diff --git a/plugins/embed-optimizer/helper.php b/plugins/embed-optimizer/helper.php
index 8f6d3ec937..944ba0674b 100644
--- a/plugins/embed-optimizer/helper.php
+++ b/plugins/embed-optimizer/helper.php
@@ -404,7 +404,7 @@ function embed_optimizer_print_row_meta_install_notice( string $plugin_file ): v
 			$details_url = __( 'https://wordpress.org/plugins/', 'default' ) . $od_plugin_slug . '/';
 
 			$link_start_tag = sprintf(
-				'<a href="%s" aria-label="%s" target="_blank">',
+				'<a href="%s" aria-label="%s" target="_blank" rel="noopener">',
 				esc_url( $details_url ),
 				esc_attr( $aria_label )
 			);
diff --git a/plugins/optimization-detective/helper.php b/plugins/optimization-detective/helper.php
index 09866de406..b8b73d8f65 100644
--- a/plugins/optimization-detective/helper.php
+++ b/plugins/optimization-detective/helper.php
@@ -344,7 +344,7 @@ function od_render_documentation_links(): void {
 	echo wp_kses_post(
 		sprintf(
 			/* translators: 1: project documentation URL, 2: introduction URL, 3: code reference URL, 4: extensions list URL. */
-			__( 'The <a href="%1$s" target="_blank">project documentation</a> is available on GitHub, including an <a href="%2$s" target="_blank">introduction</a>, <a href="%3$s" target="_blank">code reference</a>, and a list of <a href="%4$s" target="_blank">extensions</a>.', 'optimization-detective' ),
+			__( 'The <a href="%1$s" target="_blank" rel="noopener">project documentation</a> is available on GitHub, including an <a href="%2$s" target="_blank" rel="noopener">introduction</a>, <a href="%3$s" target="_blank" rel="noopener">code reference</a>, and a list of <a href="%4$s" target="_blank" rel="noopener">extensions</a>.', 'optimization-detective' ),
 			esc_url( 'https://github.com/WordPress/performance/tree/trunk/plugins/optimization-detective/docs' ),
 			esc_url( 'https://github.com/WordPress/performance/blob/trunk/plugins/optimization-detective/docs/introduction.md' ),
 			esc_url( 'https://github.com/WordPress/performance/blob/trunk/plugins/optimization-detective/docs/hooks.md' ),
diff --git a/plugins/performance-lab/includes/admin/plugins.php b/plugins/performance-lab/includes/admin/plugins.php
index 0b86db977e..9f25767c3d 100644
--- a/plugins/performance-lab/includes/admin/plugins.php
+++ b/plugins/performance-lab/includes/admin/plugins.php
@@ -219,7 +219,7 @@ static function ( string $file ) {
 			}
 
 			$plugin_list     .= sprintf(
-				'<li><a target="_blank" href="%s"><code>%s</code></a> %s</li>',
+				'<li><a target="_blank" rel="noopener" href="%s"><code>%s</code></a> %s</li>',
 				esc_url( trailingslashit( __( 'https://wordpress.org/plugins/', 'default' ) . $plugin_slug ) ),
 				esc_html( $plugin_slug ),
 				esc_html( $status )
@@ -517,7 +517,9 @@ function perflab_render_plugin_card( array $plugin_data ): void {
 
 	if ( $availability['activated'] ) {
 		$action_links[] = sprintf(
-			'<button type="button" class="button button-disabled" disabled="disabled">%s</button>',
+			'<button type="button" class="button button-disabled" disabled="disabled" aria-label="%s">%s</button>',
+			/* translators: %s: Plugin name. */
+			esc_attr( sprintf( __( '%s is active', 'performance-lab' ), $name ) ),
 			esc_html( _x( 'Active', 'plugin', 'default' ) )
 		);
 	} elseif (
@@ -538,15 +540,19 @@ function perflab_render_plugin_card( array $plugin_data ): void {
 		);
 
