Info target="_blank" without rel="noopener"
Why links that open in a new tab should include rel="noopener", and the reverse-tabnabbing risk it prevents.
The validator flags any <a target="_blank"> whose rel attribute doesn't include noopener.
Example
<!-- Missing noopener -->
<a href="https://example.com" target="_blank">External link</a>
<!-- Safer -->
<a href="https://example.com" target="_blank" rel="noopener">External link</a>Why it matters
By default, a page opened via target="_blank" gets a live JavaScript reference back to the page that opened it (window.opener). A malicious destination page can use that reference to redirect the original tab to a phishing page — an attack known as reverse tabnabbing — while the new tab keeps showing seemingly legitimate content, so the user doesn't notice the original tab changed. rel="noopener" severs that reference. All modern browsers now apply noopener-like behavior to target="_blank" links automatically, which is why this is flagged as informational rather than an error — but adding it explicitly is still recommended for older browsers and for clarity.
Frequently asked questions
Do I need rel="noopener" for links to my own site?
It's unnecessary for links you control, since you're not at risk from your own pages. It matters for links to third-party or user-submitted URLs, where you can't vouch for the destination.
What's the difference between noopener and noreferrer?
noopener blocks the window.opener reference (the tabnabbing vector). noreferrer does that too, and additionally strips the Referer header sent to the destination site, so it won't know which page linked to it. Use noreferrer when you also want to withhold referrer information.