifiers `req`, `resp`, `obj`,
`bereq`, or `beresp`, corresponding to the [predefined
variable](https://www.fastly.com/documentation/reference/vcl/variables/) of the same
name. The predefined variable associated with the _where_ argument must be
writable within the VCL subroutine where `header.filter_except()` is called.

The _headers_ arguments is a list of zero or more names of headers that will be
kept on the provided _where_ variable. Header names are ignored when they are
not present on the provided _where_ variable.

Some headers are _protected_. These headers cannot be modified, and are
unaffected by `header.filter_except()`.
See the [Header reference](https://www.fastly.com/documentation/reference/http/http-headers/)
for which headers are protected.

Calling `header.filter_except()` with the empty string, a _not-set_ value, or a
string that would be invalid as a header name, is not permitted by the
compiler.

## Example

The following example will remove all headers from the client request
except for the headers `Accept`, `User-Agent`, `Accept-Encoding`, and any
_protected_ headers.

```vcl
header.filter_except(req, "Accept", "User-Agent", "Accept-Encoding");
```