External links have rel attributes

external_links_rel

Checks that external links have proper rel attributes.

What does this rule check?

External links should include rel="noopener noreferrer" for security when using target="_blank", and optionally rel="nofollow" for user-generated or untrusted content.

Why is this important?

Missing rel="noopener" on target="_blank" links creates a security vulnerability (reverse tabnapping). Missing rel attributes also affects how search engines handle link equity.

How to fix

Add rel="noopener noreferrer" to all external links that open in new tabs.

Examples

<a href="https://external.com" target="_blank">Link</a>
<!-- Missing rel - security vulnerability! -->

<a href="https://external.com" target="_blank" rel="noopener noreferrer">Link</a>

Agent fix snippet

Copy this snippet and paste it into your AI coding agent to fix this issue automatically.

Add rel attributes to external links:

<a href="https://external.com" target="_blank" rel="noopener noreferrer">Link</a>

For untrusted links, also add "nofollow".