NCSC-certified degrees - NCSC.GOV.UK

Network security fundamentals - NCSC.GOV.UK

Shopping and paying safely online - NCSC.GOV.UK

Guidance for buying & selling second-hand devices - NCSC.GOV.UK

Resources - NCSC.GOV.UK

Social Media: how to use it safely - NCSC.GOV.UK

Cyber Essentials - NCSC.GOV.UK

Products & services - NCSC.GOV.UK

Not all types of MFA are created equal... - NCSC.GOV.UK

Phishing attacks: defending your organisation - NCSC.GOV.UK

Avoid opening links in a new tab or window. Where you must do this, include an explanation
in the text of the link.

## Why this matters

Opening links in a new tab or window breaks the back button and can be disorientating for 
novice web users, and the visually impaired. Generally you should avoid opening links in a
new tab or window, but if you have to, you should include text explaining that this will happen.

## How to fix

An explanation must be clear in the accessible text for the link. For example:

```html
<a href="products.html" target="_blank">
    Products (opens in new window)
</a>
```

Or, for an image inside a link:

```html
<a href="products.html" target="_blank">
    <img src="products.jpg" alt="Products (opens in new window)">
</a>
```

Rather than updating all of your links manually to do this, you can add a simple CSS
selector, such as:

```css
a[target="_blank"]:after {
    content: " (opens in new window)";
}
```

Note that doing this with an icon, is not sufficient to pass this check. The text must be
readable by screen readers.

Alternatively you can override the link text for accessible technologies (like screenreaders),
so that the appearance of the link does not change. For example:

```html
<a href="products.html" target="_blank" aria-label="Products (opens in new window)">
    Products
</a>
```

Note that if you do this, the `aria-label` will replace the text content of the link completely,
so it must still make sense in isolation.

## Terminology

Although it is common to say "opens in new window", almost all browsers now use tabs, and
so this terminology is potentially confusing. You may prefer: "opens in new tab".

## Methodology

1. Silktide considers all links on a page with a `target` attribute of `_blank`.
2. For each link, Silktide considers the screen-readable text of the link, which includes:
   * The text content of the link
   * Any `alt` text inside any images inside the link
   * Any `aria-label` or `aria-labelled-by` text
   * The `content` of the pseudo-elements `:before` and `:after`
3. This text is analysed for the presence of common text, including "opens new tab"
    and "opens new window". If the text is not found, the link fails the test.

## Further reading

Generally best practice is to avoid opening links in a new tab or window.  

The W3C provides detailed guidance on 
[when opening a link in a new window may be appropriate](https://www.w3.org/TR/WCAG20-TECHS/G200.html).

link-text-explains-open-in-new-window

May 2025

April 2025

The National Cyber Security Centre

Title / URL	Issues
NCSC-certified degrees - NCSC.GOV.UKwww.ncsc.gov.uk/information/ncsc-certified-degrees	100
Network security fundamentals - NCSC.GOV.UKwww.ncsc.gov.uk/guidance/network-security-fundamentals	51
Shopping and paying safely online - NCSC.GOV.UKwww.ncsc.gov.uk/guidance/shopping-online-securely	31
Guidance for buying & selling second-hand devices - NCSC.GOV.UKwww.ncsc.gov.uk/guidance/buying-selling-second-hand-devices	31
Resources - NCSC.GOV.UKwww.ncsc.gov.uk/cyberessentials/resources	30
Social Media: how to use it safely - NCSC.GOV.UKwww.ncsc.gov.uk/guidance/social-media-how-to-use-it-safely	30
Cyber Essentials - NCSC.GOV.UKwww.ncsc.gov.uk/cyberessentials/overview	25
Products & services - NCSC.GOV.UKwww.ncsc.gov.uk/section/products-services/introduction	25
Not all types of MFA are created equal... - NCSC.GOV.UKwww.ncsc.gov.uk/blog-post/not-all-types-mfa-created-equal	22
Phishing attacks: defending your organisation - NCSC.GOV.UKwww.ncsc.gov.uk/guidance/phishing	22

Ensure links explain they open in a new tab

The National Cyber Security Centre

Where this issue has occurred