diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h
index 8155375e2d..0a9fca413e 100644
--- a/src/DNS_Mgr.h
+++ b/src/DNS_Mgr.h
@@ -38,7 +38,7 @@ enum DNS_MgrMode {
 // Number of seconds we'll wait for a reply.
 #define DNS_TIMEOUT 5
 
-class DNS_Mgr : public iosource::IOSource {
+class DNS_Mgr final : public iosource::IOSource {
 public:
 	explicit DNS_Mgr(DNS_MgrMode mode);
 	~DNS_Mgr() override;
diff --git a/src/Event.h b/src/Event.h
index 9f353ad235..a4bedda6d0 100644
--- a/src/Event.h
+++ b/src/Event.h
@@ -48,7 +48,7 @@ protected:
 extern uint64_t num_events_queued;
 extern uint64_t num_events_dispatched;
 
-class EventMgr : public BroObj, public iosource::IOSource {
+class EventMgr final : public BroObj, public iosource::IOSource {
 public:
 	EventMgr();
 	~EventMgr() override;
diff --git a/src/SerializationFormat.h b/src/SerializationFormat.h
index 5045c6af92..475755bf08 100644
--- a/src/SerializationFormat.h
+++ b/src/SerializationFormat.h
@@ -92,7 +92,7 @@ protected:
 	int bytes_read;
 };
 
-class BinarySerializationFormat : public SerializationFormat {
+class BinarySerializationFormat final : public SerializationFormat {
 public:
 	BinarySerializationFormat();
 	~BinarySerializationFormat() override;
diff --git a/src/Stats.h b/src/Stats.h
index 0e8dea52e5..e2691968de 100644
--- a/src/Stats.h
+++ b/src/Stats.h
@@ -65,7 +65,7 @@ protected:
 };
 
 
-class ProfileLogger : public SegmentStatsReporter {
+class ProfileLogger final : public SegmentStatsReporter {
 public:
 	ProfileLogger(BroFile* file, double interval);
 	~ProfileLogger() override;
@@ -84,7 +84,7 @@ private:
 
 
 // Generates load_sample() events.
-class SampleLogger : public SegmentStatsReporter {
+class SampleLogger final : public SegmentStatsReporter {
 public:
 	SampleLogger();
 	~SampleLogger() override;
diff --git a/src/Trigger.h b/src/Trigger.h
index 8bf8c77abc..ae559b7995 100644
--- a/src/Trigger.h
+++ b/src/Trigger.h
@@ -114,7 +114,7 @@ private:
 	ValCache cache;
 };
 
-class Manager : public iosource::IOSource {
+class Manager final : public iosource::IOSource {
 public:
 
 	Manager();
diff --git a/src/file_analysis/AnalyzerSet.h b/src/file_analysis/AnalyzerSet.h
index a1960a2e1a..d52937ca45 100644
--- a/src/file_analysis/AnalyzerSet.h
+++ b/src/file_analysis/AnalyzerSet.h
@@ -165,7 +165,7 @@ private:
 	/**
 	 * Represents a request to add an analyzer to an analyzer set.
 	 */
-	class AddMod : public Modification {
+	class AddMod final : public Modification {
 	public:
 		/**
 		 * Construct request which can add an analyzer to an analyzer set.
@@ -186,7 +186,7 @@ private:
 	/**
 	 * Represents a request to remove an analyzer from an analyzer set.
 	 */
-	class RemoveMod : public Modification {
+	class RemoveMod final : public Modification {
 	public:
 		/**
 		 * Construct request which can remove an analyzer from an analyzer set.
diff --git a/src/file_analysis/FileReassembler.h b/src/file_analysis/FileReassembler.h
index caaa1d443a..cd17a1c9a4 100644
--- a/src/file_analysis/FileReassembler.h
+++ b/src/file_analysis/FileReassembler.h
@@ -9,7 +9,7 @@ namespace file_analysis {
 
 class File;
 
-class FileReassembler : public Reassembler {
+class FileReassembler final : public Reassembler {
 public:
 
