A proxy server receives from a client device a request for a network resource that is hosted at an origin server for a domain. The request is received at the proxy server as a result of DNS request for the domain returning an IP address of the proxy server instead of an IP address of the origin server. The proxy server retrieves the requested network resource. The proxy server determines that the retrieved network resource includes at least one modification token that is of a type that indicates a threat to the client device. For at least this modification token, the proxy server automatically modifies at least a portion of the retrieved network resource that corresponds to that modification token. The proxy server transmits the modified network resource to the client device.