Unsafe external links checker

What the unsafe external links checker does

This tool scans a webpage for external links and identifies those that open in a new browsing context, typically via target="_blank", without appropriate rel attributes. It reports links that may expose the page to security and performance risks.

When a link opens a new tab, the new page can access certain properties of the original window through the window.opener reference. Without protection, the destination page could potentially redirect the original tab to a different site. The rel="noopener" attribute prevents this access, and rel="noreferrer" additionally limits referrer information.

Why this matters

Opening untrusted external links in new tabs without noopener creates a known security risk. A malicious or compromised destination could use the opener reference to manipulate the original page, for example by redirecting it to a phishing site while the user is not looking. Modern browsers have mitigated some of this behavior by default, but explicit attributes remain a recommended practice.

There are performance implications as well. Links that share a browsing context can keep the original page alive and consume resources. Isolating the new page with noopener allows the browser to treat it independently.

How to interpret the result

The tool reports external links that open in a new tab without the relevant attributes. Check the flagged links in the source to confirm the finding. Links that open in the same tab do not have the same opener risk, so they are treated differently.

Not every external link needs a new tab. Consider whether opening a new tab is genuinely helpful for the user; often it is not. Where a new tab is appropriate, add rel="noopener", and consider noreferrer if you also want to limit referrer data. For user-generated content, applying these attributes consistently is especially important.

Common issues

• Missing rel attributes. target="_blank" used without noopener.
• Inconsistent handling. Some templates add the attributes while others do not.
• User-generated content. Comments and profiles linking out without protection.
• Overuse of new tabs. Every link opening in a new tab can annoy users.

Practical workflow

Review the flagged links and confirm which genuinely need a new tab. Add rel="noopener" where required, and extend it with noreferrer if appropriate. For CMS-driven content, configure the editor or sanitizer to apply these attributes automatically, then re-check after content updates.

Limitations

The checker reports link attributes present in the HTML response. It does not assess the trustworthiness of the destination sites and may not detect links modified by client-side scripts.