Drupal is a registered trademark of Dries Buytaert
drupal 11.3.7 Update released for Drupal core (11.3.7)! drupal 11.2.11 Update released for Drupal core (11.2.11)! drupal 10.6.7 Update released for Drupal core (10.6.7)! drupal 10.5.9 Update released for Drupal core (10.5.9)! cms 2.1.1 Update released for Drupal core (2.1.1)! drupal 11.3.6 Update released for Drupal core (11.3.6)! drupal 10.6.6 Update released for Drupal core (10.6.6)! cms 2.1.0 Update released for Drupal core (2.1.0)! bootstrap 8.x-3.40 Minor update available for theme bootstrap (8.x-3.40). menu_link_attributes 8.x-1.7 Minor update available for module menu_link_attributes (8.x-1.7). eca 3.1.1 Minor update available for module eca (3.1.1). layout_paragraphs 2.1.3 Minor update available for module layout_paragraphs (2.1.3). ai 1.3.3 Minor update available for module ai (1.3.3). ai 1.2.14 Minor update available for module ai (1.2.14). node_revision_delete 2.0.3 Minor update available for module node_revision_delete (2.0.3). moderated_content_bulk_publish 2.0.52 Minor update available for module moderated_content_bulk_publish (2.0.52). klaro 3.0.10 Minor update available for module klaro (3.0.10). klaro 3.0.9 Minor update available for module klaro (3.0.9). layout_paragraphs 2.1.2 Minor update available for module layout_paragraphs (2.1.2). geofield_map 11.1.8 Minor update available for module geofield_map (11.1.8).

sel

82 sites Security covered
View on drupal.org

Most of the clients I worked for asked that external links on their website should open a new browser window or tab. Safe External Links (sel) does this for you automatically and properly. It modifies external links to make them open a new window by adding target="_blank" and rel="noreferrer" or rel="noopener" attributes to the anchor tag.

Properly?

If you simply just have a target="_blank" on outbound links, you put your site visitors at risk of tabnapping.
Tabnapping is a phishing attack that takes advantage of user trust and inattention to detail in regard to tabs, and forces the browser to navigate to an impersonated page after the page is left. Mathias Bynens created a great Github page for demonstrating this attack.
And this is why Google Chrome’s built-in Lighthouse validation warns you if it finds an external link with a _blank target without the appropriate relation:


Lighthouse audit report warning about unsafe cross-origin link destinations.

The solution

The best thing is: Safe External Links can solve these. You only have to download and enable it, change the link formatters and update the filter formats you use.

Processed Drupal components:

  • Menu links
  • Link fields (sel_link field formatter)
  • Formatted texts (filter_sel filter plugin)

Activity

Total releases
1
First release
Jun 2025
Latest release
9 months ago
Release cadence
Stability
100% stable

Releases

Version Type Release date
8.x-1.1 Stable Jun 28, 2025