Link and Embed Security

HTML attributes control how much your pages trust — and reveal to — other sites.

Links that open new windows

A page opened with target="_blank" used to get window.opener, a reference to your page, which let it redirect your tab to a phishing page (reverse tabnabbing).

<a href="https://partner.example" target="_blank" rel="noopener noreferrer">Partner site (new tab)</a>

• noopener — no window.opener. Current browsers treat target="_blank" as noopener automatically, but explicitly writing it protects older browsers.
• noreferrer — also sends no Referer header (and implies noopener).

Referrer policy

By default, browsers send only your origin (not the full path and query) to other sites (strict-origin-when-cross-origin). You can tighten it per link, per element, or for the whole page:

<meta name="referrer" content="no-referrer">

<a href="https://example.com" referrerpolicy="no-referrer">No referrer</a>
<img src="https://images.example/cat.jpg" alt="A cat" width="400" height="300" referrerpolicy="no-referrer">

Private URLs (password-reset links, search queries, IDs) should never leak to third parties.

Subresource Integrity

When you load a script or stylesheet from a CDN, a compromised CDN could serve malicious code. Subresource Integrity pins the exact file by hash:

<script src="https://cdn.example/lib@1.2.3/lib.min.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
        crossorigin="anonymous"></script>

If the file's hash doesn't match, the browser refuses to run it. The file must be served with CORS headers, hence crossorigin. Generate the value with openssl dgst -sha384 -binary lib.min.js | openssl base64 -A or our Hash Generator (base64 of the raw digest, prefixed with the algorithm). The hash above is only an example.

crossorigin

crossorigin (anonymous or use-credentials) makes the browser fetch a resource in CORS mode. You need it for SRI, fonts, reading pixels of a cross-origin image in a canvas, and full error details from cross-origin scripts.

User-generated links

<a href="https://commenter.example" rel="ugc nofollow noopener" target="_blank">commenter.example</a>

Also validate URLs from users on the server: allow only http: and https:. A link like href="javascript:..." runs code when clicked.

Forms that submit elsewhere

Only put forms that post to your own server on your pages, over HTTPS. A form's action on an http:// URL sends data unencrypted, and browsers warn before submitting it.

Embeds recap

• sandbox on untrusted iframes, with the fewest permissions possible.
• allow to grant only the features an embed needs.
• frame-ancestors (a CSP directive, sent as an HTTP header) to stop others from framing your pages.