A partner wants referrals measured while the website team wants external tabs isolated. These are different requirements, not a choice between security and any analytics at all. Agree the privacy policy and measurement limits before changing every outbound link.
Source-bound fact
noopener removes the opener relationship; it does not itself suppress Referer, while noreferrer does. Official reference · Checked 17 October 2026.
Filled synthetic acceptance example
Synthetic teaching example, not a client case or a real-store assessment. On narrow screens, scroll to read the complete table.
| Input | Check basis | Expected |
|---|---|---|
| target_blank; relnoopener | opener relationship | isolate; referral still policy-dependent |
| relnoopener noreferrer | explicit no-referrer intent | do not promise destination referral header |
| Referrer-Policy:no-referrer | another independent policy | noopener cannot restore referral |
Supplier acceptance procedure
- List the intended destination, tab behaviour, privacy approval and required evidence without including personal query parameters.
- Have the supplier inspect actual response policy and link attributes, then test opener and received referral separately in authorised test pages.
- Classify analytics gaps as unknown until independently measured; do not report clicks as leads or fabricate referral headers.
Interpret the output
The manifest checker identifies an explicit noreferrer token but does not emulate browser navigation, server policy or a destination analytics account. Its purpose is to stop a supplier claiming “noopener removes all referral information” as a reason to weaken isolation.
Explicit limits
No security settings are weakened and no partner submission occurs. Consent, browser policy, redirects and destination measurement remain independent.
Replay the finite teaching model
Save both files in one folder. With Node22 or newer, run the command below. JSON contains explicit inputs and expected results. The script processes synthetic data only, with no network, credentials, payment or API calls. Passing proves the finite model only, not a live integration.
Filled inputs and expectations · Inspectable teaching script
node check.mjs partner-link-opener-referrer-contract.json