noopener on 27 homepages: 145 links repeat what the browser already does

FIELD TEST · 2026-09-02 · 27 homepages · one request each · rel values on target="_blank" links

Sample and method: 30 homepages fetched once each on 2026-09-02 with a desktop Chrome user agent, redirects followed, no JavaScript executed. Three dropped out — stackoverflow.com and medium.com returned 403, www.reddit.com returned an 8,393-byte shell — leaving 27. We pulled every <a> opening tag from the delivered HTML and kept the ones with target="_blank".

The 27 homepages carry 4,950 links, 423 of them opening in a new tab, and 265 of those point to another site. On those 265 off-site links, noopener appears 145 times — a token that modern browsers already apply on their own. noreferrer appears 119 times, and that one is doing something: it deletes the referrer, so the site being linked to records the visit as direct traffic.

How we measured it

One GET per site, desktop Chrome user agent rather than Googlebot, redirects followed. Counting was a regular expression over <a> opening tags rather than a full parse: keep the tags matching target="_blank", read the href, and compare its host against the site's own domain. Same-host links were set aside — this survey is about links that leave.

# The same count on one of your own pages
curl -sL --compressed -A 'Mozilla/5.0' https://example.com/ > page.html
grep -oiE '<a [^>]*target=.?_blank[^>]*>' page.html | wc -l
grep -oiE '<a [^>]*target=.?_blank[^>]*>' page.html | grep -ci 'noreferrer'

Three limits. Links inserted by script after load are invisible here, so a page that builds its footer at runtime counts low. A subdomain on the same registrable domain was treated as the same site, which is a judgement call and it moves a handful of links. And we opened none of these links and looked at nobody's analytics — the traffic consequence below is what the markup implies, not something we watched happen.

What noopener buys on a target="_blank" link

Nothing that the browser was not going to do anyway. MDN states it directly: "Setting target="_blank" on <a>, <area> and <form> elements implicitly provides the same rel behavior as setting rel="noopener" which does not set window.opener." (rel=noopener, read 2026-09-02.)

So 145 of the 265 off-site links in this sample restate a default. That is not a mistake and it costs nine bytes. It is worth knowing about only because the token sits next to one that is not a default at all.

Counted as tokens rather than links: noopener 145, noreferrer 119, nofollow 16, sponsored 14. Two of those four change what a machine does with the link. The most common one does not.

119 of 265 outbound links delete the referrer

That is 44.9% of the off-site links on this panel. noreferrer suppresses the Referer header on the request, so the destination site receives a visit with no origin attached. In an analytics tool that visit lands wherever unattributed sessions land, which for most setups is the direct bucket.

The habit is not spread evenly. Six of the 20 sites with any off-site new-tab links put noreferrer on every single one: linear.app, www.figma.com, railway.com, www.netlify.com, www.theverge.com and github.com. Nine sites put it on none, including developer.mozilla.org, techcrunch.com, slack.com and www.wired.com.

react.dev is the clearest case. Of its 64 off-site new-tab links, 48 carry noreferrer alone and one carries both — 49 links whose destinations will never see react.dev in their referral report. Nobody decided that per link. A component decided it once.

Every outbound link is a small gift of attribution. noreferrer keeps the gift and sends the visitor anyway.

45 links carry no rel at all, and 28 come from one site

Forty-five of the 265 have no rel attribute whatsoever. www.framer.com accounts for 28 of them — all 28 of its off-site new-tab links — with about.gitlab.com contributing 4, webflow.com 4, supabase.com 2, and four sites one each.

Under current browser behaviour these 45 are as safe as the ones marked noopener, which is the point of the MDN sentence above. They also pass the referrer along, so their destinations can see where the visit came from. Judged by attribution rather than by security, the bare links are the generous ones.

The 17 links with a rel but neither token are mostly commercial markup: 16 nofollow and 14 sponsored across the batch, concentrated on astro.build. Those change how a search crawler treats the link, and they are the subject of a different measurement — nofollow links on 30 homepages covers that side.

What this means for your site

Three decisions, and only the second one has consequences.

1. Adding noopener to a target="_blank" link changes nothing in a current browser. Keep it if your linter wants it. Do not go add it to 300 links.
2. Decide noreferrer deliberately, per kind of link. Sending a partner, a customer or a documentation source into your traffic as an anonymous visit is a choice, and on this panel it is a choice 119 links made without anyone noticing.
3. Check what your own site sends before you audit anyone else's. The two commands above take a minute and the answer usually comes from a component, not from a policy.

The receiving end of this is a familiar complaint: real referral visits arriving with no source. Where those sessions go and how to pull them apart is in AI traffic showing as direct in GA4, and the header-level version of the same control is measured in referrer-policy across 27 homepages. To see what a fetch of your own pages returns, links and all, see how QueryWin reads a page.

Common questions

How did you measure this?

One GET per homepage on 2026-09-02, desktop Chrome user agent, redirects followed, bodies written to disk. A regular expression pulled every <a> opening tag, kept the ones with target="_blank", read each href, and classified it as off-site when the host did not contain the site's own registrable domain. No JavaScript ran. Exit node in Osaka, Japan.

Do I still need rel="noopener"?

Not for target="_blank" in a current browser, which applies the same behaviour implicitly. It still matters for window.open() calls and for very old clients, neither of which this survey looked at.

Does noreferrer affect SEO?

It is not a crawl directive and this data set contains no ranking information of any kind. What it removes is the Referer header on a human click, which is an analytics effect on the destination site rather than a search effect on yours.

How much traffic does this actually move?

We do not know. Measuring it would need access to the receiving sites' analytics, which we do not have, so 119 links is a count of markup and not an estimate of sessions.

Why separate off-site links from same-site ones?

Because noreferrer on a same-host link removes information you were about to send yourself. The 158 same-site new-tab links in this batch raise a different question, and mixing them in would have made 423 look like 265.