Direct answer: The 61 pages contain 637 anchors with an href and target="_blank", and 58 pages have at least one. Yet only 2 declare rel="noopener" and 1 declares noreferrer, all on the E24 homepage; the 295 new-window links on article pages have zero noopener.
485 point to external sites, and 483 of those external new-window links lack noopener (99.6%). Modern browsers already apply noopener to target="_blank" by default, so this is a declaration gap rather than an exploitable flaw; an explicit attribute still helps older browsers and consistency.
Method: read a-tag attributes from caches
The study reads 25 homepage caches (2026-10-31 to 11-01) and 36 article page caches (2026-11-03 08:40–08:41) with zero network requests. It counts anchors with an href and target=_blank, checks rel for noopener/noreferrer, and treats a link as external when its host differs from the page's final host (subdomains count as internal).
| Item | Rule | Boundary |
|---|---|---|
| New-window link | target equals _blank | Only anchors with href |
| noopener / noreferrer | rel string contains the word | Other rel combinations not judged |
| External | Absolute URL with a different host | Subdomains internal; www normalised |
| Page level | Whole document | Includes navigation, footer and share entries |
Result: 637 new windows, 2 noopener
| Measure | Count | Share of 637 |
|---|---|---|
| target=_blank | 637 | 100% |
| Of which external | 485 | 76.1% |
| Declare noopener | 2 | 0.3% |
| Declare noreferrer | 1 | 0.2% |
| Without noopener | 635 | 99.7% |
| External without noopener | 483 | 75.8% |
| Page type | Pages | blank | external blank | noopener |
|---|---|---|---|---|
| Homepage | 25 | 342 | 239 | 2 |
| Article | 36 | 295 | 246 | 0 |
| Total | 61 | 637 | 485 | 2 |
On article pages 83.4% of new-window links go external, yet none declares noopener; on homepages only E24 declares it for 2 links.
Concentrated on a few pages
| Page | blank | external |
|---|---|---|
| E27 homepage | 82 | 75 |
| E03 article | 65 | 65 |
| E03 homepage | 55 | 18 |
| E13 homepage | 36 | 34 |
| E29 homepage | 27 | 0 |
| E30 homepage | 19 | 3 |
E18, E20 and E25 have no links at all, so no new-window links; the other 58 pages do. E27 and E03 templates send many entries to a new window and are the first places to fix.
What this means for acceptance
- New windows are widespread. 58 of 61 pages have at least one target=_blank, 637 in total.
- Explicit noopener is almost absent. Only 2 of 637 declare it; browsers imply it, but older engines and consistency still call for the attribute.
- External links dominate. 485 new-window links go external and 483 lack noopener.
- Fix article templates separately. 295 new-window links and zero noopener mean the article template does not connect the attribute.
- Do not call it a vulnerability. The study records the declaration gap and does not test exploitation or browser behaviour.
Limits
- Declarations only: modern browsers imply noopener for target=_blank; no declaration does not mean exploitable.
- Only anchors with href: anchors without href or JS-opened windows are not counted.
- Host rule: string hosts and subdomain rules may treat lookalike domains as internal.
- Page level: navigation, footer and share entries are included; body links are not separated.
- 61 pages from 25 homepages and 36 articles on 10 sites, not 61 independent sites.
Data and reproduction
Anonymised data: equipment-blank-links-2026.csv (61 rows × 9 columns: blank, noopener, noreferrer, external blank, external without noopener, and blank without noopener). The repository keeps docs/research/2026-11-blank-links.csv.
Parser: scripts/blank_link_probe.py; unit tests: scripts/test_blank_link_probe.py (7 tests, no network). Run:
python -m unittest scripts.test_blank_link_probe
Related: the structured data coverage pilot, the article link structure pilot, and the homepage link structure pilot., and the article navigation pilot
Sources and definitions
- Homepage cache: 25 homepages from study 4 (2026-10-31 to 11-01).
- Article cache: 36 pages from 10 sites in study 45 (2026-11-03 08:40–08:41), five JS shells excluded.
- Counting: anchors with href and target=_blank; rel keyword matching.
- Scan: 2026-11-05, zero network requests.