rel="noopener": When It Matters and When It's Noise
Run an HTML checker on almost any site and you may see a warning like "44 external links missing rel=noopener", often described as a security vulnerability. It sounds alarming. In most cases it isn't. rel="noopener" only matters for one kind of link, and modern browsers already protect those by default.
What rel="noopener" protects against
When a link opens a page in a new tab with target="_blank", older browsers gave the new page a reference back to yours, through window.opener. A malicious page could use it to quietly redirect your original tab to a fake login page while the visitor was looking at the new tab. This is known as "tabnabbing".
rel="noopener" removes that reference. rel="noreferrer" does the same, and also hides which page the visitor came from.
When rel="noopener" matters
All three of these must be true:
- The link opens in a new tab (
target="_blank"). - It goes to another site you don't control.
- It has no
rel="noopener"orrel="noreferrer".
Links that open in the same tab can't use window.opener at all. Links to your own site are pages you control. Neither needs noopener.
Modern browsers already protect you
Since around 2021, Chrome, Firefox, Safari and Edge treat every target="_blank" link as if it had rel="noopener", unless you explicitly opt out with rel="opener". So even a link that does meet all three conditions is only a risk for visitors on old browsers. Adding noopener is still good practice, but it's a low-risk item, not an urgent security fix.
Why checkers over-report noopener warnings
Many checkers look at every link that starts with https:// and flag any without noopener. That counts:
- links to your own domain written in full, such as
https://yoursite.com/pricing; - links that open in the same tab, where noopener does nothing.
We found our own HTML Checker doing exactly this: it reported 44 missing noopener links on a homepage where every one of the 23 new-tab links to other sites already had it. The real number of problems was zero. The fixed check only counts new-tab links to other domains, working out the site's own domain from its canonical tag.
How to add rel="noopener" where it's needed
<a href="https://other-site.com/" target="_blank" rel="noopener noreferrer">Their guide</a>If you use noreferrer, the other site won't see that the visit came from you, which matters if you rely on referral traffic reports on sites you own. In that case, use noopener alone.
User-generated links
For links posted by users, in comments or forums, add rel="ugc nofollow" as well. That tells search engines the link wasn't editorially chosen by you.
Checking your links
Our HTML Checker reports only new-tab links to other sites that lack noopener or noreferrer, and passes the page when they're all covered, for example "All 23 new-tab external links have rel=noopener".
Summary
rel="noopener" matters only for links that open another site in a new tab. Modern browsers apply it automatically, so a missing one is a low-risk best-practice item. Ignore warnings that count same-tab links or links to your own site, and add rel="ugc nofollow" to links your users post.
Frequently asked questions
What does rel=noopener protect against?
rel=noopener protects against a trick known as tabnabbing. When a link opens a page in a new tab using target=_blank, older browsers gave the new page a reference back to the original page through window.opener. A malicious page could use that reference to quietly redirect the original tab to a fake login page while the visitor was looking at the new tab. Adding rel=noopener removes that reference. rel=noreferrer does the same job and also hides which page the visitor came from. Links that open in the same tab cannot use window.opener at all, so the protection only applies to new-tab links.
Do I need rel=noopener on links to my own website?
No. rel=noopener only matters when three things are all true: the link opens in a new tab with target=_blank, it goes to another site you do not control, and it has no rel=noopener or rel=noreferrer. Links to your own site point to pages you control, and links that open in the same tab cannot use window.opener, so neither needs noopener. Many checkers still flag every link starting with https://, including full links to your own domain and same-tab links, which inflates the count. A sensible check counts only new-tab links to other domains, working out your own domain from the page's canonical tag.
Should I use noopener or noreferrer on external links?
Both remove the window.opener reference that makes tabnabbing possible, so either protects new-tab links to other sites. The difference is that noreferrer also hides which page the visitor came from. That means the other site will not see that the visit came from you. If you rely on referral traffic reports on sites you own, use noopener on its own so the referral is still recorded. A common pattern for links to other sites is target=_blank with rel set to noopener noreferrer. For links posted by users in comments or forums, also add rel=ugc nofollow to tell search engines the link was not editorially chosen by you.