Web services allow the interoperability and communication of heterogeneous systems in the Web through Internet protocols. These facilities make them particularly useful for implementing services oriented architectures (SOAs) of companies, cloud services (e.g., Amazon, Microsoft, Google) and even governments applications.Web services are also subject to attacks that are destructive even if they are well known or appearing daily. Moreover, very few solutions exist to ensure the availability of Web services in the presence of these attacks. In order to tackle these issues, we propose an innovative attack-tolerant architecture and framework for Web services. We propose a comprehensive and complete attack-tolerance methodology whose characteristics are: i) upstream detection of attacks before their propagation, ii) a failover system to mitigate the effects of the attack and, iii) an active rejuvenation process to mitigate attacks that are not easy or impossible to detect by monitoring. Our approach leverages and explores, in particular, monitoring, diversity and software engineering techniques for devising a finegrained attack-tolerance system. We tested our framework with an e-health Web service, which is a simplified version of a case study of the European project CLARUS1. This proof of concept shows how it is effective and realistic to enable attack tolerance