1. A computer-implemented method, comprising: under the control of one or more computer systems configured with executable instructions, receiving a request for a webpage; tagging the request based at least in part on a signature of the request and a collection of signatures, where the collection of signatures is a set of signatures and associated confidence levels; determining a security check to include in the webpage based at least in part on the tagged request, where the security check is configured such that a client application displaying the webpage would not cause the security check to be displayed; transmitting the webpage in response to the request; determining whether an interaction with the security check included in the webpage has occurred; and updating the collection of signature based at least in part on the determination.