← back to Stars of Design
Add noreferrer to all rel=nofollow noopener external links
a7ac2a95c0d74b3e6fa8fd964367196a5ead1b95 · 2026-05-19 15:18:55 -0700 · Steve Abrams
External links across /clients, /clients/:slug, /firms, /firms/:slug,
and /feed previously used rel="nofollow noopener" — noreferrer was
missing, which leaks the originating profile URL in the Referer header
to third-party sites (LinkedIn, Instagram, firm websites) every time a
visitor clicks through. Spec-canonical pairing for target="_blank" is
"noopener noreferrer"; nofollow stays for SEO. All six view files
updated; videos.ejs and designer.ejs already had the full triple.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Files touched
M views/public/clients.ejsM views/public/dwclient.ejsM views/public/feed.ejsM views/public/firm.ejsM views/public/firms.ejs
Diff
commit a7ac2a95c0d74b3e6fa8fd964367196a5ead1b95
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Tue May 19 15:18:55 2026 -0700
Add noreferrer to all rel=nofollow noopener external links
External links across /clients, /clients/:slug, /firms, /firms/:slug,
and /feed previously used rel="nofollow noopener" — noreferrer was
missing, which leaks the originating profile URL in the Referer header
to third-party sites (LinkedIn, Instagram, firm websites) every time a
visitor clicks through. Spec-canonical pairing for target="_blank" is
"noopener noreferrer"; nofollow stays for SEO. All six view files
updated; videos.ejs and designer.ejs already had the full triple.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
views/public/clients.ejs | 6 +++---
views/public/dwclient.ejs | 6 +++---
views/public/feed.ejs | 6 +++---
views/public/firm.ejs | 6 +++---
views/public/firms.ejs | 6 +++---
5 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/views/public/clients.ejs b/views/public/clients.ejs
index f1b4091..89bdd91 100644
--- a/views/public/clients.ejs
+++ b/views/public/clients.ejs
@@ -72,13 +72,13 @@
<% if (c.links && (c.links.linkedin || c.links['firm-site'] || c.links.instagram)) { %>
<div class="card-links" style="display:flex;gap:10px;margin-top:10px;flex-wrap:wrap">
<% (c.links.linkedin||[]).slice(0,1).forEach(function(u) { %>
- <a href="<%= u %>" rel="nofollow noopener" target="_blank" class="muted" style="font-size:12px">LinkedIn ↗</a>
+ <a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank" class="muted" style="font-size:12px">LinkedIn ↗</a>
<% }); %>
<% (c.links['firm-site']||[]).slice(0,1).forEach(function(u) { %>
- <a href="<%= u %>" rel="nofollow noopener" target="_blank" class="muted" style="font-size:12px">Website ↗</a>
+ <a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank" class="muted" style="font-size:12px">Website ↗</a>
<% }); %>
<% (c.links.instagram||[]).slice(0,1).forEach(function(u) { %>
- <a href="<%= u %>" rel="nofollow noopener" target="_blank" class="muted" style="font-size:12px">Instagram ↗</a>
+ <a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank" class="muted" style="font-size:12px">Instagram ↗</a>
<% }); %>
</div>
<% } %>
diff --git a/views/public/dwclient.ejs b/views/public/dwclient.ejs
index 9f83393..bfa4050 100644
--- a/views/public/dwclient.ejs
+++ b/views/public/dwclient.ejs
@@ -36,13 +36,13 @@
<h3 style="font-size:11px;letter-spacing:0.18em;text-transform:uppercase;color:var(--ink-faint,#7a706a);margin:24px 0 8px">Links</h3>
<ul class="link-list" style="list-style:none;padding:0;margin:0;display:flex;flex-wrap:wrap;gap:12px">
<% (profile.links['firm-site'] || []).slice(0,2).forEach(function(u) { %>
- <li><a href="<%= u %>" rel="nofollow noopener" target="_blank">Website ↗</a></li>
+ <li><a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank">Website ↗</a></li>
<% }); %>
<% (profile.links.linkedin || []).slice(0,2).forEach(function(u) { %>
- <li><a href="<%= u %>" rel="nofollow noopener" target="_blank">LinkedIn ↗</a></li>
+ <li><a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank">LinkedIn ↗</a></li>
