Skip to content

Security

Why external links need rel=noopener

The opened page gets a handle on yours through `window.opener` and can navigate it somewhere else — the tabnabbing pattern, where the tab you came back to is a convincing fake login page. Current browsers imply it for `target=_blank`, so this is mostly about older browsers and about being explicit.

What 13x checks

This is rule security.target-blank in the public registry: External links use rel=noopener. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Security
Score weight
3 of the readiness score
Scope
Reported as skipped when the page renders only with JavaScript
Applies
To every site

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

links open in a new tab without rel="noopener":

html code
<a href="https://example.com" target="_blank" rel="noopener noreferrer">
  External link
</a>

Without noopener, the opened page gets a handle on yours via window.opener and can navigate it elsewhere — the tabnabbing pattern, where the tab you return to is a convincing fake login page.

Current browsers imply noopener for target="_blank", so this is mostly older browsers and being explicit. noreferrer additionally withholds the referring URL.

Worth a lint rule so it does not come back: react/jsx-no-target-blank is on by default in most React configs.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More security checks