External links missing noopener noreferrer

What Is This Issue

When you link to external websites and set the link to open in a new tab (target="_blank"), you should include the rel="noopener noreferrer" attribute. This issue checks whether all external links that open in new tabs have these security attributes properly set.

A passing implementation requires:

All external links with target="_blank" include rel="noopener noreferrer"
Both noopener and noreferrer tokens are present (not just one)
The rel attribute is properly formatted with correct spelling

Example: A link to an external site: <a href="https://example.com" target="_blank" rel="noopener noreferrer">Visit Example</a>

Why Is This Important

Proper rel attributes for external links are important because they:

Improve Security: Prevent reverse tabnabbing attacks where the external page can manipulate your page through window.opener
Protect Privacy: Prevent sending referrer information to external sites when noreferrer is used
Follow Best Practices: Modern browsers recommend these attributes for all external links opening in new tabs
Protect User Experience: Prevent external pages from being able to redirect your page to a malicious URL

While this issue doesn’t directly impact rankings, it’s considered a best practice for website security and user privacy, which indirectly supports your overall SEO health score.

How XeoPix Detects This

XeoPix performs external link security checks through the following logical steps:

Link Extraction: XeoPix crawls your pages and extracts all external links (links pointing to different domains).
Target Filtering: XeoPix filters for external links that have target="_blank" attribute (links that open in new tabs).
Rel Attribute Check: For each external link with target="_blank", XeoPix checks the rel attribute to verify it includes both:
- noopener token
- noreferrer token
Token Validation: XeoPix parses the rel attribute value and checks for the presence of both required tokens (case-insensitive).
Issue Identification: XeoPix raises issues when:
- External links with target="_blank" are missing the rel attribute entirely (SUGGESTION)
- External links are missing one or both required tokens (SUGGESTION)

Note: XeoPix analyzes links in raw HTML only and does not execute JavaScript. Links generated only by JavaScript cannot be detected for this check.

How To Fix

Audit your external links: Check all links that have target="_blank" and ensure they include rel="noopener noreferrer".
Add missing attributes: For each external link opening in a new tab, update the HTML to include both tokens:
```
<a href="https://external-site.com" target="_blank" rel="noopener noreferrer"
  >Link Text</a
>
```
Update templates and components: If you use shared templates or components for external links, update them to automatically include these attributes.
Check for partial implementation: Ensure you’re not missing one of the two tokens (some sites only have noopener but not noreferrer, or vice versa).
Test after changes: After making changes, re-crawl your site to confirm all external new-tab links now have proper rel attributes.

What We Store

Storage Level

Page Level — This issue is evaluated for each individual page and its external links.

Database Table / Prisma Model

PageExternalLink

Stored Fields

Field	Type	Description
urlId	String	The ID of the page being analyzed
externalUrl	String	The external URL that is linked to
hasNoOpener	Boolean?	Whether the link has rel=“noopener”
hasNoReferrer	Boolean?	Whether the link has rel=“noreferrer”

Detection Dependencies

The following data sources are required to evaluate this issue:
HTML Document — The crawler extracts all external links from the page
External Links — All links pointing to different domains are identified
Link Attributes — The crawler checks for security-related rel attributes

Examples

Example 1: Missing rel Attribute

Problematic State (Fails): An external link opens in a new tab without security attributes:


<a href="https://external-site.com" target="_blank">Visit External Site</a>

Corrected State (Passes): Add both noopener and noreferrer tokens:


<a href="https://external-site.com" target="_blank" rel="noopener noreferrer"
  >Visit External Site</a
>

Example 2: Missing One Token

Problematic State (Fails): Only one token is present:


<a href="https://external-site.com" target="_blank" rel="noopener"
  >Visit External Site</a
>

Corrected State (Passes): Include both tokens:


<a href="https://external-site.com" target="_blank" rel="noopener noreferrer"
  >Visit External Site</a
>

Example 3: Internal Links (No Issue)

No Issue (Passes): Internal links don’t require noopener noreferrer:


<a href="/contact" target="_blank">Contact Us</a>

This is fine because it’s an internal link (same domain).

Unit Test

Test File

xeopix-crawling-v2/__tests__/seo-audit-checks/crawlBehaviour/issue-50-external-links-security.test.js

Purpose

This unit test validates that the checkExternalLinksSecurity() function correctly detects external links that are missing the noopener and noreferrer security attributes, ensuring safe external linking practices.

Tested Function

checkExternalLinksSecurity() from seo-audit-checks.js

Issue Information

Issue Number: 50
Issue Code: EXTERNAL_LINKS_USE
Toggle Group: crawlBehaviour

Test Scenarios

Positive Test Cases

External links have both noopener and noreferrer attributes → insecureLinksCount is 0, no issues

Negative Test Cases

External link missing noopener (but has noreferrer) → EXTERNAL_LINKS_USE issue created with insecureLinksCount of 1

Boundary Cases

None

Edge Cases

Multiple insecure links in a single scan (one missing both attributes, one missing only noreferrer) → insecureLinksCount is 2, both links reported in details.insecureLinks

Expected Outcome

Pass

An EXTERNAL_LINKS_USE issue is not reported when all external links have both noopener and noreferrer attributes set to true.

Fail

An EXTERNAL_LINKS_USE issue is reported when any external link is missing the noopener or noreferrer security attribute, with the count and details of insecure links.

Validation

Verifies that links with both security attributes produce no issues
Validates detection of links missing noopener
Checks that multiple insecure links are all reported in the issue details
Validates payload structure (insecureLinksCount, details.insecureLinksCount, details.insecureLinks)

xeopix-crawling-v2/seo-audit-checks.js
xeopix-crawling-v2/issueCodes.js

Coverage Summary

3 test cases (positive, negative, and multiple-links edge case)
Covers single and multiple insecure link detection
Validates aggregate count and per-link details in the payload

References

Link Types — WHATWG
rel=‘noopener’ — MDN
Reverse Tabnabbing — OWASP