<% }); %>
<% (profile.links.instagram || []).slice(0,2).forEach(function(u) { %>
- <li><a href="<%= u %>" rel="nofollow noopener" target="_blank">Instagram ↗</a></li>
+ <li><a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank">Instagram ↗</a></li>
<% }); %>
</ul>
<% } %>
diff --git a/views/public/feed.ejs b/views/public/feed.ejs
index f3b3b15..eae2989 100644
--- a/views/public/feed.ejs
+++ b/views/public/feed.ejs
@@ -257,9 +257,9 @@
<% var siteHref = (it.links['firm-site']||[])[0]; var liHref = (it.links.linkedin||[])[0]; var igHref = (it.links.instagram||[])[0]; %>
<% if (siteHref || liHref || igHref) { %>
<div class="post-links">
- <% if (siteHref) { %><a href="<%= siteHref %>" target="_blank" rel="nofollow noopener">↗ Site</a><% } %>
- <% if (liHref) { %><a href="<%= liHref %>" target="_blank" rel="nofollow noopener">↗ LinkedIn</a><% } %>
- <% if (igHref) { %><a href="<%= igHref %>" target="_blank" rel="nofollow noopener">↗ Instagram</a><% } %>
+ <% if (siteHref) { %><a href="<%= siteHref %>" target="_blank" rel="nofollow noopener noreferrer">↗ Site</a><% } %>
+ <% if (liHref) { %><a href="<%= liHref %>" target="_blank" rel="nofollow noopener noreferrer">↗ LinkedIn</a><% } %>
+ <% if (igHref) { %><a href="<%= igHref %>" target="_blank" rel="nofollow noopener noreferrer">↗ Instagram</a><% } %>
</div>
<% } %>
</div>
diff --git a/views/public/firm.ejs b/views/public/firm.ejs
index 5049140..be49b75 100644
--- a/views/public/firm.ejs
+++ b/views/public/firm.ejs
@@ -43,13 +43,13 @@
<h3 style="font-size:11px;letter-spacing:0.18em;text-transform:uppercase;color:var(--ink-faint,#7a706a);margin:24px 0 8px">Links</h3>
<ul class="link-list" style="list-style:none;padding:0;margin:0;display:flex;flex-wrap:wrap;gap:12px">
<% (firm.links['firm-site'] || []).slice(0,2).forEach(function(u) { %>
- <li><a href="<%= u %>" rel="nofollow noopener" target="_blank">Website ↗</a></li>
+ <li><a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank">Website ↗</a></li>
<% }); %>
<% (firm.links.linkedin || []).slice(0,2).forEach(function(u) { %>
- <li><a href="<%= u %>" rel="nofollow noopener" target="_blank">LinkedIn ↗</a></li>
+ <li><a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank">LinkedIn ↗</a></li>
<% }); %>
<% (firm.links.instagram || []).slice(0,2).forEach(function(u) { %>
- <li><a href="<%= u %>" rel="nofollow noopener" target="_blank">Instagram ↗</a></li>
+ <li><a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank">Instagram ↗</a></li>
<% }); %>
</ul>
<% } %>
diff --git a/views/public/firms.ejs b/views/public/firms.ejs
index 44aa7c6..2155213 100644
--- a/views/public/firms.ejs
+++ b/views/public/firms.ejs
@@ -75,13 +75,13 @@
<% if (f.links && (f.links.linkedin || f.links['firm-site'])) { %>
<div class="card-links" style="display:flex;gap:10px;margin-top:10px;flex-wrap:wrap">
<% (f.links['firm-site']||[]).slice(0,1).forEach(function(u) { %>
- <a href="<%= u %>" rel="nofollow noopener" target="_blank" class="muted" style="font-size:12px">Website ↗</a>
+ <a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank" class="muted" style="font-size:12px">Website ↗</a>
<% }); %>
<% (f.links.linkedin||[]).slice(0,1).forEach(function(u) { %>
- <a href="<%= u %>" rel="nofollow noopener" target="_blank" class="muted" style="font-size:12px">LinkedIn ↗</a>
+ <a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank" class="muted" style="font-size:12px">LinkedIn ↗</a>
<% }); %>
<% (f.links.instagram||[]).slice(0,1).forEach(function(u) { %>
- <a href="<%= u %>" rel="nofollow noopener" target="_blank" class="muted" style="font-size:12px">Instagram ↗</a>
+ <a href="<%= u %>" rel="nofollow noopener noreferrer" target="_blank" class="muted" style="font-size:12px">Instagram ↗</a>
<% }); %>
</div>
<% } %>
← 18acbe8 Hydrate saved sort BEFORE first grid render
·
back to Stars of Design
·
Guard against serving .bak / .pre- snapshot artifacts from p e2ee6aa →