The invention discloses a method of dynamically controlling application function at the client, comprising: initiating an application program which merely contains framework function codes; loading a security module after initiating the application program, wherein the security module sends a request regarding scanning configuration file to a server; scanning the application environment of the client according to the configuration file received from the server, and sending the result of scanning to the server so as to generate a risk score; and receiving the function codes that are allowed to be loaded in the current application environment from the server, wherein the function codes are generated by the server based on the generated risk score. The invention also discloses a method of dynamically controlling application function at a server.