diff --git a/index.php b/index.php
index 91196c12f5..c2a5a1d19c 100644
--- a/index.php
+++ b/index.php
@@ -156,7 +156,7 @@ if ($server > 0 || count($cfg['Servers']) > 1
                 . 'please do not change root, debian-sys-maint and pma users. '
                 . 'More information is available at %s.'
             ),
-            '<a href="url.php?url=https://demo.phpmyadmin.net/" target="_blank">demo.phpmyadmin.net</a>'
+            '<a href="url.php?url=https://demo.phpmyadmin.net/" target="_blank" rel="noopener noreferrer">demo.phpmyadmin.net</a>'
         );
         echo '</p>';
         echo '</div>';
diff --git a/js/functions.js b/js/functions.js
index 7fe97ccfd9..0017d2ea5c 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -4834,11 +4834,6 @@ function formatBytes(bytes, subdecimals, pointchar) {
 }
 
 AJAX.registerOnload('functions.js', function () {
-    /**
-     * Opens pma more themes link in themes browser, in new window instead of popup
-     * This way, we don't break HTML validity
-     */
-    $("a._blank").prop("target", "_blank");
     /**
      * Reveal the login form to users with JS enabled
      * and focus the appropriate input field
diff --git a/libraries/Advisor.php b/libraries/Advisor.php
index 8d5cadcd5d..20cf1dfab3 100644
--- a/libraries/Advisor.php
+++ b/libraries/Advisor.php
@@ -353,7 +353,7 @@ class Advisor
      */
     private function replaceLinkURL($matches)
     {
-        return 'href="' . PMA_linkURL($matches[2]) . '" target="_blank"';
+        return 'href="' . PMA_linkURL($matches[2]) . '" target="_blank" rel="noopener noreferrer"';
     }
 
     /**
diff --git a/libraries/Footer.php b/libraries/Footer.php
index 59e54841c6..4d50d517ca 100644
--- a/libraries/Footer.php
+++ b/libraries/Footer.php
@@ -72,9 +72,9 @@ class Footer
             include './revision-info.php';
             $message .= sprintf(
                 __('Currently running Git revision %1$s from the %2$s branch.'),
-                '<a target="_blank" href="' . $repobase . $fullrevision . '">'
+                '<a target="_blank" rel="noopener noreferrer" href="' . $repobase . $fullrevision . '">'
                 . $revision . '</a>',
-                '<a target="_blank" href="' . $repobranchbase . $branch . '">'
+                '<a target="_blank" rel="noopener noreferrer" href="' . $repobranchbase . $branch . '">'
                 . $branch . '</a>'
             );
         } else {
@@ -193,7 +193,7 @@ class Footer
         $retval  = '';
         $retval .= '<div id="selflink" class="print_ignore">';
         $retval .= '<a href="' . htmlspecialchars($url) . '"'
-            . ' title="' . __('Open new phpMyAdmin window') . '" target="_blank">';
+            . ' title="' . __('Open new phpMyAdmin window') . '" target="_blank" rel="noopener noreferrer">';
         if (Util::showIcons('TabsMode')) {
             $retval .= Util::getImage(
                 'window-new.png',
diff --git a/libraries/Util.php b/libraries/Util.php
index aa8cc94a87..adba8d14c8 100644
--- a/libraries/Util.php
+++ b/libraries/Util.php
@@ -1908,6 +1908,9 @@ class Util
         }
         if (! empty($target)) {
             $tag_params['target'] = htmlentities($target);
+            if ($target === '_blank' && strncmp($url, 'url.php?', 8) == 0) {
+                $tag_params['rel'] = 'noopener noreferrer';
+            }
         }
 
