What is noreferrer?
When someone clicks a link, the browser normally tells the destination where they came from, in a header called the referrer (misspelled as Referer in the original web specification, and the spelling stuck). That is how a site's analytics know a visitor arrived from a newsletter, a search engine or a particular article. Adding rel="noreferrer" to a link withholds that information: the destination sees the visit, but not its source.
It also does everything noopener does. A link marked noreferrer opens without any connection back to the original tab, which is why for years content systems added the two values together to every link that opened in a new window, and why sites built in that period often still carry both on every external link.
Why it matters
Why noreferrer matters
Referrer information is useful, and sometimes revealing. A page address can contain things that should not travel: a search term, an account path, a private document's link, a token in a query string. Noreferrer keeps that information on the original site. The trade-off is measurement. Every link marked noreferrer arrives at the other end as direct traffic, with no credit to the page that sent it, which matters to partners, affiliates and anyone who relies on knowing what is working. Used everywhere, it protects little and blinds a lot of analytics, including, in time, your own understanding of which partnerships pay off.
In practice
How noreferrer works in practice
- 01
We use it selectively. Links out of private or sensitive areas, such as account pages, internal tools, review links shared with a client or anything with personal data in the address, get noreferrer, so the destination learns nothing about where the visitor was. Ordinary editorial links to other sites, partners and press usually do not, because sending referral credit is part of being a good citizen of the web, and partners want to see what we sent them.
- 02
For site-wide control there is a better tool than tagging every link: the Referrer-Policy header. It tells the browser how much to share for every link on the site, from the full address to the domain alone to nothing at all. Modern browsers already default to sharing only the domain when a visitor moves to another site, so the full path of a page stays private unless a site chooses otherwise. Noreferrer is then the exception, for individual links that need complete silence.
Watch out
What people get wrong about noreferrer
Thinking it is an SEO setting. It has no effect on how search engines follow or value a link; that is the job of nofollow and sponsored. Second, leaving it on affiliate and partner links, which can stop the partner recording the referral and, in some programs, the commission. Third, wondering why referral traffic in analytics has shrunk, when a plugin or theme has been adding noreferrer to every external link for years. And using it as a privacy policy, when a Referrer-Policy header does the same job for the whole site in one line.
