In numerous sites I have been reading, they say that you must use
rel="noreferrer noopener" when using
target="_blank" within external links.
I can understand why you should use
noopener as a precaution against reverse tabnapping and also for performance benefits. I also understand using
noreferrer for older browsers such as Firefox versions 51 and below due to the fact they do not support
noopener, but as suggested in GitHub:
Trying to cater to older browsers is futile because there are numerous other security exploits those browsers are susceptible to. If the user wants to be secure, then the user should be using the latest browser.
- mojavelinux's comment (May 1, 2017)
noreferrer also affects Google Analytics data, and with the following stats:
noopeneris supported by just over 88% of tracked browsers (1.3% of browsers untracked),
- the most used unsupported browser is Internet Explorer 11 at 2.15% global usage, and
- this is closely followed by Edge version 18 and under at 2.11% global usage.
What is the current stance regarding use of
target="_blank" external links? Must it still be used for security purposes or can it now be dropped?