Since WordPress 5.1 (see #43187) it ships with the wp_targeted_link_rel() function, that adds noreferrer and noopener relation values to all anchor elements that have a target.
This function is used to filter through the various input data just before saving it, e.g.
- post title,
- post content,
- post excerpt,
- comment content,
- term description,
- link description,
- link notes,
- user description.
Since 5.2 the following improvements are made:
- #46421 handles the Text and HTML widgets.
- #43280 handles the Image Media widget.
- #43290 handles the Menus.
There are open tickets to further refine it, e.g.
- #46886 to avoid false positive from the
data-targetattribute. - #46580 asks if there’s any reason to add the relations for any values of
target. - 46316 to not let it corrupt JSON content.
- #46479 to handle the comment fields.
If you have some custom user input that allows external links, then you could use:
$text = wp_targeted_link_rel( $text );
to handle it.
The default relation values 'noopener noreferrer' are also filterable through the wp_targeted_link_rel filter.