What's the actual difference between nofollow and noopener/noreferrer?

They solve unrelated problems that happen to both live in the rel attribute. rel="nofollow" is an SEO/trust signal telling search engines not to pass ranking authority ("link juice") to the destination, relevant for links you don't want to vouch for, like user-submitted content or paid placements. rel="noopener" (and its stronger cousin, rel="noreferrer") is a security measure that prevents a page opened via target="_blank" from getting a JavaScript reference back to the page that opened it. A link can need one, both, or neither depending on context.

What actually happens without rel="noopener" on a target="_blank" link?

The newly opened page receives a window.opener reference back to your page, running in the same process. A malicious destination page can use that reference to navigate your original tab to a phishing page, a technique called tab-nabbing, entirely without your visitor noticing since the tab they're already looking at just silently changes. Modern Chromium and Firefox versions apply noopener behavior automatically to target="_blank" links even without the attribute, but not every browser and not every link type is covered, so setting it explicitly is still the recommended practice, not a redundant one.

Should every external link get rel="nofollow"?

No, and doing so indiscriminately can hurt rather than help. Nofollow makes sense for links you don't editorially vouch for (ads, sponsored content, user comments) or don't want to spend crawl budget/authority on. For a link to a source you're citing or genuinely recommending, passing authority is often exactly what you want; blanket-nofollowing every outbound link is a common overcorrection this tool doesn't recommend by default.

Why group results by domain instead of just listing every link?

A page with many external links to the same domain (e.g. multiple links into the same documentation site or the same social profile) is a very different pattern from the same number of links spread across many distinct domains, and grouping surfaces that at a glance. It also makes it faster to spot whether a specific concerning domain shows up repeatedly across a page.

External Link Checker - Audit Outbound Links & rel Attributes

Overview

Introduction

External links carry two kinds of risk that have nothing to do with whether the link actually works: an SEO risk (passing ranking authority to sites you didn't mean to endorse) and a security risk (a target="_blank" link letting the destination page manipulate the tab it was opened from). Neither shows up from just reading a page visually.

This tool audits both at once: paste or fetch a page's HTML and its URL, and get every external link grouped by destination domain with its rel and target attributes checked against both concerns.

What Is External Link Checker?

A link-structure auditor that parses <a href> elements with the browser's own DOMParser, resolves each against the page's own URL, and keeps only the ones whose resolved origin differs from the page's origin, i.e. external links.

Each external link is grouped by destination hostname and checked for rel="nofollow" (SEO), and for the security-relevant combination of target="_blank" without rel="noopener" or rel="noreferrer" (tab-nabbing risk).

How External Link Checker Works

HTML is parsed to collect every <a href>, its rel and target attributes, and its anchor text. mailto:, tel:, javascript:, and bare-fragment (#) links are skipped since they don't point off-site.

Each remaining href is resolved against the page's own URL; links whose resolved origin differs from the page's are classified as external, grouped by hostname, and evaluated against the nofollow and noopener/noreferrer rules independently, since a link can fail either, both, or neither.

When To Use External Link Checker

Auditing a page with a lot of user-generated or externally sourced content (comments, guest posts, embeds) for missing nofollow before it's indexed.

Reviewing any page that opens external links in a new tab, to confirm none of them are vulnerable to tab-nabbing via a missing rel="noopener".

Checking which external domains a page links to most, and how, before a broader link-quality or affiliate-disclosure review.

Often used alongside Broken Link Checker, Internal Link Checker and Anchor Text Analyzer.

Features

Advantages

Checks a genuinely distinct SEO concern and a genuinely distinct security concern in one pass, instead of conflating them under a single "add rel here" recommendation.
Groups results by domain, making concentration patterns (many links to one external domain) visible at a glance rather than buried in a flat list.
Runs entirely client-side against pasted or fetched HTML; no crawler, backend, or third-party link-analysis service required.

Limitations

This is a static-HTML snapshot, not a JS-rendered-DOM crawl; links injected by client-side JavaScript after the page's initial HTML loads won't appear unless the pasted or fetched HTML already includes them.
It flags missing rel attributes; it doesn't (and can't) judge whether nofollow is the right call for a given link, since that depends on editorial intent this tool has no way to know.
Modern browsers apply implicit noopener behavior to target="_blank" links by default, so the practical risk of a flagged link varies by which browser a visitor uses; the flag reflects the attribute being explicitly missing, not a confirmed live exploit.

Examples

A tab-nabbing risk

Input

<a href="https://partner.example" target="_blank">Partner site</a>

Output

Domain: partner.example - target="_blank" with no rel="noopener" or rel="noreferrer" - flagged: tab-nabbing risk

Opening in a new tab without noopener/noreferrer lets the destination page access window.opener back to the original page.

Best Practices & Notes

Best Practices

Add rel="noopener" (or rel="noreferrer", which also strips the Referer header) to every target="_blank" link by default, regardless of how much you trust the destination; it costs nothing and closes a real attack surface.
Reserve rel="nofollow" for links you deliberately don't want to vouch for or spend authority on, not as a blanket default for every external link on the page.
Re-run this check after adding any embed, widget, or third-party script that injects its own links, since those often ship without either attribute set correctly.

Developer Notes

rel tokens are split on whitespace and lowercased before matching, so multi-value attributes like rel="noopener nofollow" are parsed correctly and a link can be flagged (or cleared) on both the nofollow and noopener/noreferrer checks independently in the same pass.

External Link Checker Use Cases

Confirming every sponsored or affiliate link on a page carries rel="nofollow" (or rel="sponsored") before publishing
Security-reviewing a page's new-tab links for missing rel="noopener" before shipping a redesign
Surveying which external domains a content-heavy page links to most, as input to a link-quality or partnership review

Common Mistakes

Adding rel="noopener" only to links that feel risky, rather than as a blanket default on every target="_blank" link, leaving inconsistent coverage across the page.
Confusing rel="nofollow" with a security control; it has no effect on tab-nabbing risk, which is governed entirely by rel="noopener"/rel="noreferrer".

Tips

If one domain dominates a page's external links, double check whether that's an intentional partnership/citation pattern or an accidental side effect of an embedded widget linking back to itself repeatedly.

External Link Checker