Security check
Unsafe cross-origin links
Finds links to other sites that open in a new tab (target="_blank") without rel="noopener" or rel="noreferrer".
- Category
- Security
- Importance
- Medium importance
- Check id
- unsafe-cross-origin-links
How the result is decided
- PassEvery external new-tab link has noopener or noreferrer.
- WarningAt least one doesn’t.
Why it matters
Without noopener, the opened page can reach back to your tab through window.opener and, for example, redirect it to a phishing page. Modern browsers default to noopener, but older ones don’t.
How to fix it
<a href="https://partner.example" target="_blank" rel="noopener noreferrer">Partner</a>After the fix, open the page’s report and choose Run again to confirm it passes.