         $displayed_message = '';
diff --git a/libraries/navigation/NavigationHeader.php b/libraries/navigation/NavigationHeader.php
index b4948ba709..6788bf28b2 100644
--- a/libraries/navigation/NavigationHeader.php
+++ b/libraries/navigation/NavigationHeader.php
@@ -116,7 +116,7 @@ class NavigationHeader
         }
         switch ($GLOBALS['cfg']['NavigationLogoLinkWindow']) {
         case 'new':
-            $linkAttriks = 'target="_blank"';
+            $linkAttriks = 'target="_blank" rel="noopener noreferrer"';
             break;
         case 'main':
             // do not add our parameters for an external link
@@ -127,7 +127,7 @@ class NavigationHeader
             if (empty($host)) {
                 $logoLink .= URL::getCommon();
             } else {
-                $linkAttriks = 'target="_blank"';
+                $linkAttriks = 'target="_blank" rel="noopener noreferrer"';
             }
         }
 
diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php
index b560e6fc8f..05d74a2075 100644
--- a/libraries/plugins/auth/AuthenticationCookie.php
+++ b/libraries/plugins/auth/AuthenticationCookie.php
@@ -94,7 +94,7 @@ class AuthenticationCookie extends AuthenticationPlugin
     <div class="container">
     <a href="';
         echo PMA_linkURL('https://www.phpmyadmin.net/');
-        echo '" target="_blank" class="logo">';
+        echo '" target="_blank" rel="noopener noreferrer" class="logo">';
         $logo_image = $GLOBALS['pmaThemeImage'] . 'logo_right.png';
         if (@file_exists($logo_image)) {
             echo '<img src="' , $logo_image
diff --git a/test/classes/AdvisorTest.php b/test/classes/AdvisorTest.php
index 451538582c..23cb028da2 100644
--- a/test/classes/AdvisorTest.php
+++ b/test/classes/AdvisorTest.php
@@ -263,7 +263,7 @@ class AdvisorTest extends PMATestCase
                     'name' => 'Distribution',
                     'issue' => 'official MySQL binaries.',
                     'recommendation' => 'See <a href="./url.php?url=https%3A%2F%2F' .
-                        'example.com%2F" target="_blank">web</a>',
+                        'example.com%2F" target="_blank" rel="noopener noreferrer">web</a>',
                     'id' => 'Distribution'
                 ),
                 null,
diff --git a/test/classes/FooterTest.php b/test/classes/FooterTest.php
index 1b1ff62b1b..43efe51fde 100644
--- a/test/classes/FooterTest.php
+++ b/test/classes/FooterTest.php
@@ -158,7 +158,7 @@ class FooterTest extends PMATestCase
             '<div id="selflink" class="print_ignore"><a href="index.php?db=&amp;'
             . 'table=&amp;server=1&amp;target=&amp;lang=en&amp;collation_connection='
             . 'utf8_general_ci" title="Open new phpMyAdmin window" '
-            . 'target="_blank">Open new phpMyAdmin window</a></div>',
+            . 'target="_blank" rel="noopener noreferrer">Open new phpMyAdmin window</a></div>',
             $this->_callPrivateFunction(
                 '_getSelfLink',
                 array(
@@ -183,7 +183,7 @@ class FooterTest extends PMATestCase
             '<div id="selflink" class="print_ignore"><a href="index.php?db=&amp;'
             . 'table=&amp;server=1&amp;target=&amp;lang=en&amp;collation_connection='
             . 'utf8_general_ci" title="Open new phpMyAdmin window" '
-            . 'target="_blank"><img src="themes/dot.gif" title="Open new '
+            . 'target="_blank" rel="noopener noreferrer"><img src="themes/dot.gif" title="Open new '
             . 'phpMyAdmin window" alt="Open new phpMyAdmin window" '
             . 'class="icon ic_window-new" /></a></div>',
             $this->_callPrivateFunction(
diff --git a/themes.php b/themes.php
index 0aca62e409..8374d34f2d 100644
--- a/themes.php
+++ b/themes.php
@@ -23,7 +23,7 @@ $hash    = '#pma_' . preg_replace('/([0-9]*)\.([0-9]*)\..*/', '\1_\2', PMA_VERSI
 $url     = PMA_linkURL('https://www.phpmyadmin.net/themes/') . $hash;
 $output  = '<h1>phpMyAdmin - ' . __('Theme') . '</h1>';
 $output .= '<p>';
-$output .= '<a href="' . $url . '" rel="noopener noreferrer" class="_blank">';
+$output .= '<a href="' . $url . '" rel="noopener noreferrer" target="_blank">';
 $output .= __('Get more themes!');
 $output .= '</a>';
 $output .= '</p>';