rel="noopener noreferrer"
rel="noopener noreferrer" is an HTML link attribute combination used with target="_blank" to prevent security risks and suppress referrer data. It addresses browser vulnerabilities like reverse-tabnabbing and reduces unintended URL leakage, but has no direct SEO impact.
This page explains how noopener and noreferrer work, their security and privacy benefits, common implementation patterns, and why they are distinct from SEO-focused attributes like nofollow.
At a glance
- Security Impact
- Critical (prevents tabnabbing)
- SEO Impact
- None
- Default in CMS
- WordPress, Shopify auto-add
- Browser Support
- Universal (Chrome, Firefox, Safari)
Security Risks Without noopener
When links open in new tabs without noopener, the new page can:
- Redirect the original page to phishing/malware URLs via
window.opener.location - Slow performance by maintaining connection to opener
- Leak analytics data cross-domain
This link risk is mitigated by adding the attribute.
Implementation Guide
For developers:
LinkFor CMS users:
- WordPress: Enabled by default since 5.6
- Shopify: Requires manual template edits
- Check your setup with backlink audit tools
SEO Myths Debunked
Common misconceptions:
- Myth: Improves rankings
- Reality: Zero effect (Google's John Mueller confirms)
- Myth: Replaces
nofollow - Reality: Different purposes entirely
See types of backlinks for attribute comparisons.
Performance Considerations
Modern browsers handle these attributes efficiently, but:
- Excessive
target="_blank"links increase memory usage - Unnecessary
noreferrerbreaks analytics paths - Test with backlink tools before bulk changes
Link Attributes Comparison
How security-focused attributes differ from SEO controls:
| Attribute | Security Effect | Referrer Data | SEO Impact | Use Case |
|---|---|---|---|---|
| noopenerSecurity-only | Blocks tabnabbing | Preserved | None | External new-tab links |
| noreferrerPrivacy-focused | Implies noopener | Hidden | None | Sensitive external links |
| nofollowSEO control | None | Preserved | Crawling hint | Untrusted/sponsored links |
Arguments for
- Blocks reverse-tabnabbing, a real security threat
- Reduces unintended referrer leakage to external sites
- Easy to implement via templates or CMS filters
- Widely supported by modern browsers
Arguments against
- Can obscure referral data in analytics without UTMs
- No SEO benefit, despite common misconceptions
- Overuse on internal links complicates tracking
- Auto-insertion by CMSs may lack granular control
What the experts say
rel=noopener is about browser security, not SEO. We don't use it for ranking.
Frequently asked questions
Does rel="noopener noreferrer" affect SEO?
No. Ahrefs and Google confirm these attributes are security/privacy controls with no ranking impact. They do not influence link equity or crawling.
When should I use noopener vs. noreferrer?
Use noopener alone for security without hiding referrers. Add noreferrer when privacy is also a concern. Modern browsers often combine their effects.
Is this required for internal links?
Rarely. Internal links generally don’t need referrer suppression, and the security risk is minimal unless navigating between untrusted subdomains.
How do I check if my site uses these correctly?
Audit tooling like Chrome Lighthouse flags missing noopener on target="_blank" links. For bulk analysis, backlink audit tools can scan markup.
Do I need both attributes?
Modern browsers treat noreferrer as implying noopener, but using both ensures backward compatibility.
Sources
Every factual claim on this page is drawn from the following independent sources. Links open in a new tab.
- Google Chrome DevelopersLighthouse guidance that cross-origin `target="_blank"` links should use `rel="noopener"` or `rel="noreferrer"`.
- MDN Web Docs`noopener` behavior, including preventing access to `window.opener` for `<a>`, `<area>`, and `<form>`.
- Ahrefs Help CenterDifference between `noreferrer`, `noopener`, and `nofollow`; SEO impact; analytics/referrer effects.
- SEOptimerCommon usage of `rel="noopener noreferrer"` on external `target="_blank"` links and CMS auto-application context.
- ElementorSecurity explanation, privacy/referrer explanation, and practical example markup.
- AuditBuffetPattern guidance to add `rel='noopener noreferrer'` to external links that open in a new tab.
- Google Chrome DevelopersDuplicate Chrome guidance showing `noopener` and `noreferrer` in example markup.