Key Takeaways

• rel="noopener noreferrer" combines two HTML link values with different purposes: security and referrer privacy.
• noopener prevents a newly opened page from accessing or manipulating the original page through window.opener.
• noreferrer prevents the destination website from receiving the referring page’s URL.
• Modern browsers generally apply noopener protection automatically to links using target="_blank", but adding it explicitly remains a clear security practice.
• noreferrer also provides noopener behaviour, although both values are often included to make their purpose explicit.
• Neither noopener nor noreferrer works like nofollow; they do not instruct search engines to ignore the link.
• noreferrer can affect referral analytics because visits may appear as direct or unattributed traffic.
• Use noreferrer selectively when referrer privacy is required, rather than adding it automatically to every external link.
• For affiliate links, confirm the platform’s tracking requirements before using noreferrer, and add rel="sponsored" to identify the commercial relationship.
• For most external links opening in a new tab, target="_blank" with rel="noopener" is an appropriate default.

What Does rel="noopener noreferrer" Mean?

The HTML attribute rel="noopener noreferrer" is used to improve security and control referrer information when a link opens in a new browser tab or window.

Although the two values commonly appear together, they perform different functions:

• noopener prevents the newly opened page from accessing the original page through the JavaScript window.opener property.
• noreferrer prevents the browser from sending the referring page’s URL to the destination website. Under the HTML standard, it also provides the security behavior of noopener.

These values do not perform the same function as nofollow, sponsored, or ugc. They primarily control browser security and privacy, while nofollow, sponsored, and ugc help search engines understand the nature of a link.

A typical link using both values looks like this:

<a href="https://example.com"
   target="_blank"
   rel="noopener noreferrer">
   Visit Example
</a>

In this example, target="_blank" opens the destination in a new tab, noopener protects the original page, and noreferrer prevents referrer information from being sent.

Understanding the HTML rel Attribute

The rel attribute describes the relationship between the current page and the linked resource. It can contain one or more space-separated values.

For example:

<a href="https://example.com" rel="nofollow sponsored">
   Sponsored Partner
</a>

Here, the link contains two relationship values:

• nofollow indicates that the publisher does not want to associate the link with a normal editorial endorsement.
• sponsored identifies the link as an advertisement, sponsorship, affiliate placement, or another paid arrangement.

Similarly:

<a href="https://example.com"
   target="_blank"
   rel="noopener noreferrer">
   External Resource
</a>

In this case, noopener and noreferrer control what happens in the browser when the link is opened. They do not label the link as paid, untrusted, or user-generated.

What Is rel="noopener"?

rel="noopener" is a security-focused value used primarily with links that open in a new browser tab or window.

When a page opens another page, the newly opened page may receive a reference to the original page through a JavaScript property called window.opener. In affected browser environments, a malicious destination could attempt to use this connection to redirect or manipulate the original tab.

Adding noopener prevents the new page from receiving that access. The window.opener property in the opened page is set to null.

Example:

<a href="https://example.com"
   target="_blank"
   rel="noopener">
   Open Securely
</a>

This link opens in a new tab and prevents the destination from controlling the page that opened it. However, normal referrer information may still be sent because noreferrer has not been added.

What is reverse tab-nabbing?

Reverse tab-nabbing is an attack in which a page opened in a new tab attempts to change the original tab.

A typical scenario could involve the following:

1. A visitor clicks a link that opens an external site in a new tab.
2. The visitor begins viewing the new page.
3. A malicious script on the destination accesses the original page through window.opener.
4. The original tab is redirected to a fake login page or another deceptive destination.
5. When the visitor returns to the original tab, the substituted page may appear legitimate.

The visitor may not notice that the original page has been replaced because their attention moved to the new tab.

Using noopener breaks this connection and prevents the newly opened page from manipulating the originating page through window.opener.

Is noopener still necessary in modern browsers?

