1

Add rel="noopener" to outgoing links with target="_blank" for security and better performance.

But is this enough nowadays?

There are already a good number of pages and articles about this topic I found. In general, they all say the same but then they also differ from each other.

What about compatibility?

On caniuse.com we can check for some:

We can see that noreferrer has better compatibility. But also, IE11 support is combined with some warnings here, so I checked it manually. There is a good demo page that I found that we can use for testing the security issue: https://mathiasbynens.github.io/rel-noopener/

  • rel="noopener" is not working on IE11
  • rel="noreferrer" is solving that security issue for IE11

What does Google say?

Google recommends using either noopener or noreferrer. They explicitly also saying that setting noopener helps protect users of legacy browsers.

[...] Explicit specification of rel="noopener" helps protect users of legacy browsers including Edge Legacy and Internet Explorer. [...]

See here: https://web.dev/external-anchors-use-rel-noopener/

Conclusion?

So, what is now our conclusion? I don't have an answer to this but of course we can say that setting both is more secure because it is better supported. We for example want to support IE11 still since we have lots of users coming with this browser. But since it also breaks analytics, I can't live with this.

What are your opinions on this?

Is it depending on the browsers you would like to support or can we assume that other security issues are way heavier so that we can go for noopener. Users of older browsers are anyway insecure in way more areas ...

3
  • IE has about 1% market share at this point. Far from "lots of visitors", 1% is the threshold at which I typically stop supporting a browser. I also don't think that rel="noopener" breaks the links in IE 11, it just doesn't give the security benefits. It shouldn't hurt to put it in if it help security in other browsers. – Stephen Ostermiller Jan 12 at 12:39
  • I've closed this because this site is not a good place for discussion questions. Perhaps you could reword this ask for answers rather than discussion and opinion. – Stephen Ostermiller Jan 12 at 12:40
  • @StephenOstermiller Thanks for your reply! You're right, I'm asking for opinions and discussions here - this is exactly what I asked for. I was thinking about rewording this post. But in the end this will remain an opinion based topic and you need to find the best suitable way for yourself. – Nico W. Jan 13 at 15:49

Browse other questions tagged or ask your own question.