Tool Tests
Rel Noopener Noreferrer: Stop Wasting Time on Bogus SEO Myths
I see it every week: someone slaps rel noopener noreferrer on every link thinking it's a secret SEO lever. It's not. It's a security control. Period. It stops reverse-tabnabbing – when a malicious site hijacks your opener tab – and noreferrer kills the HTTP Referer header. Zero impact on rankings. Zero.
In this guide, I'll break down what each part does, where you actually need it, and where you're just making your analytics worse. No fluff, no vendor pitches. Just the facts.
- Security Impact
- Critical (prevents tabnabbing)
- SEO Impact
- None – confirmed by Google
- Default in CMS
- WordPress, Shopify auto-add
- Browser Support
- Universal (Chrome, Firefox, Safari)
Key takeaways
- Blocks reverse-tabnabbing by nullifying window.opener – without it, an external site can redirect your tab to a phishing page
- noreferrer suppresses the Referer header, which breaks your analytics unless you use UTM parameters
- Google, Ahrefs, and Moz all confirm: no effect on link equity or crawling. It's not a ranking signal.
- Required on every external target="_blank" link per modern security standards – Chrome Lighthouse will flag you if you skip it
- Overused on internal links where you actually want referrer data to flow within your site
Side by side
Link Attributes Comparison
| Attribute | Security Effect | Referrer Data | SEO Impact | Use Case |
|---|---|---|---|---|
| noopener | Blocks tabnabbing | Preserved | None | External new-tab links |
| noreferrer | Implies noopener | Hidden | None | Sensitive external links |
| nofollow | None | Preserved | Crawling hint | Untrusted/sponsored links |
Analysis
Security Risks Without noopener – Don't Be Lazy
Opening a link in a new tab without noopener is like leaving your front door unlocked. The new page can call window.opener.location and redirect your original page to a phishing or malware site. It also keeps a memory reference that slows performance and can leak cross-domain data.
I've audited sites that skip this on every external link. Even if the risk is low for most sites, it's a five-second fix. Chrome Lighthouse flags it. Treat it as a standard practice – not an optional nice-to-have. If you're serious about security, just add it.
Analysis
Implementation Guide – The Markup That Actually Works
Here's the code you need:
LinkWordPress has done this automatically since version 5.6. Shopify requires manual template edits. If you're not sure, run a quick check with any backlink checker tool that scans link attributes.
Yes, modern browsers treat noreferrer as implying noopener, but I still recommend using both for backward compatibility. That way IE11 and old Chrome users are covered too.
Analysis
SEO Myths – Let Me Kill Them Again
Myth: rel noopener noreferrer improves rankings. Reality: Zero effect. John Mueller from Google has stated these are browser controls, not ranking signals. Myth: It replaces nofollow. Reality: Different jobs. nofollow is a crawl hint; noopener and noreferrer are security/privacy behaviors.
If you're still confusing link attributes, read my referring domains vs backlinks guide. But for this attribute pair: the SEO impact is exactly zero. Stop treating it like a magic bullet.
Analysis
Performance Considerations – You're Probably Making It Worse
Modern browsers handle these attributes efficiently, but there's a trade-off. Every target="_blank" link without noopener keeps a memory reference to the opener – that's a performance leak. But adding noreferrer unnecessarily breaks your analytics paths. You lose referral data unless you manually append UTM parameters.
Before you bulk-change anything, run a backlink analysis to see what's actually happening. For internal links, I always skip noreferrer – I want that data flowing through my site. Use judgment, not a blanket rule.
Analysis
When to Use and When to Skip – Use Your Brain
Use rel="noopener noreferrer" on external links that open in a new tab. That's the baseline for security and privacy. Skip it on internal links – you want referrer data to flow within your site for analytics. Also skip it on same-tab links because there's no new browsing context.
I've seen sites apply it to every link blindly. That breaks internal tracking. If the link is to a trusted partner and you want to share referrer data, use only noopener. For more on link evaluation, see how I judge links.
Analysis
Comparison with nofollow – They're Not the Same
Let's be clear about the differences:
- noopener: Security-only. Blocks tabnabbing, preserves referrer, no SEO impact. Use for external new-tab links.
- noreferrer: Privacy-focused. Implies noopener, hides referrer, no SEO impact. Use for sensitive external links.
- nofollow: SEO control. No security effect, preserves referrer, crawling hint. Use for untrusted/sponsored links.
Ahrefs explicitly separates these. For a deeper dive into link attribute strategies, check my methods page.
Answers
Frequently asked questions
Does rel="noopener noreferrer" affect SEO?
No. Ahrefs and Google confirm these are security/privacy controls with zero ranking impact. They do not influence link equity or crawling.
When should I use noopener vs. noreferrer?
Use noopener alone for security without hiding referrers. Add noreferrer when privacy is also a concern. Modern browsers often combine their effects.
Is this required for internal links?
Rarely. Internal links generally don’t need referrer suppression, and the security risk is minimal unless navigating between untrusted subdomains.
How do I check if my site uses these correctly?
Audit tooling like Chrome Lighthouse flags missing noopener on target="_blank" links. For bulk analysis, use a backlink audit tool that scans markup.
Do I need both attributes?
Modern browsers treat noreferrer as implying noopener, but using both ensures backward compatibility with older browsers.
What does rel="noopener noreferrer" example look like?
A common example is Example.
Continue research