rel="noopener noreferrer"

noopener and noreferrer are HTML link attributes that control what happens when a link opens in a new tab via target="_blank". They are security and privacy controls, not SEO signals. Full stop.

noopener prevents the new page from accessing the original page's window.opener object. Without it, a malicious site can redirect your page to a phishing page without you noticing. That's called a reverse-tabnabbing attack, and it's been around long enough that there's no excuse for ignoring it.

noreferrer does everything noopener does and also suppresses the HTTP Referer header. The destination site won't see where the traffic came from. Modern browsers treat noreferrer as implying noopener, but using both ensures backward compatibility with older browsers.

Both attributes are documented by MDN Web Docs for , , and elements. They're not new, they're not controversial, and they're not optional if you care about security.

When you open a link in a new tab without noopener, the new page can do three things you don't want:

• Redirect your page to a phishing or malware URL via window.opener.location. Your visitor is now on a fake login page, and your site is the unwitting accomplice.
• Slow performance by maintaining a connection to the opener. It's not a huge hit, but it's unnecessary overhead.
• Leak analytics data cross-domain. The destination site gets your referrer data whether you want them to or not.

Chrome Lighthouse flags cross-origin links that open in a new tab without rel="noopener" or rel="noreferrer". Google's own developers recommend it, as documented in their Lighthouse best practices. If Lighthouse is yelling at you, listen.

For developers: Add the attribute to any tag that uses target="_blank" and points to an external domain.

For CMS users:

• WordPress: Enabled by default since version 5.6. If you're on a newer version, you're probably covered. Check your theme's link settings to be sure.
• Shopify: Requires manual template edits. Shopify's default behavior doesn't add these attributes, so you'll need to modify your theme files or use an app.
• Other platforms: Most modern CMS platforms add these automatically in some cases. Test with backlink audit tools to verify.

If you're not sure whether your site uses these attributes correctly, run a Lighthouse audit. It's free, it's fast, and it will tell you exactly which links need fixing.

I see two myths about these attributes more often than I'd like. Let's kill them both.

• Myth: noopener noreferrer improves rankings.
  Reality: Zero effect. Ahrefs states the SEO impact is 0. Google has never suggested otherwise. These attributes are about browser security and referrer privacy, not link equity or crawling.
• Myth: noopener noreferrer replaces nofollow.
  Reality: Different purposes entirely. nofollow is a crawl and endorsement hint for search engines. noopener and noreferrer handle browser security and referrer privacy. They are not interchangeable.

If you want to understand how these attributes compare to nofollow and others, see our backlink profile tools comparison.

Modern browsers handle these attributes efficiently, but there are trade-offs worth noting:

• Excessive target="_blank" links increase memory usage. Not a crisis, but don't use it on every link.
• Unnecessary noreferrer breaks analytics paths. If you're using noreferrer on links where referrer data matters, you're losing attribution data.
• Using noreferrer can break referral attribution in analytics. If you need that data, preserve it with UTM parameters or use noopener alone.
• Test with backlink audit tools before making bulk changes. A site-wide regex replacement can break things if you're not careful.

The rule of thumb: use noopener by default on external target="_blank" links. Add noreferrer only when you have a specific privacy reason to suppress referrer data.