Should rel="noopener" be set on links to external sites even if I own the site?

Question

We've had a policy to always set rel="noopener" for all external links.

However is that necessary if the external link is to a site in our own control? Let's say we own both coffee.example.com and milk.example.com - should we add those attributes when linking from one site to the other?

To me it feels unnecessary.

However, a colleague disagrees and says it's always a good idea to include at least rel="noopener" when linking to ANY other site, no matter what.

EDIT: I also notice that Lighthouse will complain about external links without rel="noopener". So the question is if it's just considered best practice to add that attribute for all external links even if you control the site being linked to.

Answer 1

Is it necessary? No. Is it best practice to do it anyway? Yes.

Here are a few reasons:

• Ownership and management of external sites can change, leaving them in less trusted hands. You would need to remember to go back and change all your links.

• The hosting setup of external sites (even subdomains) can be heterogeneous, meaning that a compromise in the server software of one domain could more easily compromise the experience of visitors to the other domain.

• By always using noopener, you don't need to keep a list of "trusted" and "untrusted" domains, then audit your links to make sure the links to untrusted domains have the noopener attribute. If your policy is to add noopener to all external links, it's easy to tell at a glance if a particular link is noncompliant with your policy.

Answer 2

I fully agree with Max's answer, rel-noopener is always best practice. One important thing to add:

When linking to external sources, it's common to have them open in a new tab. Ex: supplementary links in an article, etc. This is accomplished with target="_blank". This is fine but it must be combined with rel-noopener.

On it's own,target="_blank"can expose your site to performance and most notably security issues (which Max alludes to). This is because the linked page can access your window object via the window.opener property. As a result, it becomes possible to redirect the user to a malicious URL.

Adding rel="noopener" (or even rel="noreferrer") to your target="_blank" external links is a way around this. So you'd have:

<a href="https://examplepetstore.com" target="_blank" rel="noopener">
  Example Pet Store
</a>

Even if you control the external site, it's still an external site. It could get hacked without your knowledge and something malicious could sit there wreaking havoc before you realize it. In my experience it's always best to treat the idea of getting compromised as a when, not an if.