Add rel="noopener" to links that open in a new tab

The rel="noopener" attribute on links opening in a new tab addresses a genuine, specific vulnerability sometimes called tabnabbing, where a page you link to and that opens in a new tab can, without this protection, gain a degree of access to and control over your original page through a JavaScript reference — a technical relationship browsers establish by default for target="_blank" links.

The specific risk this creates is genuinely exploitable — a malicious destination page could use this default access to your original page to redirect it to a phishing page mimicking your original site, potentially deceiving a visitor who glances back at their original tab and, seeing what appears to be your legitimate site (now actually a phishing page), enters credentials or other sensitive information.

The noopener attribute explicitly severs this default connection, ensuring the newly opened page has no ability to access or manipulate your original tab regardless of what that destination page's content or intentions might be — this protects your visitors even when linking to genuinely untrusted or unknown external destinations.

This represents a genuinely simple, low-effort fix — adding this single attribute to your relevant links closes off this specific vulnerability with no functional downside, making this exactly the kind of straightforward security improvement worth applying comprehensively across every instance of new-tab-opening links throughout your site.