Understanding the rel=noopener and rel=noreferrer attributes: security and SEO impact
When you insert a link on a website with the target=»_blank» attribute, WordPress automatically adds the rel=noopener and rel=noreferrer attributes. But what do these attributes really mean and why have they become a standard in web development?
Their main purpose is to improve user security and to protect sites against certain malicious attacks, notably reverse tabnabbing. At the same time, rel=noreferrer has an effect on link tracking and the transmission of referral data, which can have implications for SEO and netlinking.
Definition and how the attributes work
The rel=noopener and rel=noreferrer attributes are HTML tags added to external links that open in a new tab (target=»_blank»). Their main role is to strengthen user security and improve the confidentiality of the data transmitted between sites. Although they are often used together, these two attributes fulfil distinct functions.
What is the rel=noopener attribute?
The rel=noopener attribute was introduced to counter a vulnerability known as reverse tabnabbing. This flaw allowed a malicious web page to access the original window of the site that had generated the link. In concrete terms, when a user clicked on an external link opening a new tab, the target site could manipulate the window.opener JavaScript object and change the URL of the original page. An attacker could thus redirect the user to a fake page imitating the legitimate site, making it easier to carry out phishing attacks or run malicious scripts.
By adding rel=noopener, the value of window.opener is set to null, preventing any interaction between the original tab and the new window. This security measure protects visitors by blocking attempts to fraudulently modify the starting page. Since recent versions of certain browsers, such as Chrome and Firefox, this restriction has been applied implicitly to target=»_blank» links. However, since this safeguard is not universally adopted by all browsers, explicitly adding rel=noopener remains a recommended precaution to guarantee optimal protection.
What is the rel=noreferrer attribute?
The rel=noreferrer attribute goes beyond mere security and also plays a part in managing the information transmitted when an external link is clicked. When a user navigates from site A to site B via a standard link, site B can retrieve information about the origin of the traffic thanks to the “Referer” HTTP header. This allows the target site to identify where the visitor came from, which is particularly useful for web analytics tools and marketing campaign tracking.
However, some site owners prefer to hide this information for privacy reasons. With rel=noreferrer, the target site receives no data about the original page, which prevents any tracking of traffic sources via the “Referer” header. As a result, visits coming from these links appear as “direct traffic” in Google Analytics, making it impossible to accurately analyse the performance of a netlinking campaign.
WordPress often applies rel=noreferrer in addition to rel=noopener to strengthen user protection, but this practice can cause problems for SEO and link tracking. Some publishers choose to disable it in order to retain traceability of their backlinks while keeping the security provided by rel=noopener.
Impact on SEO and netlinking
Although the rel=noopener and rel=noreferrer attributes are primarily designed for security and privacy reasons, they also have repercussions on organic search and netlinking strategies. While rel=noopener has no direct impact on SEO, rel=noreferrer, on the other hand, can cause a problem by hiding the origin of the traffic from backlinks, which can complicate the analysis of external link performance.
Influence on organic search
In SEO, backlinks play an essential role in improving a website’s ranking in search engines. When a site receives a link from another domain, Google views this as a positive signal of credibility and relevance. However, the way search engines behave towards the various rel attributes can influence the transmission of this “link juice”. Unlike rel=nofollow or rel=sponsored, which tell Google not to attribute any SEO value to the link, rel=noreferrer does not block the transmission of authority from the source site to the target site. In other words, even if the origin of the traffic is not visible in Google Analytics, the link retains its SEO impact in terms of popularity and ranking in the search results.
However, for site owners and SEO experts, the absence of data on where visitors come from can complicate the evaluation of backlink performance. When a sponsored link or an SEO partnership is set up, it is essential to be able to measure the traffic generated in order to adjust campaigns accordingly. WordPress’s automatic application of rel=noreferrer limits this analysis, which can be an obstacle for netlinking strategies based on accurately measuring the return on investment of the links obtained.
Effects on netlinking strategies
Netlinking is a fundamental practice for SEO, consisting of obtaining quality external links pointing to a site in order to improve its authority and its ranking on Google. In this context, the traceability of backlinks is a key element in optimising a visibility strategy. When the rel=noreferrer attribute is applied, it becomes impossible for the site receiving the link to identify its origin, which prevents accurately measuring the impact of the backlinks and evaluating the best-performing sources.
For advertisers and publishers of sponsored links, this absence of data complicates the management of netlinking campaigns. An advertiser who invests in links must be able to make sure that the backlinks generate qualified traffic and contribute to improving their SEO. If rel=noreferrer is systematically added, it becomes more difficult to assess which partner sites truly bring value. This can lead some SEO players to look for alternative solutions to track their performance, such as adding UTM tags (tracking codes) to URLs or using advanced analytics tools that make it possible to indirectly detect the origin of visits.
So, although rel=noreferrer does not prevent the transmission of “SEO juice”, its impact on the visibility of referrers and on performance tracking poses a challenge for SEO and netlinking specialists. Some choose to remove it via WordPress plugins to preserve backlink tracking, while keeping rel=noopener to guarantee user security. The important thing, therefore, is to find a balance between protecting data and the need to effectively measure how well the netlinking strategies in place are working.
Checking and managing the attributes on a website
Since the rel=noopener and rel=noreferrer attributes are added automatically by WordPress to links using target=»_blank», it is essential for site owners and SEO specialists to know how to check them and, if necessary, edit them. Their management should be optimised according to security needs and SEO objectives, notably for netlinking and backlink traffic tracking.
How to check whether these attributes are present?
To make sure whether or not a link contains the rel=noopener and rel=noreferrer attributes, you can examine the page’s HTML code directly. Using the developer tools built into browsers, such as Google Chrome or Microsoft Edge, a simple right-click on the link in question followed by the “Inspect element” option gives you access to the source code and lets you check whether the rel attributes are present in the <a> tag.
For a faster and automated analysis, SEO tools and browser extensions make it easy to identify all the links that carry these attributes. These solutions are particularly useful for large-scale sites, where manual checking would be too tedious.
How to manage and edit these attributes?
Once the attributes have been spotted, it is possible to edit them according to your SEO and security objectives. As the rel=noopener attribute is an essential protection against reverse tabnabbing, it is strongly advised against removing it. On the other hand, rel=noreferrer can cause a problem for backlink tracking, because it prevents the site receiving the link from knowing its origin in analytics tools.
On WordPress, several solutions exist to manage these attributes. For manual control, you can edit the HTML code by removing rel=noreferrer from the <a> tags, but this method is cumbersome on a site with many external links. A more efficient alternative is to use WordPress plugins, such as “Remove Noreferrer” or “WP External Links”, which make it possible to automatically remove noreferrer while keeping noopener.
Another approach is to work around the absence of referral data without removing rel=noreferrer. Adding UTM parameters to the URLs of external links makes it possible to track the origin of the traffic in Google Analytics, even when noreferrer is enabled. This solution is particularly useful for netlinking campaigns, where the traceability of backlinks is essential to measure their effectiveness.
In conclusion, it is crucial to adopt a balanced strategy between security and SEO optimisation. Removing rel=noreferrer can improve backlink tracking, but you must make sure that this does not compromise the confidentiality you want on certain links. Smart management of these attributes thus makes it possible to protect users while optimising the analysis of SEO performance.
