Challenge we solve
How we solve Missing Rel Noopener on External Links
In our experience, missing rel="noopener" on external links means anchor tags using target="_blank" don't include the noopener attribute, leaving the newly opened tab with a window.opener reference back to the originating page. This happens simply because developers add target="_blank" for external links without the accompanying security attribute. The resulting risk is a reverse tabnabbing vulnerability, where the opened page can use window.opener.location to redirect the original tab to a malicious or phishing page while the user isn't looking.
How we solve Missing Rel Noopener on External Links
In our experience, missing rel="noopener" on external links means anchor tags using target="_blank" don't include the noopener attribute, leaving the newly opened tab with a window.opener reference back to the originating page. This happens simply because developers add target="_blank" for external links without the accompanying security attribute. The resulting risk is a reverse tabnabbing vulnerability, where the opened page can use window.opener.location to redirect the original tab to a malicious or phishing page while the user isn't looking.
Why this happens (and how we fix it)
In our experience, developers add target="_blank" to open external links in a new tab as a routine, almost reflexive choice, but the accompanying rel="noopener" attribute is a separate, easy to forget addition that doesn't affect whether the link visibly works, so it's skipped unless a team has a defined security checklist enforcing it on every outbound link. Copy pasted link markup from older tutorials or component libraries perpetuates the gap further, since the missing attribute gets duplicated across every new link built from that same template.
What it costs you while it goes unfixed
In our experience, without noopener, the newly opened external page retains a live window.opener reference back to the original tab, which enables a reverse tabnabbing attack, the destination page can silently redirect the user's original tab to a phishing or malicious look alike page while their attention is on the new tab. A visitor could return to what looks like the same site they were just on and instead be looking at a credential harvesting clone, with no indication anything changed.
How we resolve it
01 Diagnose
We audit your current setup and identify the root cause.
02 Fix
We implement targeted corrections using proven methods.
03 Verify
We confirm the issue is resolved and monitor for recurrence.
Ready to grow your business with us?
Get a free audit from Arising Media. We identify what is holding your business back and show you exactly how to fix it.