WebberZone Link Warnings

WebberZone Link Warnings helps you warn users when links open in a new window or take them to external websites. It adds accessible indicators, confirmation dialogs, or redirect screens — helping you align with accessibility best practices without rewriting your content. WebberZone Link Warnings uses a two-layer approach to process links across your entire site. For post content, it uses WordPress's native WP_HTML_Tag_Processor class to efficiently parse and modify links at render time. For everything else — navigation menus, footers, sidebars, widgets, and theme output — a lightweight JavaScript scan runs after the page loads and applies the same rules. It adds appropriate ARIA attributes, visual indicators, and optional JavaScript-based warnings based on your configuration. Your stored content remains untouched — the plugin only alters rendered output and does not interfere with REST API responses or admin editing screens. Why warn users about external links?

• target="_blank" can disorient screen reader users
• Sudden context changes impact usability
• Accessibility audits often recommend user warnings
• Agencies and site owners often need documented user warnings during accessibility reviews

Key features

• Multiple Warning Methods: Choose from inline indicators, modal dialogs, or redirect screens — or combine them
• Flexible Scope: Target external links only, or external links plus all target="_blank" links
• Customizable Indicators: Configure visual icons, text, or screen reader-only warnings
• Modal Dialog: Show a confirmation dialog before users navigate to external sites with keyboard navigation and focus management
• Dismissible Modals: Let repeat visitors tick "Don't show again" so the modal is skipped for a session or for a set number of days, per destination domain or sitewide
• Redirect Screen: Display an intermediate page with a configurable countdown before external navigation
• Force External: Add a class to any link or wrapper element to force it to be treated as external — useful for tracking URLs or redirects that use internal paths
• Automatic Link Attributes: Add nofollow, sponsored, ugc, noopener, noreferrer and target="_blank" to external links, affiliate links, or both — no post edits needed
• Affiliate Link Marking: Flag a link or container with a class and give affiliate links their own attributes
• Domain Exclusions: Allow trusted domains to treat them as internal links
• Sitewide Coverage: Links in navigation menus, footers, sidebars, widgets, and theme output are processed alongside post content
• Post Type Control: PHP-side processing is scoped to configured post types; JS scanning covers the full page regardless
• Built to support accessibility best practices for external link behaviour in WordPress: Adds screen reader text, ARIA attributes, and keyboard-friendly modal confirmations
• Setup Wizard: Get started quickly with a guided setup wizard on first activation
• Template Override: Override the redirect screen template in your theme for full design control
• RTL Support: Full right-to-left language support for all frontend and admin styles
• Multisite Compatible: Network activate and configure per-site settings
• Privacy Focused: Does not collect personal data or send link data to third-party services
• Performance Optimized: Uses WordPress's native WP_HTML_Tag_Processor class to process links at display time
• Developer-Friendly: Filters and actions allow developers to customize behavior, exclude domains, and output

This plugin assists with user awareness of external navigation. It does not automatically make your website fully accessible or legally compliant.

How it works After activation, the setup wizard guides you through the initial configuration. You can also configure the plugin at Settings > WebberZone Link Warnings. Warning Methods:

• Inline indicators only (visual and/or screen reader text)
• Modal dialog (JavaScript-based confirmation)
• Redirect screen (intermediate page with countdown)
• Combined approach (inline + modal)
• Combined approach (inline + redirect)

Link Scope:

• External links only
• External links and all target="_blank" links

Visual Indicators:

• Icon only (↗)
• Text only (customizable)
• Icon + text
• None (screen reader only)

Advanced Settings:

• Custom modal messages and button text
• Modal frequency, dismissal scope and "Don't show again" label
• Custom redirect page content and countdown duration
• Link attributes for external and affiliate links (nofollow, sponsored, ugc, open in a new tab, noopener, noreferrer)
• Affiliate link class and wrapper class (defaults: wzlw-affiliate, wzlw-affiliate-wrapper)
• Domain exclusion list
• Post type selection
• Force-external class name (default: wzlw-force-external)

