Abstract: An apparatus discerns clients by the requests made to a web application server through a web application firewall, which injects client side code into the responses with a randomized challenge that needs a unique answer to be returned in the cookie. The client side code generates cookies, which identify a browser to the web application server, or the web application firewall in subsequent requests if made by a normally configured browser and a fail threshold is checked for subsequent requests originating from such a browser. Each browser is thus fingerprinted and if the expected answer failures exceed a threshold, the client is marked as suspicious and a subsequent Turing test is enforced to these suspicious clients, failing which, a subsequent defined action is taken.