External Links Use noopener

Why It Matters

• It prevents tab hijacking. Without noopener, a page opened via target="_blank" can use window.opener.location to redirect the original tab. The user returns to find a fake login page instead of your site — a classic phishing attack.
• It improves performance. Pages linked with target="_blank" without noopener may share the same process as your page in some browsers. Adding noopener ensures the new page runs in its own process, preventing a slow external page from dragging down yours.
• Modern browsers help, but do not fully replace it. Recent browser versions treat target="_blank" as implicitly noopener, but older browsers do not. Adding the attribute explicitly ensures protection across all browsers your visitors might use.
• It is trivially easy to implement. Adding rel="noopener" to an anchor tag is a minimal change with zero impact on user experience. There is no reason not to include it on every external link that opens a new tab.

How to Implement It

1. Add rel="noopener" to all target="_blank" links. The standard pattern is: <a href="/https://example.com" target="_blank" rel="noopener">Visit Example</a>. Simple and complete.
2. Consider adding noreferrer too. Using rel="noopener noreferrer" also prevents the external site from seeing which page linked to it. This provides additional privacy protection for your visitors.
3. Audit existing links. Search your codebase for target="_blank" and check whether each instance includes rel="noopener". Older pages and legacy content often miss this.
4. Configure your CMS or editor. Most content management systems can be configured to automatically add rel="noopener" whenever a link is set to open in a new tab. Set this up once and it applies to all future content.
5. Do not forget dynamically generated links. Links created by JavaScript, rendered from templates, or pulled from a database also need rel="noopener". Check your code that generates link elements, not just your static HTML.

Common Mistakes

• Assuming modern browsers make it unnecessary. While Chrome and Firefox now implicitly add noopener for target="_blank", adding it explicitly guarantees protection in older browsers and edge cases.
• Only fixing some links. It is easy to add noopener to new links while forgetting the hundreds of existing ones on older pages. Do a global search and fix them all.
• Using window.open() without the noopener feature. JavaScript's window.open() also creates an opener reference by default. Pass the "noopener" feature string to prevent it.
• Confusing noopener with nofollow. They are completely different attributes. noopener is a security feature that prevents tab hijacking. nofollow is an SEO directive that tells search engines not to pass link authority. Both can coexist on the same link.