This is possible with the Content Security Policy header, including automated reports from the browsers when things are blocked. It's hard to implement however since a whitelist of allowed domains can grow very, very large for the average site.
Eg if your web app uses embedded Tweets, MixPanel, and GoogleFonts:
var policy = cspByAPI(basePolicy, ['twitter', 'mixpanel', 'googleFonts' ]);
Ie, the package maintains an up to date list of the image, script, etc sources for all those different embeds, so you only have to specify what your own code needs (that's the basePolicy).
It's for node, but you can easily port it to Elixir or Python or Ruby.
Policies for 16 common CSP embeds are included, please send a pull request to add more.