GDPR WebberZone Link Warnings doesn't collect personal data or send information to external services — making it GDPR-friendly by default. You remain responsible for your site's overall GDPR compliance. Contribute WebberZone Link Warnings is also available on Github. So, if you've got a cool feature you'd like to implement in the plugin or a bug you've fixed, consider forking the project and sending me a pull request. Bug reports are welcomed on GitHub. Please note that GitHub is not a support forum, and issues that aren't suitably qualified as bugs will be closed. Translations WebberZone Link Warnings is available for translation directly on WordPress.org. Check out the official Translator Handbook to contribute. Other Plugins by WebberZone WebberZone Link Warnings is one of the many plugins developed by WebberZone. Check out our other plugins:

• Contextual Related Posts - Display related posts on your WordPress blog and feed
• Top 10 - Track daily and total visits to your blog posts and display the popular and trending posts
• WebberZone Snippetz - The ultimate snippet manager for WordPress to create and manage custom HTML, CSS or JS code snippets
• Knowledge Base - Create a knowledge base or FAQ section on your WordPress site
• Better Search - Enhance the default WordPress search with contextual results sorted by relevance
• Auto-Close - Automatically close comments, pingbacks and trackbacks and manage revisions
• Popular Authors - Display popular authors in your WordPress widget
• Followed Posts - Show a list of related posts based on what your users have read

WordPress install (the easy way)

1. Navigate to Plugins > Add New
2. Search for "WebberZone Link Warnings"
3. Click "Install Now" and then "Activate"

Manual install

1. Upload the webberzone-link-warnings folder to /wp-content/plugins/
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Go to Settings > WebberZone Link Warnings to configure

1.5.1

• Improvement: Setting defaults are now resolved from a single lightweight list instead of building every settings field, so reading an option early in the page load no longer risks a "translation loading triggered too early" notice.
• Fix: Fixed settings on a multisite network reading another site's values in the same request after a switch_to_blog() call, such as during network activation or deactivation.
• Fix: Fixed the settings wizard silently dropping repeater field rows on save.
• Fix: Fixed settings not saving when the referer check was bypassed, and hardened the settings sanitizer's array handling.
• Updated the Patchstack VDP link to the plugin-specific URL.
• Tested up to WordPress 7.1.

1.5.0 (4 August 2026) Version 1.5.0 Release Post New Features

• New Link Attributes section under Settings > WebberZone Link Warnings > Advanced adds rel and target attributes to your links automatically. Pick any combination of rel="nofollow", rel="sponsored", rel="ugc", "Open in a new tab" (target="_blank"), rel="noopener" and rel="noreferrer", configured separately for external links and for affiliate links.
• Existing rel values are preserved rather than overwritten, and matching ignores case. A link with rel="me author" becomes rel="me author nofollow", and a link that already has rel="NoFollow" is not given a duplicate.
• noopener and noreferrer are separate options and are only added to links that actually open in a new tab — either because the link already carries target="_blank" or because you enabled the new-tab option. They are kept apart because noreferrer also stops the referrer being sent, which can break referrer-based affiliate attribution, while noopener is a pure security hint.
• New Affiliate Link Class (default wzlw-affiliate) and Affiliate Link Wrapper Class (default wzlw-affiliate-wrapper) settings mark a single link, or every link inside a container, as an affiliate link. Both accept comma-separated values, and affiliate links receive both the external and the affiliate attribute sets.
• Links marked as affiliate links are also treated as external for warning purposes, so an internal cloaked URL such as /go/product/ shows the same modal, redirect screen or indicator as a genuine outbound link. This mirrors how the force-external class already behaves and takes precedence over the excluded domains list.
• Attributes are applied by both processing layers — WP_HTML_Tag_Processor for post content, and the sitewide JavaScript scan for navigation menus, footers, sidebars, widgets and other theme output.
• Repeat visitors can now dismiss the modal instead of confirming every external link. Set Modal Frequency under Settings > WebberZone Link Warnings > Display to "Once per browser session" or "Once every N days" and the modal gains a "Don't show again" checkbox. Tick it, click Continue, and the modal is skipped on later clicks. The default remains "Always show the modal", so existing sites behave exactly as before.
• New Dismissal Scope setting decides whether a dismissal applies only to the destination domain the visitor dismissed, or to every external link on the site.
• New Remember Dismissal For setting sets how many days a dismissal lasts, from 1 to 365.
• The checkbox label is configurable via Don't Show Again Label and is registered for WPML string translation.
• Dismissals are stored in the visitor's own browser using sessionStorage or localStorage. No cookies are set and nothing is written to your database.

