Target Blank Without Noopener: Example
My fur coat, bitten by a mad dog, tore itself loose, and it still comes back through the open window to bite my other clothes.
The short answer
- What it is
- This issue is an external link that opens a new tab with target set to _blank but has neither noopener nor noreferrer in its rel attribute. The new page may then get a handle on the old one.
- Why it matters
- In older browsers, the opened page can use window.opener to send the first tab to a fake login page. It is a security fault, not a ranking factor.
- How a crawler should report it
- Report one row per external link with the source page, target URL, and current rel value, as a security warning. Skip internal links and any link whose rel already has noopener or noreferrer.
- Live examples
/lab/target-blank-no-noopener/(positive)/lab/target-blank-no-noopener/near-miss/(near miss)
Keeping a New Tab From Controlling the One You Left
Rel noopener is a link value that stops a new tab from reaching back to the page that opened it. You add it as rel="noopener" on a link with target="_blank". Without it, older browsers give the new page a window.opener object. The new page can use it to change the address of the original tab. It can't read your page across sites, but it can navigate it.
That opens the door to an attack called reverse tabnabbing. A reader clicks a link to another site. While they read, that site quietly sends the first tab to a copy of a login page. When the reader returns, they see what looks like a timed-out session, and they type in a password. Links in comments and user profiles are the riskiest ones, since anyone can post them.
Browsers have closed most of this gap. Safari 12.1, Firefox 79, and Chrome 88 all treat target="_blank" as if noopener were set. So the risk now lies with older browsers and with code that calls window.open directly. Search engines do not use noopener as a signal, so adding it will not change rankings. Don't confuse it with noreferrer, which also hides the source page, so your partners' analytics may see direct traffic.
To detect the issue, list every link with target="_blank" that goes to another host. Read its rel value and flag any without one of the two tokens. To fix it, add rel="noopener" in the template or the editor. Most CMS tools can do this for you. Use noreferrer only if you mean to hide the referrer. Review any feature that truly needs the link back to the opener, and keep those to hosts that you trust.