What Is rel=”noopener” in WordPress? (Explained)

A few years ago, we noticed something strange happening on one of our clients’ WordPress sites. Their visitors were getting redirected to suspicious websites whenever they clicked on external links. That’s when we discovered the importance of the rel="noopener" attribute.

Security in WordPress isn’t just about strong passwords and regular updates. It’s also about understanding technical elements that might seem minor but can have major impacts on your website’s safety. The rel=”noopener” attribute is one of those essential elements.

After helping hundreds of website owners secure their sites, we’ve put together this guide to explain everything you need to know about rel="noopener" in easy-to-understand terms.

What Is rel=”noopener” in WordPress?

When you add links to your WordPress website, you can use HTML attributes to control what happens when you click the link.

For example, when you create a link, there is a toggle switch that allows you to open it in a new tab.

The HTML code generated by WordPress for this link looks like this:

<a href="http://example.com" target="_blank" rel="noreferrer noopener">external link</a>

Hosted with ❤️ by WPCode

1-click Use in WordPress

Notice that some HTML attributes have been added to the link: rel="noopener" and rel="noreferrer". These attributes are added to address a security vulnerability.

When you use target="_blank" to make a link open in a new tab, there’s something potentially unexpected that happens behind the scenes by default. The new tab actually gets a kind of connection back to the original tab you were just on.

This connection is made through something in web browsers called window.opener. The page in the new tab can access and even control certain properties of the original tab, like changing the page’s address (window.opener.location).

This creates a security vulnerability.

Imagine you click a link on a trusted website, and it opens a malicious page in a new tab. Because of this window.opener connection, that malicious page could potentially change the original trusted page you were just viewing into a fake login page (a phishing scam), tricking you when you switch back to the original tab.

The noopener link attribute is designed to prevent this specific security risk.

When you add rel="noopener" to a link that opens in a new tab, you tell the browser not to create that window.opener connection between the two tabs. This protects your users from scams and phishing attempts.

How Does rel=”noopener” Affect Your WordPress SEO?

It doesn’t.

Even though the rel="noopener" attribute improves your WordPress site’s security, some users avoid using it because they think it will impact their WordPress SEO.

But that’s just a myth.

It has no impact on your site’s SEO rankings or your overall WordPress performance.

What’s the Difference Between “noopener” and “nofollow”?

It’s easy to confuse rel="noopener" with rel="nofollow". However, they are completely separate attributes.

The noopener attribute prevents your website from cross-site hacking and improves WordPress security.

On the other hand, the nofollow attribute prevents your website from passing on SEO link juice to the linked website.

Search engines look for and consider the nofollow attribute when following a link on your website. However, they do not give any consideration to the noopener tag.

By default, WordPress does not allow you to add nofollow to your external links. If you want to add nofollow in WordPress, then you will need to use a plugin.

To learn more, see our article on how to add title and nofollow to links in WordPress.

Does rel=”noreferrer” Affect Affiliate Links in WordPress?

The rel="noreferrer" does not affect affiliate links in WordPress. Some users believe that it does because rel="noreferrer" prevents the referrer information from passing to the new tab.

However, most affiliate programs provide you with a unique URL that has your affiliate ID. This means your affiliate ID is passed along as a URL parameter for the other website to track.

Secondly, most affiliate marketers use a link-cloaking plugin for their affiliate links.

With link cloaking, the affiliate link that your users click on is actually your website’s own URL, which then redirects users to the destination URL.

How Do You Disable rel=”noopener” in WordPress?

There is no need to remove rel="noopener" from links on your website. It is good for your website’s security and has no performance or SEO impact on your website.

However, if you must remove it, then you will have to disable the Gutenberg block editor in WordPress and use the classic editor.

That’s because if you remove rel="noopener" from the link manually, the block editor will automatically add it back in to keep your website safe.

Once the block editor is disabled, you will need to add a code snippet to your theme’s functions.php file or to the WPCode plugin (recommended). You can learn how to use the WPCode Free Plugin in our guide on how to easily add custom code in WordPress.

Simply copy the following code into a new PHP snippet:

add_filter('tiny_mce_before_init','wpb_disable_noopener');
function wpb_disable_noopener( $mceInit ) {
 $mceInit['allow_unsafe_link_target']=true;
 return $mceInit;
}

Hosted with ❤️ by WPCode

1-click Use in WordPress

Make sure you turn the ‘Active’ toggle on and then click the ‘Save Snippet’ button.

This will stop WordPress from adding rel="noopener" to new links. You will also need to manually edit any old links to remove the attribute.

Want even more control over which rel attributes get added to your links in WordPress? We recommend using the AIOSEO plugin because it lets you add title, nofollow, and other link attributes right inside the WordPress editor.