diff --git a/sentry_sdk/integrations/_wsgi_common.py b/sentry_sdk/integrations/_wsgi_common.py
index 0940310c32..1a602b8b06 100644
--- a/sentry_sdk/integrations/_wsgi_common.py
+++ b/sentry_sdk/integrations/_wsgi_common.py
@@ -11,6 +11,21 @@
     from typing import Union
 
 
+SENSITIVE_ENV_KEYS = (
+    "REMOTE_ADDR",
+    "HTTP_X_FORWARDED_FOR",
+    "HTTP_SET_COOKIE",
+    "HTTP_COOKIE",
+    "HTTP_AUTHORIZATION",
+    "HTTP_X_FORWARDED_FOR",
+    "HTTP_X_REAL_IP",
+)
+
+SENSITIVE_HEADERS = tuple(
+    x[len("HTTP_") :] for x in SENSITIVE_ENV_KEYS if x.startswith("HTTP_")
+)
+
+
 class RequestExtractor(object):
     def __init__(self, request):
         # type: (Any) -> None
@@ -129,7 +144,10 @@ def _filter_headers(headers):
         return headers
 
     return {
-        k: v
+        k: (
+            v
+            if k.upper().replace("-", "_") not in SENSITIVE_HEADERS
+            else AnnotatedValue("", {"rem": [["!config", "x", 0, len(v)]]})
+        )
         for k, v in iteritems(headers)
-        if k.lower().replace("_", "-") not in ("set-cookie", "cookie", "authorization")
     }
diff --git a/sentry_sdk/integrations/wsgi.py b/sentry_sdk/integrations/wsgi.py
index 9a098b6697..c3a02e7bcb 100644
--- a/sentry_sdk/integrations/wsgi.py
+++ b/sentry_sdk/integrations/wsgi.py
@@ -100,8 +100,9 @@ def _get_environ(environ):
     """
     keys = ["SERVER_NAME", "SERVER_PORT"]
     if _should_send_default_pii():
-        # Add all three headers here to make debugging of proxy setup easier.
-        keys += ["REMOTE_ADDR", "HTTP_X_FORWARDED_FOR", "HTTP_X_REAL_IP"]
+        # make debugging of proxy setup easier. Proxy headers are
+        # in headers.
+        keys += ["REMOTE_ADDR"]
 
     for key in keys:
         if key in environ: