rel="noreferrer noopener" in target="_blank" external links

Question

In numerous sites I have been reading, they say that you must use rel="noreferrer noopener" when using target="_blank" within external links.

I can understand why you should use noopener as a precaution against reverse tabnapping and also for performance benefits. I also understand using noreferrer for older browsers such as Firefox versions 51 and below due to the fact they do not support noopener, but as suggested in GitHub:

Trying to cater to older browsers is futile because there are numerous other security exploits those browsers are susceptible to. If the user wants to be secure, then the user should be using the latest browser.
- mojavelinux's comment (May 1, 2017)

Using noreferrer also affects Google Analytics data, and with the following stats:

• noopener is supported by just over 88% of tracked browsers (1.3% of browsers untracked),
• the most used unsupported browser is Internet Explorer 11 at 2.15% global usage, and
• this is closely followed by Edge version 18 and under at 2.11% global usage.

What is the current stance regarding use of noreferrer within target="_blank" external links? Must it still be used for security purposes or can it now be dropped?

Answer 1

rel="noreferrer" doesn't affect security. It is for your own privacy (or for being secretive).

If your page has a link to a page on site-X, when someone clicks on it, the log file on site-X will record the fact that your site provided the link.

Generally this could be considered a good thing. For instance they might notice that they are getting many referrals from your site, investigate, like what they see, and add their own links to your site. This would increase your own search rating.

But perhaps you don't want site-X to know that you have links to their pages. In that case, you'd add rel="noreferrer" to your link, and the other site will not be told about your link.

See also: html - When should I use rel=noreferrer? - Stack Overflow