How to Inventory Every Third-Party Origin a Page Contacts, and Four Pitfalls to Avoid

Safari 27 now blocks a category of third-party domains by default at the network level, leaving many teams unsure whether their pages depend on such domains. Those domains often arrive through tag managers or marketing vendors, so repository inspection and one-off network panel checks give an incomplete picture. The article recommends using the browser's Resource Timing API to list fetched origins, with a PerformanceObserver to avoid the default 250-entry buffer limit. For production-wide coverage, it suggests a Content-Security-Policy-Report-Only header with a deliberately restrictive connect-src and a report-to destination, which reports outbound connections without blocking them. The author warns of four traps: the small buffer, a missing report-to directive that silently does nothing, incomplete browser support for report-to, and the header being unavailable from within an HTML meta tag.