Link Target Checker
Scan HTML snippets for target="_blank" links missing crucial rel="noopener" security attributes.
Link Target Checker
Instantly scan HTML for vulnerable target="_blank" links.
The `target="_blank"` Vulnerability
When you link to another website using target="_blank" to open it in a new tab, you are inadvertently granting that new page partial access to your original page.
Specifically, the new page can access the window.opener object. A malicious site could use this to redirect your original page to a phishing site (a "reverse tabnabbing" attack) or to degrade the performance of your original page since they may run on the same thread.
The Solution
Always add rel="noopener" or rel="noreferrer" to any external links that open in a new tab:
- noopener: Prevents the new page from accessing the
window.openerobject. (Supported in all modern browsers). - noreferrer: Also prevents the new page from accessing the
window.openerobject, but additionally prevents the browser from sending theRefererHTTP header to the new site (hiding where the traffic came from).
Note: Modern browsers (Chrome 88+, Safari 12.1+, Firefox 79+) now implicitly set rel="noopener" on links with target="_blank" by default. However, it is still a best practice to include it explicitly for backward compatibility and to enforce strict security standards in your HTML.
Related Guides
Deepen your understanding with our expert articles.
