I want to get html by iframe, but I don't want to get the contents (css or images) of the html I got.

• If you only need to block resources from a different origin (different domain) than the page to load
  → iframe sandbox attribute
• It's hard with iframe to block all resources
  • The parent page and the page to be loaded are the same origin→ Get HTML only with XMLHttpRequest
  • You can't even use CORS with a different origin→ Let's rely on the server side

• The parent page and the page to be loaded are the same origin→ Get HTML only with XMLHttpRequest
• You can't even use CORS with a different origin→ Let's rely on the server side

DOMContentLoaded does not wait for external resources to load in the first place, not before they start loading external resources.In fact, when I made a breakpoint on DOMContentLoaded, some requests were already flying.

Also, to use the DOMContentLoaded event, you need to access the Document object, which is created in the middle of loading iframe.There is no event related to this, so you can monitor it with the timer and set the event as soon as it is created.

I waited for the head element to be created without using DOMContentLoaded to monitor the timer anyway, but it still seems that the resources are loaded...

By default, Javascript cannot do anything about the browser's communication capabilities.It's not only dangerous to intercept communications, but it can't just be blocked.

You can block resources from different origin using the sandbox attribute of the iframe element, but you cannot restrict the same origin.

On a page-by-page basis, Content Security Policy allows page authors to prevent unintended resource loading and execution.You can use HTTP headers and meta tags to whitelist, but This meta tag works even if you insert it in Javascript, but you must insert it before it starts loading.

The same goes for replacing the URL of an external resource with a dummy one through the DOM of iframe.However, if you don't want to see the communication even if it happens, you may be able to use this method.

You also need to have the same origin or CORS configuration in order to access the iframe DOM either by inserting a meta tag for CSP or removing external resources, so it would be easier to obtain only HTML from XMLHttpRequest if that condition is met.

The rest should be combined with a server-side program.

Instead of writing the URL directly on the iframe src, why don't you use JavaScript to get the source of http://example.com/sample.html, remove the elements (link, src script, iframe, img) that communicate asynchronously, and then write them into the iframe?I think it's okay to erase only attributes such as src, not elements themselves.