Unsafe Cross-Origin Links Test

External links opened in a new tab with target="_blank" can, without the right safeguards, give the destination page JavaScript access to the original window, a long-standing browser quirk that modern browsers now mitigate by default. Adding rel="noopener" or rel="noreferrer" makes the protection explicit, ensures consistent behavior on older browsers, and enforces process isolation between the tabs. This test checks whether the external new-tab links on your page include the recommended rel attributes.

Why cross-origin link safety still matters

Without rel="noopener", the destination page can access the original window via JavaScript and potentially redirect it to a malicious URL while the user is reading the new tab. Modern browsers default to noopener behavior to prevent this, but explicit attributes still matter on legacy browsers and as documentation of intent. They also enforce process isolation: with noopener, the destination page runs in a separate browser process, so heavy JavaScript on the linked page cannot degrade the performance of the original tab.

Adding the attributes explicitly is also good code hygiene. They communicate the intent clearly to anyone reading the markup later, they survive copying or migrating content between sites, and they enable static-analysis lint rules to enforce the convention across a codebase. The cost is two extra characters per external link and the benefit is consistent behavior across browser versions.

Common situations this test catches

• Hand-written external links missing the attribute, especially in older content.
• Old content from before the editor added it automatically, where a one-time bulk update covers it.
• Markdown-rendered content where the renderer needs configuration to add the attributes by default.
• Embedded HTML from third-party sources that does not follow modern conventions.

This test reports external links that lack the recommended rel attributes. The fix guide below covers adding them in raw HTML, configuring CMS editors and Markdown renderers to add them by default, and lint rules that enforce the convention in framework code.