A simple privacy-enhancing plugin that adds rel="noreferrer" to external links in posts, pages and comments.
| Author: | Anders Jensen-Urstad (profile at wordpress.org) |
| WordPress version required: | 3.0 |
| WordPress version tested: | 4.3.1 |
| Plugin version: | 2.0.1 |
| Added to WordPress repository: | 19-05-2015 |
| Last updated: | 19-09-2015
Warning! This plugin has not been updated in over 2 years. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.
|
| Rating, %: | 0 |
| Rated by: | 0 |
| Plugin URI: | https://anders.unix.se/wordpress-plugin-noref... |
| Total downloads: | 376 |
| Active installs: | 70+ |
 Click to start download |
|
When you click on a link, your browser normally tells the destination page what page you were on when you clicked the link. This is called the HTTP referer [sic!]. This also happens when your browser loads things like images, fonts and external CSS/JS.
This is bad for privacy. For sensitive sites, it can be terrible for privacy. However, with HTML5, there are now ways to stop referrers from being sent.
rel="noreferrer" link type and referrer attribute
This plugin, by default, adds rel="noreferrer" to external links in posts, pages and comments, and referrer="no-referrer" to images and iframes.
As defined in the HTML5 spec, rel="noreferrer" "indicates that no referrer information is to be leaked when following the link".
As defined in the Referrer Policy Draft, referrer="no-referrer" "specifies that no referrer information is to be sent along with requests made from a particular settings object to any origin".
The plugin modifies elements right before they are displayed. It doesn't modify anything in the database. Existing attributes, including any existing rel attributes (such as the one set by wp_rel_nofollow()), are preserved. It is possible to whitelist domains if you do want to send referrer information to them.
The rel="noreferrer" link type is supported by Firefox (since version 33), Chrome/Safari (added to WebKit in November 2009) and Microsoft Edge in Windows 10.
The referrer attribute is not yet supported by the stable version of any browser (July 2015).
Referrer Policy meta tag
This plugin, by default, also sets Referrer Policy to never via a meta tag. This is even better for privacy: it tells the browser not to send referrer information at all and applies to both links as well as requests generated by the page (CSS, images, etc.). While still just a W3C draft, it is supported by Firefox (since version 37), Chrome and Safari (added to WebKit in November 2011), and by Microsoft Edge in Windows 10 (source).
Please note that this could affect plugins that foolishly rely on the refer(r)er header, as well as third-party tools you might use.
If you enable this, whitelisting internal links and other elements is possible thanks to the referrer attribute; however, support for this has not yet made it into the stable version of any browser.
Notes
Inspired by the Drupal module No referrer.
The code is available on GitHub.