Security · Checked on every page
External links security (noopener)What it checks and how to fix it
What it checks
Parses each page for links that open in a new tab (target="_blank") and point to another host. Any such link without rel="noopener" or rel="noreferrer" fails; pages with none, or where every one has them, pass.
Why it matters
A page opened with target="_blank" gets a reference back to your tab through window.opener, and can silently navigate it to a phishing copy of your site while the user reads the new tab (reverse tabnabbing). Modern browsers imply noopener for target="_blank", but older ones and some in-app webviews do not, so setting it explicitly closes the gap.
How to fix it
Add rel="noopener noreferrer" (or at least noopener) to every external link that opens in a new tab.
<a href="https://partner.example" target="_blank" rel="noopener noreferrer">Partner</a>
Rails
<%= link_to "Partner", "https://partner.example", target: "_blank", rel: "noopener noreferrer" %>
In a CMS, fix it in the theme or link template, or use a sanitizer/plugin that adds the attribute to outbound links. Use noopener alone if you still want to send the referrer to the destination.