Rel Noopener Noreferrer: Security and Privacy for External Links

When links open in new tabs without noopener, the new page can redirect the original page to phishing or malware URLs via window.opener.location. It can also slow performance by maintaining a connection to the opener and leak analytics data cross-domain. This risk is mitigated by adding the attribute.

I've seen sites that skip this attribute on external links, and while the chance of a malicious attack is low for most sites, it's a simple fix that removes a real vulnerability. Chrome Lighthouse flags these cases, and I recommend treating it as a standard practice.

For developers, the markup looks like this:

For CMS users: WordPress has enabled this by default since version 5.6. Shopify requires manual template edits. If you're unsure about your setup, run a quick check with backlink checker tools that scan link attributes.

I recommend adding both attributes for backward compatibility, even though modern browsers treat noreferrer as implying noopener.

Common misconceptions include: Myth: Improves rankings. Reality: Zero effect. Google's John Mueller has confirmed these are security controls, not ranking signals. Myth: Replaces nofollow. Reality: Different purposes entirely. nofollow is a crawl and endorsement hint; noopener and noreferrer are browser behaviors.

If you're comparing link attributes, see my guide on referring domains vs backlinks for a broader picture. But for this attribute, the SEO impact is none.

Modern browsers handle these attributes efficiently, but there are trade-offs. Excessive target="_blank" links increase memory usage because each new tab keeps a reference to the opener unless noopener is used. Unnecessary noreferrer breaks analytics paths — you lose referral data unless you append UTM parameters.

I always test with backlink analysis tools before making bulk changes. For internal links, I skip noreferrer to preserve navigation data.

Here's how security-focused attributes differ from SEO controls:

• noopener: Security-only. Blocks tabnabbing, preserves referrer, no SEO impact. Use for external new-tab links.
• noreferrer: Privacy-focused. Implies noopener, hides referrer, no SEO impact. Use for sensitive external links.
• nofollow: SEO control. No security effect, preserves referrer, crawling hint. Use for untrusted/sponsored links.

Ahrefs explicitly separates these: noreferrer, noopener, and nofollow have different purposes. For a deeper dive into link attribute strategies, check my methods page.

Use rel="noopener noreferrer" on external links that open in a new tab. This covers security and privacy. Skip it on internal links — you want referrer data to flow within your site for analytics. Also skip it on same-tab links because there's no new browsing context.

I've seen sites apply it to every link blindly, which breaks internal tracking. Use your judgment: if the link is to a trusted partner and you want to share referrer data, use only noopener. For more on link evaluation, see how I judge links.

To check if your site uses these attributes correctly, use Chrome Lighthouse: it flags missing noopener on target="_blank" links. For bulk analysis, I recommend backlink checker tools that scan link markup. Also, backlink monitoring tools can track changes over time.

If you find missing attributes, add them via your CMS filter or a global search-and-replace in your template. It's a quick win for security hygiene.