Stop adding “noreferrer” to external links. by adamsilverstein · Pull Request #26968 · WordPress/gutenberg

adamsilverstein · 2020-11-13T16:59:48Z

Description

Removes the noreferrer value from the rel attribute on external links generated by the editor, admin UI, and block output. noopener is retained where needed to prevent reverse-tabnabbing on target="_blank" links.

Scope

The change touches two groups of links:

Admin-UI links (ExternalLink component, More Menus in editor/edit-widgets/customize-widgets, media-categories "view more" links, editor-only links in site-logo and categories): wp-admin sends Referrer-Policy: strict-origin-when-cross-origin via wp_admin_headers — which is also the modern browser default — so only the origin is sent, never full URLs or query strings. Removing noreferrer here does not leak sensitive admin paths.
Front-end post content (latest-posts, button, image block output; the link format in format-library/src/link/utils.js; the phrasing-content paste reducer; and the associated test fixtures): sharing the referrer is the expected web-platform default, and the site's own Referrer-Policy governs what is sent.

File block — excluded from this PR

Per @t-hamano's review, changes to the File block have been deferred to a separate follow-up PR #77345. The File block's save() function deterministically generates the rel attribute, so changing its output invalidates existing saved File blocks on reload. The follow-up will remove both noreferrer AND noopener in one pass, with a proper new deprecation to migrate existing content cleanly.

See discussion: #26914 (comment)

How has this been tested?

Unit tests and snapshots updated (npm run test:unit)
E2E tests for buttons, links, and pattern overrides pass against updated rel output

Types of changes

Bug fix / behavior change — removes noreferrer from editor-generated external links. One breaking change for @wordpress/components consumers: ExternalLink no longer adds noreferrer by default (documented in the components CHANGELOG).

Checklist:

My code is tested.
My code follows the WordPress code style.
My code follows the accessibility standards.
My code has proper inline documentation.
I've included developer documentation if appropriate.
I've updated all React Native files affected by any refactorings/renamings in this PR.

adamsilverstein · 2024-01-23T15:20:26Z

Looks like this dropped off my radar. I will try to revisit soon and land this. As far as I can tell, the only outstanding item (other than resolving merge conflicts) was adding a deprecation for the file block. Also, I will review the codebase to make sure more noreferrer links have been added in the meantime.

The deprecated save functions must match old saved content in the database (which has noreferrer noopener). Only the current save function should output noopener alone.

adamsilverstein · 2026-04-13T22:10:40Z

@Krinkle - thanks for reviewing. I have resolved merge conflicts, this should be ready to merge once CI is green.

…removal

jsnajdr

Looks good 👍 Given that we now have the global Referrer-Policy and that modern browsers send only origin by default, the original reasons why referrers were dangerous (leaking URL details) no longer hold, they've been solved at web platform level.

Similarly, modern browsers set noopener automatically for target="blank", so the second ubiquitous rel value can be removed, too. That will also completely remove a lot of the NEW_TAB_REL code.

t-hamano · 2026-04-14T09:49:36Z

-						rel={
-							textLinkTarget ? 'noreferrer noopener' : undefined
-						}
+						rel={ textLinkTarget ? 'noopener' : undefined }


This change may break blocks, so I think we'll need to add a new migration. Try the following steps:

Check out the trunk branch

Insert a File block

Attach a PDF file and enable "Open in new tab"

Save the post

Check out the remove/noreferrer branch

Reload your browser

The block is broken

Perhaps we can exclude the File block in this PR. To avoid adding multiple block migrations, it might be better to submit a separate PR specifically for the File block and then remove noreferer, noopener all at once.

We should do a migration. Then it makes sense to remove both noreferrer and noopener in one PR.

We did a similar migration in #43050, for a similarly "banal" change--changing the value of an aria-label attribute. The change doesn't need to be big and serious to warrant a migration script.

It would be great to land #73116, so we don't have to introduce deprecations for every minor change.

Perhaps we can exclude the File block in this PR.

Good idea @t-hamano - I am going to exclude the File block for now, and open a separate PR just for it.

We should do a migration.

I will include a migration in the new PR.

It would be great to land #73116, so we don't have to introduce deprecations for every minor change.

@Mamaduka so after that merges, we wouldn't need a migration at all?

removed changes to File block in 2f2f030

Follow up PR to update the File block, including migration: #77345

The File block's save function deterministically generates the rel attribute. Changing its output invalidates existing saved blocks on reload. Defer to a follow-up PR that removes both noreferrer and noopener together with a proper deprecation to handle migration cleanly.

# Conflicts: # packages/blocks/src/api/raw-handling/phrasing-content-reducer.ts # packages/components/CHANGELOG.md

@t-hamano

The File block's save function previously added rel="noreferrer noopener" to the text link when opened in a new tab. Modern browsers apply noopener implicitly for target="_blank" (Chrome 88+, Firefox 79+, Safari 12.1+), and noreferrer blocks legitimate referrer tracking without meaningful security benefit on supported browsers. Add a new v4 deprecation mirroring the current block schema but with the previous save output so existing saved blocks migrate cleanly on reload. Fixture added: core__file__new-window__deprecated-2 exercises the v4 migration path (input has rel="noreferrer noopener", output has no rel). Follow-up to WordPress#26968 per review feedback from @t-hamano.

Changes to the File block were excluded.

