diff --git a/src/sbbs3/websrvr.c b/src/sbbs3/websrvr.c
index 92e99c3f2b3e585846727944a1b16fb68e86b4fa..3ae6bf3df5cf6a38e6df11f57afa658c52e84cc3 100644
--- a/src/sbbs3/websrvr.c
+++ b/src/sbbs3/websrvr.c
@@ -2779,6 +2779,8 @@ static BOOL parse_headers(http_session_t * session)
 								else {
 									if (session->req.vary_list)
 										strcat(p, ", ");
+									else
+										*p = '\0';
 									strcat(p, get_header(HEAD_UPGRADEINSECURE));
 									session->req.vary_list = p;