A method for generating a transformed web application code to detect and mitigate security attacks on a web application code performed by a web application protection system for a web server, the method comprising: a. intercepting a web application code sent to at least one web server; b. obtaining a deemed clean representation of the document object model, DOM structure of the intercepted web application code; c. providing at least one script; wherein the providing the at least one script comprises: i. installing at least one of a challenge token or a unique identification number in the at least one script; and ii. protecting the at least one script with the at least one challenge token or unique identification number; d. embedding the at least one script along with the intercepted web application code resulting in a transformed web application code, wherein the transformed web application code is transmitted to a client, wherein the script is meant for collecting and sending the representation of at least one client document object model, DOM, structure of the transformed web application code at least once when executed on the client; e. protecting at least partially one of the intercepted web application code, the at least one script or the transformed web application code; f. comparing the representation of at least one client DOM structures received from the client with the deemed clean representation of the DOM structure present at the web server, wherein the representation of the at least one client DOM structure is received subsequent to the execution of the transformed web application code on the client; and g. determining one or more tampering events that signify one or more security threats to the transformed web application code based upon comparison. a. intercepting a web application code sent to at least one web server; b. obtaining a deemed clean representation of the document object model, DOM structure of the intercepted web application code; c. providing at least one script; wherein the providing the at least one script comprises: i. installing at least one of a challenge token or a unique identification number in the at least one script; and ii. protecting the at least one script with the at least one challenge token or unique identification number; i. installing at least one of a challenge token or a unique identification number in the at least one script; and ii. protecting the at least one script with the at least one challenge token or unique identification number; d. embedding the at least one script along with the intercepted web application code resulting in a transformed web application code, wherein the transformed web application code is transmitted to a client, wherein the script is meant for collecting and sending the representation of at least one client document object model, DOM, structure of the transformed web application code at least once when executed on the client; e. protecting at least partially one of the intercepted web application code, the at least one script or the transformed web application code; f. comparing the representation of at least one client DOM structures received from the client with the deemed clean representation of the DOM structure present at the web server, wherein the representation of the at least one client DOM structure is received subsequent to the execution of the transformed web application code on the client; and g. determining one or more tampering events that signify one or more security threats to the transformed web application code based upon comparison.