viewer: add noreferrer to every target=_blank anchor

21a690a307ecd2783940284b62835ab74fe125ed · 2026-05-19 18:33:22 -0700 · SteveStudio2

Files touched

M public/index.html

Diff

commit 21a690a307ecd2783940284b62835ab74fe125ed
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 18:33:22 2026 -0700

    viewer: add noreferrer to every target=_blank anchor
---
 public/index.html | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/public/index.html b/public/index.html
index 7acdb01..08d199a 100644
--- a/public/index.html
+++ b/public/index.html
@@ -251,7 +251,7 @@ function shotFail(img, domain, h){
 function frameHTML(domain){
   const r = embedResults[domain];
   const open = '<div class="frame-link"><a href="https://'+domain
-    +'" target="_blank" rel="noopener">open https://'+domain+' ↗</a></div>';
+    +'" target="_blank" rel="noopener noreferrer">open https://'+domain+' ↗</a></div>';
   if (r && r.embeddable){
     return '<iframe src="https://'+domain
       +'" loading="lazy" referrerpolicy="no-referrer"></iframe>'+open;
@@ -315,7 +315,7 @@ function drawGrid(){
       + '<img class="shot" src="/api/shot?domain='+encodeURIComponent(d.domain)
       + '" loading="lazy" onerror="shotFail(this,\''+d.domain+'\',230)">'
       + '<div class="meta"><div class="dn"><a href="https://'+d.domain
-      + '" target="_blank" rel="noopener">'+d.domain+'</a></div>'
+      + '" target="_blank" rel="noopener noreferrer">'+d.domain+'</a></div>'
       + '<div class="st">'+deliv+' '+iss+'</div></div></div>';
   }).join('') || '<div class="muted">no domains match</div>';
 }
@@ -326,7 +326,7 @@ function drawTable(){
   $('#domains tbody').innerHTML = rows.map(d=>{
     const deliv = d.deliverable ? pill('ok','yes') : pill('bad','no');
     const safe = d.domain.replace(/[^a-z0-9]/gi,'-');
-    const link = '<a href="https://'+d.domain+'" target="_blank" rel="noopener" '
+    const link = '<a href="https://'+d.domain+'" target="_blank" rel="noopener noreferrer" '
       + 'onclick="event.stopPropagation()">'+d.domain+'</a>';
     return '<tr class="drow" onclick="toggleRow(\''+safe+'\',\''+d.domain+'\')">'
       + '<td><span class="caret" id="caret-'+safe+'">▸</span> '+link+'</td>'
@@ -362,7 +362,7 @@ function pickHeroDomains(n){
   return out;
 }
 function heroCard(domain){
-  return '<a href="https://'+domain+'" target="_blank" rel="noopener">'
+  return '<a href="https://'+domain+'" target="_blank" rel="noopener noreferrer">'
     + '<img src="/api/shot?domain='+encodeURIComponent(domain)
     + '" loading="lazy" onerror="shotFail(this,\''+domain+'\','+(heroMode==='1up'?460:225)+')">'
     + '<span class="hero-cap">'+domain+'</span></a>';

← 336eef0 server: 404 bak/pre/orig/rej/swp/tilde paths before static l · back to Purelymail Fleet Viewer · Add per-site favicon (kills /favicon.ico 404) 4b8c997 →