A method for monitoring web page code comprising: monitoring attempted actions and/or attempted events initiated by components of the web page code for manipulation of a document object model (DOM), the monitoring performed by a virtual DOM firewall that simulates the DOM by intercepting the attempted actions and/or attempted events targeting the DOM without execution of the attempted actions and/or attempted events on the DOM, and identifying a deviation from a set-of-rules defining allowable manipulation of the DOM, and prohibited manipulation of the DOM, wherein the virtual DOM firewall is stored on the web server and executed by the hardware processor of the web server in associated with the web page code, wherein attempted actions and/or attempted events that deviate from the set-of-rules are prevented from execution on the DOM, and attempted actions and/or attempted events that adhere to the set-of-rules are allowed to continue execution on the DOM.