rel=noopener: external target=_blank links and tabnabbing
An external link with target=_blank and an explicit rel=opener gives the opened page a handle on yours. squirrel lists every one, per page.
What rel=“noopener” is
rel="noopener" on a link tells the browser not to give the newly opened document a window.opener reference back to the page that opened it. Without it (and with an explicit rel="opener"), the destination can call window.opener.location = "..." and silently replace the tab the user came from with a copy of your login page. That attack is called tabnabbing.
rel="noreferrer" is the privacy half: it stops the Referer header and window.opener both, so the destination never learns which page sent the user. Browsers have applied noopener implicitly to target="_blank" since 2021, and noreferrer implies noopener, so a plain target="_blank" link is already isolated. noreferrer as a referrer control has no such default.
What squirrel checks
The rule runs on every crawled page over every a[href][target="_blank"] whose resolved hostname differs from the page hostname, and emits up to three checks:
noopenerwarns when at least one such link setsrel="opener"withoutnoopenerornoreferrer. Links with norel, withnoopener, or withnoreferrerare isolated and do not warn. Each href is listed. It passes instead when no external_blanklink exposeswindow.opener.noreferrerreports info when a link does not carry thenoreferrertoken. This is a privacy note about theRefererheader, not a security finding, and does not imply compromise. The pass message is4 external _blank link(s) have noreferrer.new-tab-securityreports info when the page has no external_blanklinks at all. Message:No external target="_blank" links found.
The rel value is read as a case-insensitive, whitespace-separated token list (so noopenerx is not noopener), and hrefs that do not parse as URLs are skipped. Severity for the rule is warning.
How to fix it
<a href="https://example.org/docs" target="_blank" rel="noopener noreferrer">Docs</a>Remove any rel="opener" from external links, or add noopener next to it. Adding noopener noreferrer explicitly is still harmless and keeps older browsers covered. Do it in the template or the component that renders external links, not link by link.
Dropping noreferrer is a legitimate choice when an affiliate or partner needs the referrer for attribution. Keep noopener in that case.
| Rule ID | security/new-tab |
| Category | Security |
| Scope | Per-page |
| Severity | warning |
| Weight | 4/10 |
Enable / disable
Disable this rule
[rules]
disable = ["security/new-tab"]Disable all Security rules
[rules]
disable = ["security/*"]Enable only this rule
[rules]
enable = ["security/new-tab"]enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.
Related rules
- security/referrer-policy: the site-wide version of what
noreferrerdoes per link. - links/external-links: how many external links a page carries and where they go.
- links/broken-external-links: whether those destinations still resolve.
- integrity/known-malicious-url: outbound links to hosts that should not be there at all.
Security findings ship in every audit next to the SEO, performance and agent experience rules. See Website security scan with AI for how an agent works through a report.
References
Check your site
Run squirrel audit https://example.com and open the Security section of the report. Every external new-tab link missing the attribute is listed by page. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.