Resources - NCSC.GOV.UK

Social Media: how to use it safely - NCSC.GOV.UK

Mon 8 Nov - EmPower Cyber Week - Cyber Security - NCSC.GOV.UK

Tue 9 Nov - EmPower Cyber Week - Networks - NCSC.GOV.UK

Threat Modelling - NCSC.GOV.UK

Phishing attacks: defending your organisation - NCSC.GOV.UK

NCSC Annual Review 2022 - NCSC.GOV.UK

NCSC’s Cyber Advisor scheme milestone - NCSC.GOV.UK

Vulnerability Reporting - NCSC.GOV.UK

Privacy notice - NCSC.GOV.UK

Avoid opening links in a new tab or window. Where you must do this, include an explanation
in the text of the link.

## Why this matters

Opening links in a new tab or window breaks the back button and can be disorientating for 
novice web users, and the visually impaired. Generally you should avoid opening links in a
new tab or window, but if you have to, you should include text explaining that this will happen.

## How to fix

An explanation must be clear in the accessible text for the link. For example:

```html
<a href="products.html" target="_blank">
    Products (opens in new window)
</a>
```

Or, for an image inside a link:

```html
<a href="products.html" target="_blank">
    <img src="products.jpg" alt="Products (opens in new window)">
</a>
```

Rather than updating all of your links manually to do this, you can add a simple CSS
selector, such as:

```css
a[target="_blank"]:after {
    content: " (opens in new window)";
}
```

Note that doing this with an icon, is not sufficient to pass this check. The text must be
readable by screen readers.

Alternatively you can override the link text for accessible technologies (like screenreaders),
so that the appearance of the link does not change. For example:

```html
<a href="products.html" target="_blank" aria-label="Products (opens in new window)">
    Products
</a>
```

Note that if you do this, the `aria-label` will replace the text content of the link completely,
so it must still make sense in isolation.

## Terminology

Although it is common to say "opens in new window", almost all browsers now use tabs, and
so this terminology is potentially confusing. You may prefer: "opens in new tab".

## Methodology

1. Silktide considers all links on a page with a `target` attribute of `_blank`.
2. For each link, Silktide considers the screen-readable text of the link, which includes:
   * The text content of the link
   * Any `alt` text inside any images inside the link
   * Any `aria-label` or `aria-labelled-by` text
   * The `content` of the pseudo-elements `:before` and `:after`
3. This text is analysed for the presence of common text, including "opens new tab"
    and "opens new window". If the text is not found, the link fails the test.

## Further reading

Generally best practice is to avoid opening links in a new tab or window.  

The W3C provides detailed guidance on 
[when opening a link in a new window may be appropriate](https://www.w3.org/TR/WCAG20-TECHS/G200.html).

link-text-explains-open-in-new-window

July 2025

June 2025

The National Cyber Security Centre

Title / URL	Issues
Resources - NCSC.GOV.UKwww.ncsc.gov.uk/cyberessentials/resources	32
Social Media: how to use it safely - NCSC.GOV.UKwww.ncsc.gov.uk/guidance/social-media-how-to-use-it-safely	30
Mon 8 Nov - EmPower Cyber Week - Cyber Security - NCSC.GOV.UKwww.ncsc.gov.uk/empower-cyber-week/day-1-cyber-security	29
Tue 9 Nov - EmPower Cyber Week - Networks - NCSC.GOV.UKwww.ncsc.gov.uk/empower-cyber-week/day-2-networks	23
Threat Modelling - NCSC.GOV.UKwww.ncsc.gov.uk/collection/risk-management/threat-modelling	22
Phishing attacks: defending your organisation - NCSC.GOV.UKwww.ncsc.gov.uk/guidance/phishing	22
NCSC Annual Review 2022 - NCSC.GOV.UKwww.ncsc.gov.uk/collection/annual-review-2022	21
NCSC’s Cyber Advisor scheme milestone - NCSC.GOV.UKwww.ncsc.gov.uk/blog-post/ncsc-cyber-advisor-scheme-milestone	21
Vulnerability Reporting - NCSC.GOV.UKwww.ncsc.gov.uk/information/vulnerability-reporting	21
Privacy notice - NCSC.GOV.UKwww.ncsc.gov.uk/section/about-this-website/privacy-statement	20

Ensure links explain they open in a new tab

The National Cyber Security Centre

Where this issue has occurred