Modern browsers generally treat links using target="_blank" as if rel="noopener" were present. This means current browser versions normally prevent the new page from receiving a usable window.opener reference even when noopener is not written explicitly.

Explicitly adding noopener can still be useful because it:

• Makes the intended security behavior clear to developers.
• Supports visitors using older browser versions.
• Helps code-review and security-audit tools identify protected links.
• Avoids relying entirely on implicit browser behavior.

Therefore, noopener remains a sensible, explicit safeguard for external links that open in a new tab, even though modern browsers provide similar protection automatically.

What Is rel="noreferrer"?

rel="noreferrer" is a privacy-focused link value. It instructs the browser not to send the Referer HTTP header when the visitor follows the link.

Example:

<a href="https://example.com"
   target="_blank"
   rel="noreferrer">
   Visit Privately
</a>

If someone clicks this link, the destination website will not normally receive the URL of the page from which the visitor arrived.

Traffic generated by the link may consequently appear as direct, unattributed, or otherwise unclassified traffic in the destination’s analytics platform.

The value can be useful when:

• The referring URL contains sensitive information.
• A link appears inside a private dashboard or account area.
• The publisher does not want to disclose the source page.
• Referrer privacy is more important than referral attribution.
• The destination does not need to know which page generated the visit.

Under the HTML standard, noreferrer also provides noopener behaviour. This means it prevents referrer information from being sent and protects the original page from access through window.opener.

Does noreferrer hide all user information?

No. noreferrer specifically controls referrer information associated with the navigation. It does not make the visitor anonymous.

The destination may still receive or determine information such as:

• The visitor’s IP address.
• Browser and device information.
• Cookies previously set by the destination.
• URL parameters included in the link.
• Affiliate or campaign identifiers.
• Information provided through logins or submitted forms.

Therefore, noreferrer should not be described as a complete anonymity or privacy solution. It simply prevents the browser from sending the originating page as the referrer.

What Does rel="noopener noreferrer" Do When Combined?

When both values are used, the link provides two explicit protections:

1. noopener prevents the new page from accessing the original page through window.opener.
2. noreferrer prevents the destination from receiving the referring page’s URL.

Example:

<a href="https://example.com"
   target="_blank"
   rel="noopener noreferrer">
   Visit External Website
</a>

Because noreferrer already implies noopener behavior, adding both values is technically redundant in standards-compliant modern browsers. However, developers often include both because the markup makes both intentions clear: protect the original page and suppress referrer information.

The decision to include noreferrer should be deliberate. If you want the destination to receive referral information, use noopener without noreferrer.

Comparison of Common Link Attributes

Attribute	Primary purpose	Blocks window.opener	Hides referrer	Can affect referral reporting	Search link qualifier
noopener	New-tab security	Yes	No	No	No
noreferrer	Referrer privacy	Yes	Yes	Yes	No
nofollow	Search-engine link qualification	No	No	No	Yes
sponsored	Identifies paid or affiliate links	No	No	No	Yes
ugc	Identifies user-generated links	No	No	No	Yes

Multiple values can be added to the same link when they serve different purposes.

For example, an affiliate link that opens in a new tab might use:

<a href="https://affiliate.example.com/?ref=123"
   target="_blank"
   rel="noopener sponsored">
   View the Offer
</a>

In this example:

• noopener provides explicit new-tab security.
• sponsored identifies the commercial relationship.
• Referrer information can still be sent because noreferrer is not present.

Benefits of rel="noopener noreferrer"

1. Protects against reverse tab-nabbing

The main security benefit comes from preventing the newly opened page from accessing the original page through window.opener. This reduces the risk of an external destination redirecting the originating tab to a phishing or deceptive page.

2. Prevents the destination from controlling the original tab

Separating the two browsing contexts ensures that the destination cannot use the opener connection to manipulate the original page. This is particularly valuable when linking to external websites that the publisher does not control.

3. Prevents referrer information from being disclosed

The noreferrer value stops the referring URL from being sent to the destination. This can protect private URLs, campaign details, internal paths, search parameters, or other information contained in the source address.

