In one embodiment, a device obtains page load information corresponding to a loaded web application. The device detects, based on the page load information, an anomalous feature of the loaded web application. The device identifies a type of the anomalous feature based on a number of resource anomalies within the loaded web application, wherein the type of the anomalous feature is selected from a group consisting of: a page anomaly; a resource anomaly; and a domain anomaly. The device performs one or more mitigation actions according to the type of the anomalous feature.