How this was measured
On 2026-10-16 we requested the homepage of each of the same 78 hand-picked domains our other surveys use — news, commerce, SaaS, developer tooling, social, streaming, reference, SEO, education, finance, cloud, local and government — and parsed every <a> tag in the HTML we got back. Each request identified itself as a survey crawler and was attempted directly first, then through a local proxy; 56 domains answered on the direct path and 22 needed the proxy.
63 of 78 returned a readable homepage (80.8%). The other 15 are counted as undecidable, not as absent: 202 from amazon.com and booking.com, 403 from ebay.com, stackoverflow.com, npmjs.com, yelp.com and nih.gov, 406 from uber.com, and no response at all from nytimes.com, reuters.com, washingtonpost.com, etsy.com, quora.com, searchengineland.com and coinbase.com.
Nine of the 63 then had to be excluded for a different reason: their HTML contained fewer than 20 links, which means what we fetched was a JavaScript shell rather than a page — reddit.com 0, pinterest.com 18, tumblr.com 4, youtube.com 14, twitch.tv 0, archive.org 0, khanacademy.org 0, paypal.com 9 and airbnb.com 14. That leaves 54 homepages carrying 10,121 anchors, median 171 links each, ranging from 20 to 649.
Four parsing decisions shaped every number below, and each one changed an answer. Internal versus external is decided by registrable domain, not by hostname: docs.docker.com and www.docker.com are one site, and screamingfrog.co.uk has a three-label registrable domain, not two. Non-HTTP schemes are excluded before anything is counted — 144 in-page fragments, 37 anchors with no href at all, 8 mailto:, 8 tel: and 5 javascript: links are not outbound links. Attribute values do not have to be quoted, and a parser that insists on quotes silently discards them. And when a tag carries two rel attributes, only the first one counts, which is the HTML rule and turns out to matter here.
Finding 1: the attribute everybody argues about is the one nobody uses
Of the 1,087 outbound links across these 54 homepages, 41 carry rel="nofollow" — 3.8%. More telling is the site-level count: 5 of 54 homepages nofollow a single outbound link. Those five are ahrefs.com (17 of its 37 outbound links), digitalocean.com (9 of 12), shopify.com (7 of 29), semrush.com (6 of 10) and x.com (2 of 2). Every other homepage — bbc.com, netflix.com, cloudflare.com, stripe.com, wikipedia.org, cdc.gov — links out to other domains with nothing on the tag.
20 of 54 homepages put no rel on any outbound link at all, and one, spotify.com, has no outbound links on its homepage whatsoever. If you have been told that marking external links is standard practice, this sample says otherwise: it is a practice a minority of sites apply, unevenly, and three of the five that do apply it are SEO or marketing companies.
The pooled percentages are almost useless here, and that is worth stating plainly. zoom.us alone contributes 270 of the 1,087 outbound links, 262 of them pointing at zoom.com. A single site's link structure can move any pooled number by a quarter, which is why every rate in this article is reported per site as well as pooled.
Finding 2: sponsored has one user, and it is not an affiliate site
Exactly one homepage in 54 uses rel="sponsored", and it is nodejs.org. It uses it eight times, on eight sponsor buttons — digitalocean.com, nodesource.com, vercel.com, herodevs.com, cloudflare.com, tuxcare.com, macstadium.com and microsoft.com — each carrying rel="sponsored noopener", target="_blank" and a utm_source=nodejs-website parameter. That is the textbook case for the attribute: paid placement, disclosed in markup, with the tracking parameters sitting right next to it.
Which makes the absence everywhere else hard to read as anything but under-use. Homepages of this kind are exactly where sponsored logos and partner badges live, and 53 of 54 mark them with nothing.
rel="ugc" appears zero times. That number needs a caveat before anyone quotes it: ugc exists for user-generated content — comments, forum posts, profile fields — and a corporate homepage is the one page type that reliably has none. Zero here is evidence about where we looked, not about whether the attribute is used. It is the reason this survey reports the homepage rate for ugc and refuses to generalise from it.
One homepage also uses rel="external" (mozilla.org). It is not something Google reads; it is a convention, sometimes used by scripts that style or handle outbound links.
Finding 3: what sites actually write is noopener, and it stopped being an SEO decision
The most common token by a wide margin is not an SEO signal at all. noopener appears on 299 outbound links across 26 of the 54 homepages; noreferrer appears on 163 across 18. The two are paired on 146 links, noopener is written alone on 153, and noreferrer alone on 17.
None of that is about ranking — it is the window.opener tabnabbing fix, and it is now largely redundant. MDN's documentation for <a> states that setting target="_blank" implicitly provides the same rel behaviour as setting rel="noopener" in newer browser versions. The implicit behaviour does not extend to noreferrer, so if the point is to keep the referring URL out of the request, that still has to be written explicitly.
Which reframes the 181 links in this sample that open a new tab without either token. 752 links across 42 homepages carry target="_blank"; 181 of them, on 23 sites, have no noopener and no noreferrer, and 58 of those 181 point off-site. On a modern browser that is a non-issue. On an old one, or if you wanted noreferrer, it is not.