4. Provides explicit protection for older browsers

Although modern browsers normally apply noopener behaviour automatically to target="_blank", writing the value explicitly makes the security intention clear and provides better compatibility with older browser environments.

5. Does not act like nofollow

Neither noopener nor noreferrer tells search engines to disregard a link. These values manage browser behavior rather than classifying the link for search engines.

If a link is paid, sponsored, affiliate-generated, untrusted, or user-generated, the relevant search-focused value should be added separately.

6. Requires no JavaScript or external software

The attribute works through native browser behavior. It requires no script, library, API, plugin, or additional network request. It can be added directly to an HTML link without affecting the page’s layout or loading speed.

7. Gives publishers more control over outbound links

Publishers can decide separately whether to:

• open a link in a new tab.
• prevent the destination from accessing the original page.
• pass or suppress referrer information.
• identify the link as sponsored, nofollowed, or user-generated.

This makes link behaviour more intentional and easier to manage.

When Should You Use rel="noopener"?

Consider explicitly using noopener when:

• An external link uses target="_blank".
• You do not control the destination website.
• The destination could change after the link is published.
• Your website supports users with older browsers.
• You want security audits to identify the protection directly in the HTML.

Recommended structure:

<a href="https://example.com"
   target="_blank"
   rel="noopener">
   Visit Example
</a>

This is often the best general-purpose option because it provides explicit security protection while preserving normal referral information.

When Should You Use rel="noreferrer"?

Use noreferrer when you intentionally do not want the destination to receive the referring page’s URL.

Possible situations include:

• Links from private dashboards.
• Links from logged-in account areas.
• URLs containing sensitive query parameters.
• Confidential research or internal tools.
• Situations where referrer privacy is required by policy.
• External links for which referral attribution is unnecessary.

Recommended structure:

<a href="https://example.com"
   target="_blank"
   rel="noopener noreferrer">
   Visit Without Sending Referrer Data
</a>

Do not apply noreferrer automatically to every external link without considering its effect on analytics, partnerships, affiliate programs, and referral attribution.

When Is noreferrer Unnecessary?

You may not need rel="noreferrer" when:

• You want another website to recognize your referral traffic.
• A partner requires referrer data for reporting.
• An affiliate platform uses the referrer for attribution or validation.
• You are linking between pages on your own website.
• Normal analytics attribution is more important than referrer privacy.
• The source URL does not contain sensitive information.

In such cases, use noopener alone for links that open in a new tab.

Does rel="noopener noreferrer" Affect SEO?

noopener and noreferrer are not search-engine link qualification values. Unlike nofollow, sponsored, and ugc, they do not instruct search engines how to classify the commercial or editorial relationship behind a link.

Their purposes are:

• noopener: browser security.
• noreferrer: referrer privacy.

Using these values does not convert a normal link into a nofollow link. They also do not prevent a crawler from accessing the linked URL merely because noopener or noreferrer is present.

However, claims that they guarantee the passage of PageRank or link equity should be avoided. Search engines independently decide how links are discovered, interpreted, weighted, and used in ranking systems.

The most accurate conclusion is that noopener and noreferrer are not designed to control SEO authority. If you need to qualify a link for search engines, use the appropriate value:

• Use sponsored for advertisements, sponsorships and affiliate links.
• Use ugc for links added through comments, forums or other user-generated content.
• Use nofollow when the other link qualifications do not apply and you do not want Google to associate your website with the linked resource.

Is rel="noopener noreferrer" a Ranking Factor?

No established evidence shows that adding noopener or noreferrer directly improves search rankings.

Secure linking practices are valuable for users and website management, but the attribute should not be presented as a direct ranking factor or an E-E-A-T signal. Its primary value lies in security and privacy, not ranking improvement.

The absence of a direct SEO benefit does not make the attribute unimportant. Security controls should be implemented because they reduce risk, not because they are expected to increase keyword rankings.