 	FileReassembler(File* f, uint64_t starting_offset);
@@ -56,4 +56,4 @@ protected:
 	bool flushing;
 };
 
-} // namespace analyzer::* 
+} // namespace analyzer::*
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index 43346f7d0f..435ae03801 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -94,7 +94,7 @@ Manager::Stream::~Stream()
 	delete reader;
 	}
 
-class Manager::TableStream: public Manager::Stream {
+class Manager::TableStream final : public Manager::Stream {
 public:
 
 	unsigned int num_idx_fields;
@@ -116,7 +116,7 @@ public:
 	~TableStream() override;
 };
 
-class Manager::EventStream: public Manager::Stream {
+class Manager::EventStream final : public Manager::Stream {
 public:
 	EventHandlerPtr event;
 
@@ -128,7 +128,7 @@ public:
 	~EventStream() override;
 };
 
-class Manager::AnalysisStream: public Manager::Stream {
+class Manager::AnalysisStream final : public Manager::Stream {
 public:
 	string file_id;
 
diff --git a/src/input/readers/ascii/Ascii.h b/src/input/readers/ascii/Ascii.h
index 019e215c4f..db98a5a188 100644
--- a/src/input/readers/ascii/Ascii.h
+++ b/src/input/readers/ascii/Ascii.h
@@ -33,7 +33,7 @@ struct FieldMapping {
 /**
  * Reader for structured ASCII files.
  */
-class Ascii : public ReaderBackend {
+class Ascii final : public ReaderBackend {
 public:
 	explicit Ascii(ReaderFrontend* frontend);
 	~Ascii() override;
diff --git a/src/input/readers/benchmark/Benchmark.h b/src/input/readers/benchmark/Benchmark.h
index 944c85d06e..ca3f14ffee 100644
--- a/src/input/readers/benchmark/Benchmark.h
+++ b/src/input/readers/benchmark/Benchmark.h
@@ -10,7 +10,7 @@ namespace input { namespace reader {
 /**
  * A benchmark reader to measure performance of the input framework.
  */
-class Benchmark : public ReaderBackend {
+class Benchmark final : public ReaderBackend {
 public:
 	explicit Benchmark(ReaderFrontend* frontend);
 	~Benchmark() override;
diff --git a/src/input/readers/binary/Binary.h b/src/input/readers/binary/Binary.h
index 13a3d586cc..ff2cd30adb 100644
--- a/src/input/readers/binary/Binary.h
+++ b/src/input/readers/binary/Binary.h
@@ -12,7 +12,7 @@ namespace input { namespace reader {
 /**
  * Binary mode file reader.
  */
-class Binary : public ReaderBackend {
+class Binary final : public ReaderBackend {
 public:
 	explicit Binary(ReaderFrontend* frontend);
 	~Binary() override;
diff --git a/src/input/readers/config/Config.h b/src/input/readers/config/Config.h
index fde24e29d9..599b3bb737 100644
--- a/src/input/readers/config/Config.h
+++ b/src/input/readers/config/Config.h
@@ -17,7 +17,7 @@ namespace input { namespace reader {
 /**
  * Reader for Configuration files.
  */
-class Config : public ReaderBackend {
+class Config final : public ReaderBackend {
 public:
 	explicit Config(ReaderFrontend* frontend);
 	~Config() override;
diff --git a/src/input/readers/raw/Raw.h b/src/input/readers/raw/Raw.h
index e5b9c9bdc6..7ab1ab35d4 100644
--- a/src/input/readers/raw/Raw.h
+++ b/src/input/readers/raw/Raw.h
@@ -15,7 +15,7 @@ namespace input { namespace reader {
  * A reader that returns a file (or the output of a command) as a single
  * blob.
  */
-class Raw : public ReaderBackend {
+class Raw final : public ReaderBackend {
 public:
 	explicit Raw(ReaderFrontend* frontend);
 	~Raw() override;
diff --git a/src/input/readers/sqlite/SQLite.h b/src/input/readers/sqlite/SQLite.h
index b85af944db..6c7e9c328c 100644
--- a/src/input/readers/sqlite/SQLite.h
+++ b/src/input/readers/sqlite/SQLite.h
@@ -13,7 +13,7 @@
 