Improvements

• The Advanced tab is now split under two headings, Link Attributes and Exclusions and Classes, so the domain exclusion and class settings are no longer grouped under the attribute options.

Bug Fixes

• Internal target="_blank" links inside post content never triggered a warning. Under the "External links and internal links opening in a new tab" scope, PHP marked these links as processed but wrote no data attributes, so the JavaScript scan skipped them as well. The identical link in a navigation menu or widget did get a warning. PHP now mirrors the JavaScript logic and emits data-wzlw-blank for internal new-tab links.
• The signed redirect URL is no longer added to every processed link when the warning method is modal only. It is emitted for the redirect and inline redirect methods alone, which drops an unused attribute from the rendered HTML and skips a per-link HMAC on modal pages.

1.4.0 (23 May 2026) Version 1.4.0 Release Post New Features

• Excluded domains now support wildcard entries: *.example.com matches any subdomain of example.com but not the base domain itself. Plain entries (e.g. example.com) match that exact domain only. Add both to exclude a domain and all its subdomains.
• Excluded domains are now honoured by the sitewide JavaScript scan, not just PHP content processing. Previously, links excluded in settings could still be flagged as external by the JS scan on navigation menus, footers, and widgets.
• All four class settings (Suppress Icon Class, Suppress Icon Wrapper Class, Force External Class, Force External Wrapper Class) now accept comma-separated values, allowing multiple class names per setting.

Bug Fixes

• Excluded domains with target="_blank" in scope=both mode no longer incorrectly show a modal or redirect warning when processed by the JavaScript scanner. ARIA attributes are still applied for screen reader accessibility.

1.3.0 (1 May 2026) Version 1.3.0 Release Post New Features

• Sitewide link processing: JavaScript now scans the full rendered page on load and applies warnings to links in navigation menus, footers, sidebars, widgets, and any other theme output — not just post content. All four CSS class rules (wzlw-force-external, wzlw-force-external-wrapper, wzlw-no-icon, wzlw-no-icon-wrapper) work everywhere on the page.

Bug Fixes

• Links inside wzlw-no-icon-wrapper now correctly receive data-wzlw-* attributes so the redirect/modal warning still fires; only the visual icon is suppressed.

1.2.0 (14 April 2026) Version 1.2.0 Release Post New Features

• Add wzlw-force-external / wzlw-force-external-wrapper class support to force links to be treated as external regardless of automatic detection. Both class names are configurable under Settings > Advanced.
• The wzlw-no-icon and wzlw-no-icon-wrapper class names are now configurable under Settings > Advanced.

Security

• Redirect endpoint now requires an HMAC signature on every URL. Unsigned or tampered URLs are rejected, preventing open-redirect abuse.

Bug Fixes

• Redirect URLs with HMAC signatures were broken due to double-encoding of the & separator in HTML output.
• Redundant URL encoding in get_redirect_url() caused malformed redirect URLs.
• Same-host check now normalises hostnames before comparison, so variants like EXAMPLE.COM or example.com. are treated as internal.
• Excluded domains now match correctly when entered with a scheme or trailing path.

1.1.0 (14 March 2026) Version 1.1.0 Release Post New Features

• Add wzlw-no-icon-wrapper class support — add it to any wrapper element to exclude all links inside it from visual indicators.

Improvements

• Enhanced modal accessibility: background content is now hidden from screen readers when the modal is open, URL display includes a screen reader label, buttons have fallback accessible names, and the Continue button announces "opens in a new window" for target="_blank" links.

1.0.0 (7 March 2026) Version 1.0.0 Release Post

• Initial release.