This check reviews links that open a new browsing context with target="_blank" and confirms the new page cannot control the original page through window.opener.
Why this matters
A newly opened page that retains an opener reference could redirect or manipulate the original tab. Modern browsers generally treat target="_blank" as if rel="noopener" were present, but an explicit value keeps the security intent clear and supports older or unusual environments.
noreferrer is a separate privacy choice. It suppresses the HTTP Referer header and also provides opener protection, so do not add it automatically when analytics, attribution, or destination behavior needs the referrer.
How to fix it
- Use the correct value:
target="_blank", without spaces or underscores insideblank. - Add
rel="noopener"to links that open an untrusted or external destination in a new tab. - Add
noreferreronly when suppressing referrer information is intentional. - Prefer normal same-tab navigation unless opening a new tab clearly supports the user’s task.
- Keep the link text descriptive so users understand the destination before activating it.
<a href="https://example.com/products" target="_blank" rel="noopener">
View the product catalog
</a>
How to verify the fix
Inspect the rendered anchor and confirm that target and rel contain the intended values. Open the destination and verify in a controlled test that window.opener is unavailable. Recheck links generated by CMS content, reusable components, and client-side rendering rather than reviewing only the source template.