Finding 4: two sites write noopener in a form the browser cannot read
Counting tokens rather than trusting the attribute is what surfaced these, and both were verified against the raw HTML before being written down.
screamingfrog.co.uk writes rel=”noopener” with typographic quotation marks — U+201D, the curly character a word processor or a copy-paste from a rich-text editor produces — on four social links in its footer. The value is not the token noopener; it is a nine-character string containing it. The browser parses the attribute fine and then matches nothing. This is an SEO software vendor's own site, and it is the kind of defect no validator flags, because the markup is valid.
moz.com writes two rel attributes on the same tag, three times: <a rel="author" href="…" target="_blank" rel="noopener noreferrer">. HTML takes the first and ignores the second, so those three links open a new tab with rel="author" and nothing else. The fix is one attribute with all three tokens, and the reason it went unnoticed is that the HTML looks correct to a human reader.
Two smaller ones in the same family: 145 links across atlassian.com, slack.com and developer.mozilla.org carry rel="" — an empty value, almost certainly a framework rendering an empty prop. It does nothing. And harvard.edu uses rel="home" on its logo link, a value that has been obsolete for years.
Finding 5: five sites put nofollow on their own links
43 internal links across 5 homepages carry rel="nofollow" — links pointing at the same registrable domain they appear on. The counts: digitalocean.com 16, x.com 14, docker.com 5, ahrefs.com 4 and stanford.edu 4.
Read the actual tags and the pattern splits in two. digitalocean.com nofollows footer furniture — /press, /leadership/executive-management, /currents, /open-source, plus store.digitalocean.com, status.digitalocean.com and ideas.digitalocean.com. x.com nofollows its own legal and help pages — /tos, /privacy, help.x.com, about.x.com, careers.x.com, each with rel="noopener noreferrer nofollow". docker.com nofollows its own installer downloads, ahrefs.com nofollows help.ahrefs.com and its own /podcast, and stanford.edu nofollows its copyright, trademark and non-discrimination pages.
Some of that is defensible — nofollow on a login or a legal page is a way of saying "do not spend crawl budget here" — and some of it looks like a template applied to a whole footer. Either way it is a decision being made about internal crawl paths, and it is being made on five of the most heavily engineered homepages in the sample rather than by accident.
What to ship
Stop nofollowing outbound links by default. Five of 54 homepages do it at all, 20 mark nothing, and Google has treated these values as hints rather than directives since 2019. Marking every external link was never the norm this sample reflects.
Do use sponsored where money changed hands. nodejs.org is the only site here that does, and it is the clearest, cheapest signal available: one attribute on the links you are already tagging with UTM parameters.
Put ugc where the user-generated content is. Comment templates, forum threads, review forms — not the homepage. Zero of 54 homepages use it because none of them have comments on the homepage.
Keep noopener only if you need old-browser coverage, and treat noreferrer as the part that still counts. Modern browsers imply the former for target="_blank"; they do not imply the latter.
Audit for the two broken patterns, because no tool warns you about either. Grep the rendered HTML for curly quotes inside attribute values, and for tags with rel twice. Both are valid HTML that does nothing — grep -o 'rel=[^ >]*' page.html | sort | uniq -c | sort -rn shows the first in one line.
To write the head tags for a new page without any of them drifting apart, the meta tag generator produces the title, description, canonical and robots tag from one input, and the robots.txt tester covers the file that governs crawling rather than link-level signals.
Limitations
Homepages only, and only 54 of them. A homepage is where navigation and footer link sets dominate: the median homepage here has 171 links and only 13 outbound ones, and outbound links are a median 8.2% of everything on the page. Article pages, category pages and comment threads have completely different link profiles, and ugc in particular lives there.
Server-rendered HTML only. Nine otherwise-readable homepages had to be dropped because their HTML was a JavaScript shell, and any link added after load is invisible to this method. The sample is biased towards sites that render on the server, which is the same bias our heading and favicon surveys carry.
The internal/external split is mechanical. We compare registrable domains, so zoom.us linking to 262 zoom.com URLs is counted as outbound even though it is one company, and a link to a site's own CDN or a subsidiary counts as external. That single site contributes a quarter of the pooled outbound total.
One snapshot, one user agent. Everything was fetched on 2026-10-16 with a crawler identity. WAFs answer differently per client, and while every verdict in this article was checked against the raw tag, the pages themselves were not re-requested with a browser user agent.
We counted attributes, not intent. A rel that a framework renders but a script strips, or one added client-side, lands in the wrong bucket, and we cannot tell from HTML which links anyone considers paid.
Reproduce it
The script and the shared domain list ship with this site. node scripts/survey-link-rel.mjs fetches all 78 homepages and stores them; --report re-parses and re-derives every number from the stored HTML without touching the network, which is how the parsing fixes were applied after the fetch; --evidence prints the original <a> tag behind every verdict — that is what confirmed the curly-quoted noopener, the duplicated rel and all eight sponsored links. Our robots.txt, canonical, AI crawler and indexing directive surveys run the same domain list from other angles.