Resolve CHANGELOG conflict: preserve the ExternalLink breaking-change note in Unreleased and keep the 32.6.0 release section from trunk.

Remove “noreferrer”.

9839c5b

adamsilverstein mentioned this pull request Nov 13, 2020

Stop adding rel=noreferrer to links that open in a new tab #26914

Closed

talldan reviewed Nov 17, 2020

View reviewed changes

Comment thread packages/block-library/src/file/save.js Outdated

Comment thread packages/e2e-tests/fixtures/blocks/core__file__new-window.html Outdated

talldan added [Feature] Link Editing Link components (LinkControl, URLInput) and integrations (RichText link formatting) Backport to WP Beta/RC labels Nov 24, 2020

talldan modified the milestones: WordPress 5.x, 5.6 Nov 24, 2020

tellthemachines removed the Backport to WP Beta/RC label Nov 25, 2020

Base automatically changed from master to trunk March 1, 2021 15:44

skorasaurus mentioned this pull request Mar 9, 2021

"Open in new tab" relationship values are overwritten when user first enters a different relationship value #29690

Closed

adamsilverstein added 9 commits January 23, 2024 10:30

merge trunk, overwriting changes

f240688

reintroduce noreferrer removal

d7f9807

additional noreferrer removal

a6c69bb

file block test fixture noreferrer removal

3dcadcc

revert snapshot change

e88f166

remove fixture noreferrer references

d7ca6bc

remove noreferrer from slack test fixtures

7009b60

adjust test fixtures

fa8c4a8

update snapshots with npm run test:unit:update

b981beb

adamsilverstein marked this pull request as ready for review January 26, 2024 17:54

adamsilverstein requested review from Mamaduka, ajitbohra, dcalhoun, ellatrix, fluiddot, kevin940726 and noisysocks as code owners January 26, 2024 17:55

adamsilverstein requested review from jsnajdr and removed request for fabiankaegy March 26, 2026 16:14

adamsilverstein added 4 commits March 26, 2026 09:18

Restore noreferrer in deprecated file block save functions and fixtures

cb5698e

The deprecated save functions must match old saved content in the database (which has noreferrer noopener). Only the current save function should output noopener alone.

Merge trunk

b48574a

Merge remote-tracking branch 'origin/trunk' into remove/noreferrer

634c546

Merge remote-tracking branch 'origin/trunk' into remove/noreferrer

aa2e5e0

adamsilverstein requested a review from a team as a code owner April 13, 2026 22:08

adamsilverstein requested a review from talldan April 13, 2026 22:09

adamsilverstein added 2 commits April 13, 2026 16:11

Add CHANGELOG entry for ExternalLink noreferrer removal

2996e13

Fix lint errors: formatting and jsx-no-target-blank after noreferrer …

7f7f0b2

…removal

jsnajdr approved these changes Apr 14, 2026

View reviewed changes

t-hamano previously requested changes Apr 14, 2026

View reviewed changes

adamsilverstein added 2 commits April 14, 2026 11:42

Merge remote-tracking branch 'origin/trunk' into remove/noreferrer

2d52876

# Conflicts: # packages/blocks/src/api/raw-handling/phrasing-content-reducer.ts # packages/components/CHANGELOG.md

adamsilverstein mentioned this pull request Apr 14, 2026

File block: Remove rel attribute from text link; add migration #77345

Open

6 tasks

t-hamano approved these changes Apr 15, 2026

View reviewed changes

Merge remote-tracking branch 'origin/trunk' into remove/noreferrer

d4cf0e6

Resolve CHANGELOG conflict: preserve the ExternalLink breaking-change note in Unreleased and keep the 32.6.0 release section from trunk.

adamsilverstein merged commit f75a114 into WordPress:trunk Apr 15, 2026
40 checks passed

github-project-automation Bot moved this from PR needs review to Done in Increase Gutenberg Extensibility Apr 15, 2026

github-actions Bot added this to the Gutenberg 23.1 milestone Apr 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Stop adding “noreferrer” to external links.#26968

Stop adding “noreferrer” to external links.#26968
adamsilverstein merged 24 commits into
WordPress:trunkfrom
adamsilverstein:remove/noreferrer

adamsilverstein commented Nov 13, 2020 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

adamsilverstein commented Jan 23, 2024

Uh oh!

adamsilverstein commented Apr 13, 2026

Uh oh!

jsnajdr left a comment

Uh oh!

t-hamano Apr 14, 2026

Uh oh!

jsnajdr Apr 14, 2026

Uh oh!

Mamaduka Apr 14, 2026

Uh oh!

adamsilverstein Apr 14, 2026 •

edited

Loading

Uh oh!

adamsilverstein Apr 14, 2026

Uh oh!

adamsilverstein Apr 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

adamsilverstein commented Nov 13, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Scope

File block — excluded from this PR

How has this been tested?

Types of changes

Checklist:

Uh oh!

Uh oh!

Uh oh!

adamsilverstein commented Jan 23, 2024

Uh oh!

adamsilverstein commented Apr 13, 2026

Uh oh!

jsnajdr left a comment

Choose a reason for hiding this comment

Uh oh!

t-hamano Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

jsnajdr Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Mamaduka Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

adamsilverstein Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adamsilverstein Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

adamsilverstein Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

adamsilverstein commented Nov 13, 2020 •

edited

Loading

adamsilverstein Apr 14, 2026 •

edited

Loading