diff --git a/src/content/docs/waf/detections/leaked-credentials/index.mdx b/src/content/docs/waf/detections/leaked-credentials/index.mdx
index f8330909f10d4c..e6fada28d6f09c 100644
--- a/src/content/docs/waf/detections/leaked-credentials/index.mdx
+++ b/src/content/docs/waf/detections/leaked-credentials/index.mdx
@@ -72,8 +72,6 @@ Expressions used to specify custom detection locations can include the following
 
 - Fields:
   - [`http.request.body.raw`](/ruleset-engine/rules-language/fields/http-request-body/#httprequestbodyraw)
-  - [`http.request.headers`](/ruleset-engine/rules-language/fields/http-request-header/#httprequestheaders)
-  - [`http.request.uri.query`](/ruleset-engine/rules-language/fields/standard-fields/#httprequesturiquery)
 - Functions:
   - [`lookup_json_string()`](/ruleset-engine/rules-language/functions/#lookup_json_string)
   - [`lower()`](/ruleset-engine/rules-language/functions/#lower)