Unsafe cross-origin links: add rel=noopener

What it means

This page has at least one link to an external domain that opens in a new tab (target="_blank") without rel="noopener". Without it, the opened page can access window.opener — a reference back to your page — and silently redirect your tab to any URL it chooses, replacing your page with a phishing clone (reverse tab-napping).

Why it matters

This is a user-safety issue, not a ranking factor — Google does not penalize pages for omitting rel="noopener". The attack exploits the trust a user places in the tab they opened first: after switching back, they may enter credentials into a page you never served. Modern Chrome (88+) and recent Firefox apply noopener automatically, but Safari and older browsers do not, so the explicit attribute remains the documented, consistent protection. noreferrer additionally suppresses the Referer header sent to the external site.

How to fix it

1. Add rel="noopener noreferrer" to every cross-origin target="_blank" link.
2. If you control a link component or templating layer, change it once to apply the fix site-wide.
3. For static-site generators or CMS platforms, enable the built-in option or plugin that enforces this automatically.
4. Re-crawl to confirm no external _blank links remain without noopener/noreferrer.

When it's not a problem

Only cross-origin links are flagged; internal target="_blank" links are lower risk (both pages are yours) and are not reported. If your audience is exclusively on browsers that enforce noopener automatically the practical risk is low — but the explicit attribute is still correct and costs nothing.

How common is it?

25 audited sites in our corpus currently show this issue. The breakdowns below show which platforms, gatekeepers, verticals and countries are most exposed.

Related guides

• Security Headers and SEO: HTTPS, HSTS, CSP