Does noreferrer Affect Analytics?

Yes. noreferrer can affect referral reporting.

When the destination does not receive a Referer header, its analytics platform cannot normally identify the originating page through that header. The visit may be recorded as direct, unattributed, or classified through another available tracking method.

The effect depends on the analytics setup. Tracking may still work through:

• UTM campaign parameters.
• Affiliate IDs embedded in URLs.
• First-party or third-party cookies.
• Redirect-based tracking.
• Server-to-server attribution.
• Logged-in user accounts.
• Dedicated campaign landing pages.

For example:

<a href="https://example.com/?utm_source=publisher&utm_medium=referral"
   target="_blank"
   rel="noopener noreferrer">
   Visit Campaign Page
</a>

The destination will not receive the source page through the Referer header, but it may still read the UTM parameters included in the URL.

This does not mean all analytics will remain accurate. Each tracking system must be evaluated individually.

Should Affiliate Links Use rel="noopener noreferrer"?

Using noopener on affiliate links that open in a new tab is a sensible security practice. Whether to add noreferrer depends on the affiliate program’s tracking requirements.

Many affiliate platforms track activity through:

• Unique affiliate URLs.
• Query-string identifiers.
• Redirect systems.
• Cookies.
• Server-side conversion records.

In these systems, suppressing the referrer may not prevent commission attribution. However, some platforms may use referrer information for validation, partner reporting, compliance checks, traffic-quality analysis, or fraud detection.

It is therefore inaccurate to guarantee that noreferrer will never affect affiliate tracking.

Before adding it, check the affiliate program’s documentation or ask its support team whether referrer information is required.

A common affiliate-link structure is:

<a href="https://affiliate.example.com/?partner=123"
   target="_blank"
   rel="noopener sponsored">
   Buy Now
</a>

Add noreferrer Only when referrer privacy is required, and the affiliate platform confirms that removing the referrer will not cause problems.

How Does WordPress Handle noopener and noreferrer?

WordPress link behavior can vary depending on the WordPress version, editor, theme, block, plugin, and how the link was inserted.

Modern browsers already provide implicit noopener protection for standard links using target="_blank". WordPress and its editors have also changed their handling of new-tab links over time, so website owners should not assume that every WordPress link will always contain both values.

You can check a link by opening the post in the WordPress code editor or inspecting the published HTML.

Look for markup such as:

<a href="https://example.com"
   target="_blank"
   rel="noopener">
   External Link
</a>

or:

<a href="https://example.com"
   target="_blank"
   rel="noopener noreferrer">
   External Link
</a>

If referral information needs to be preserved, keep noopener and remove noreferrer, provided no plugin or editor automatically restores it.

If the link is sponsored or affiliate-generated, add sponsored separately:

<a href="https://example.com"
   target="_blank"
   rel="noopener sponsored">
   Sponsored Link
</a>

After updating a link, inspect the published page rather than relying only on what appears in the visual editor.

How to Check Whether a Link Uses These Values

Check the page source

Open the published page, view its HTML source, and search for:

noopener

or:

noreferrer

Use browser developer tools

Right-click the link and select Inspect. The browser’s developer tools will display its final HTML.

Example:

<a href="https://example.com"
   target="_blank"
   rel="noopener noreferrer">
   Example
</a>

Use the WordPress code editor

Open the post or page, switch to the code editor, locate the link, and review its target and rel attributes.

Remember that plugins, filters, or themes can modify markup when the page is rendered. Inspecting the published HTML provides the most reliable result.

Common Misunderstandings

noopener and nofollow are the same

They are not the same.

noopener protects the original page from access through window.opener. nofollow helps qualify the link for search engines. One concerns browser security; the other concerns search interpretation.

noreferrer makes visitors anonymous

It does not. It removes referrer information, but the destination can still receive the visitor’s IP address, browser information, cookies, URL parameters, and submitted data.

