1. A method comprising: detecting, by a client computing device running a local application, that the local application has accessed a web application hosted by a remote server and received data from the web application, wherein the detecting comprises intercepting universal resource identifiers (URIs) or universal resource locators (URLs) used by the local application to detect that the local application has accessed the web application; determining, by the client computing device, whether the web application is a sensitive web application identified by a data loss prevention (DLP) policy, wherein the sensitive web application has access to sensitive information identified by and protected by the DLP policy, wherein the DLP policy comprises a set of identifiers of a set of web applications to protect and a set of one or more operations to restrict for the set of web applications, wherein the determining comprises: comparing the URIs or URLs against the set of identifiers specified in the DLP policy; and identifying the web application as a sensitive web application when the respective URI or URL matches one of the set of identifiers specified in the DLP policy; and in response to determining that the web application is a sensitive web application identified by the DLP policy, restricting a capability of at least one of the local application or the client computing device to perform the set of one or more operations on the data received from the web application.