 namespace input { namespace reader {
 
-class SQLite : public ReaderBackend {
+class SQLite final : public ReaderBackend {
 public:
 	explicit SQLite(ReaderFrontend* frontend);
 	~SQLite() override;
diff --git a/src/iosource/Manager.h b/src/iosource/Manager.h
index 93cdd998d7..af6f62ce77 100644
--- a/src/iosource/Manager.h
+++ b/src/iosource/Manager.h
@@ -159,7 +159,7 @@ private:
 
 	void RemoveAll();
 
-	class WakeupHandler : public IOSource {
+	class WakeupHandler final : public IOSource {
 	public:
 		WakeupHandler();
 		~WakeupHandler();
diff --git a/src/iosource/pcap/Source.h b/src/iosource/pcap/Source.h
index f32071cb99..a04891934d 100644
--- a/src/iosource/pcap/Source.h
+++ b/src/iosource/pcap/Source.h
@@ -13,7 +13,7 @@ extern "C" {
 namespace iosource {
 namespace pcap {
 
-class PcapSource : public iosource::PktSrc {
+class PcapSource final : public iosource::PktSrc {
 public:
 	PcapSource(const std::string& path, bool is_live);
 	~PcapSource() override;
diff --git a/src/logging/writers/ascii/Ascii.h b/src/logging/writers/ascii/Ascii.h
index 875216b880..6ec122723d 100644
--- a/src/logging/writers/ascii/Ascii.h
+++ b/src/logging/writers/ascii/Ascii.h
@@ -12,7 +12,7 @@
 
 namespace logging { namespace writer {
 
-class Ascii : public WriterBackend {
+class Ascii final : public WriterBackend {
 public:
 	explicit Ascii(WriterFrontend* frontend);
 	~Ascii() override;
@@ -75,4 +75,3 @@ private:
 
 }
 }
-
diff --git a/src/logging/writers/none/None.h b/src/logging/writers/none/None.h
index b00616f597..5dddcd67b6 100644
--- a/src/logging/writers/none/None.h
+++ b/src/logging/writers/none/None.h
@@ -8,7 +8,7 @@
 
 namespace logging { namespace writer {
 
-class None : public WriterBackend {
+class None final : public WriterBackend {
 public:
 	explicit None(WriterFrontend* frontend) : WriterBackend(frontend)	{}
 	~None() override {};
diff --git a/src/logging/writers/sqlite/SQLite.h b/src/logging/writers/sqlite/SQLite.h
index 87003f35cb..e62bf38a55 100644
--- a/src/logging/writers/sqlite/SQLite.h
+++ b/src/logging/writers/sqlite/SQLite.h
@@ -13,7 +13,7 @@
 
 namespace logging { namespace writer {
 
-class SQLite : public WriterBackend {
+class SQLite final : public WriterBackend {
 public:
 	explicit SQLite(WriterFrontend* frontend);
 	~SQLite() override;
diff --git a/src/threading/formatters/Ascii.h b/src/threading/formatters/Ascii.h
index aecaf9ec8f..16a20425e9 100644
--- a/src/threading/formatters/Ascii.h
+++ b/src/threading/formatters/Ascii.h
@@ -6,7 +6,7 @@
 
 namespace threading { namespace formatter {
 
-class Ascii : public Formatter {
+class Ascii final : public Formatter {
 public:
 	/**
 	 * A struct to pass the necessary configuration values to the
diff --git a/src/threading/formatters/JSON.h b/src/threading/formatters/JSON.h
index 74a002485a..46f0769782 100644
--- a/src/threading/formatters/JSON.h
+++ b/src/threading/formatters/JSON.h
@@ -14,7 +14,7 @@ namespace threading { namespace formatter {
   * A thread-safe class for converting values into a JSON representation
   * and vice versa.
   */
-class JSON : public Formatter {
+class JSON final : public Formatter {
 public:
 	enum TimeFormat {
 		TS_EPOCH,	// Doubles that represents seconds from the UNIX epoch.