Every external link needs noreferrer

Not necessarily. Use noreferrer when you intentionally want to suppress referrer information. For general external links, noopener may provide the desired security protection without affecting referral reporting.

noreferrer always breaks affiliate tracking

Not always. Many programs use tracking URLs, cookies, or server-side attribution. Nevertheless, some systems may rely on the referrer for reporting, verification, or fraud prevention. Check the program before using it.

noopener noreferrer improves rankings

There is no established evidence that either value directly improves rankings. Their main functions are security and privacy.

Frequently Asked Questions

What does rel="noopener noreferrer" do?

rel="noopener noreferrer" combines new-tab security with referrer privacy. noopener prevents the opened page from accessing the original page through window.opener, while noreferrer prevents the destination from receiving the referring URL. Under the HTML standard, noreferrer also provides noopener behavior.

Is noopener still required with target="_blank"?

Modern browsers generally apply noopener behavior automatically to links using target="_blank". Explicitly adding it remains useful for clarity, compatibility with older browsers, and security auditing. It makes the intended protection visible in the HTML rather than relying entirely on implicit browser behavior.

Does noreferrer automatically include noopener?

Yes. Under the HTML standard, noreferrer also causes the link to behave as if noopener were present. Developers frequently write both values because doing so clearly documents both intentions, even though the additional noopener value is technically redundant in modern standards-compliant browsers.

Does rel="noopener noreferrer" affect SEO?

These values do not act like nofollow, sponsored, or ugc. They are designed for browser security and referrer privacy rather than search-engine link qualification. They do not, by themselves, instruct search engines to stop crawling the destination or classify the link as paid or untrusted.

Does noreferrer affect referral traffic in Google Analytics?

It can affect referral reporting because the destination does not receive the referring URL. A visit may appear as direct or unattributed traffic unless another method, such as UTM parameters, affiliate identifiers, cookies, or server-side attribution, identifies the source.

Should affiliate links use noreferrer?

Use noreferrer on affiliate links only after checking the program’s tracking requirements. Many affiliate platforms use tracking parameters and cookies, but others may also use referrer information for reporting, fraud detection, validation, or compliance. Use rel="noopener sponsored" as a practical starting point for affiliate links opening in a new tab.

What is the difference between noopener and nofollow?

noopener is a browser-security value that blocks access through window.opener. nofollow is a search-focused value used to qualify a link when the publisher does not want to give it a normal editorial association. They solve different problems and can be used together when necessary.

Should internal links use noopener noreferrer?

Internal links opening in the same tab generally do not need either value. If an internal link opens in a new tab, modern browsers normally provide implicit noopener protection. Adding noreferrer to internal links is rarely helpful and may interfere with analytics or user-journey attribution.

Final Takeaway

rel="noopener noreferrer" combines two distinct link controls. noopener protects the original page when a link opens in a new tab, while noreferrer prevents the destination from receiving referrer information.

For most external links using target="_blank", explicitly adding noopener is a sensible security practice. Add noreferrer only when you deliberately want to hide the referring URL and understand its possible effects on analytics, partnerships, and affiliate tracking.

Neither value replaces nofollow, sponsored, or ugc. If a link is paid, affiliate-generated, untrusted, or user-generated, use the appropriate search-focused attribute separately.

The practical rule is simple:

<!-- Security protection with normal referral information -->
<a href="https://example.com"
   target="_blank"
   rel="noopener">
   Visit Example
</a>

<!-- Security protection without referral information -->
<a href="https://example.com"
   target="_blank"
   rel="noopener noreferrer">
   Visit Privately
</a>

<!-- Affiliate or paid link opening in a new tab -->
<a href="https://affiliate.example.com"
   target="_blank"
   rel="noopener sponsored">
   View Offer
</a>

Choose the combination based on the link’s purpose rather than applying every value automatically.

Technical References

• MDN: rel="noopener"
• MDN: rel="noreferrer"

Last updated: July 2026