 		$action_links[] = sprintf(
-			'<a class="button perflab-install-active-plugin" href="%s" data-plugin-slug="%s">%s</a>',
+			'<a class="button perflab-install-active-plugin" href="%s" data-plugin-slug="%s" aria-label="%s">%s</a>',
 			esc_url( $url ),
 			esc_attr( $plugin_data['slug'] ),
+			/* translators: %s: Plugin name. */
+			esc_attr( sprintf( __( 'Activate %s', 'performance-lab' ), $name ) ),
 			esc_html__( 'Activate', 'default' )
 		);
 	} else {
 		$explanation    = $availability['can_install'] ? _x( 'Cannot Activate', 'plugin', 'default' ) : _x( 'Cannot Install', 'plugin', 'default' );
 		$action_links[] = sprintf(
-			'<button type="button" class="button button-disabled" disabled="disabled">%s</button>',
+			'<button type="button" class="button button-disabled" disabled="disabled" aria-label="%s">%s</button>',
+			/* translators: 1: Plugin name, 2: Status explanation. */
+			esc_attr( sprintf( __( '%1$s: %2$s', 'performance-lab' ), $name, $explanation ) ),
 			esc_html( $explanation )
 		);
 	}
@@ -575,7 +581,7 @@ function perflab_render_plugin_card( array $plugin_data ): void {
 			esc_html__( 'Learn more', 'performance-lab' )
 		);
 	} else {
-		$title_link_attr = ' target="_blank"';
+		$title_link_attr = ' target="_blank" rel="noopener"';
 
 		/* translators: %s: Plugin name. */
 		$aria_label = sprintf( __( 'Visit plugin site for %s', 'default' ), $name );
@@ -583,7 +589,7 @@ function perflab_render_plugin_card( array $plugin_data ): void {
 		$details_link = __( 'https://wordpress.org/plugins/', 'default' ) . $plugin_data['slug'] . '/';
 
 		$action_links[] = sprintf(
-			'<a href="%s" aria-label="%s" target="_blank">%s</a>',
+			'<a href="%s" aria-label="%s" target="_blank" rel="noopener">%s</a>',
 			esc_url( $details_link ),
 			esc_attr( $aria_label ),
 			esc_html__( 'Visit plugin site', 'default' )
@@ -593,8 +599,13 @@ function perflab_render_plugin_card( array $plugin_data ): void {
 	if ( $availability['activated'] ) {
 		$settings_url = perflab_get_plugin_settings_url( $plugin_data['slug'] );
 		if ( null !== $settings_url ) {
-			/* translators: %s is the settings URL */
-			$action_links[] = sprintf( '<a href="%s">%s</a>', esc_url( $settings_url ), esc_html__( 'Settings', 'performance-lab' ) );
+			$action_links[] = sprintf(
+				'<a href="%s" aria-label="%s">%s</a>',
+				esc_url( $settings_url ),
+				/* translators: %s: Plugin name. */
+				esc_attr( sprintf( __( 'Settings for %s', 'performance-lab' ), $name ) ),
+				esc_html__( 'Settings', 'performance-lab' )
+			);
 		}
 	}
 	?>
diff --git a/plugins/performance-lab/includes/site-health/audit-autoloaded-options/helper.php b/plugins/performance-lab/includes/site-health/audit-autoloaded-options/helper.php
index 2023c9de36..0e3df72571 100644
--- a/plugins/performance-lab/includes/site-health/audit-autoloaded-options/helper.php
+++ b/plugins/performance-lab/includes/site-health/audit-autoloaded-options/helper.php
@@ -78,7 +78,7 @@ function perflab_aao_autoloaded_options_test(): array {
 
 	$result['actions'] = sprintf(
 		/* translators: 1: HelpHub URL. 2: Link description. */
-		'<p><a target="_blank" href="%1$s">%2$s</a></p>',
+		'<p><a target="_blank" rel="noopener" href="%1$s">%2$s</a></p>',
 		esc_url( __( 'https://wordpress.org/support/article/optimization/#autoloaded-options', 'performance-lab' ) ),
 		__( 'More info about performance optimization', 'performance-lab' )
 	);
diff --git a/plugins/performance-lab/includes/site-health/audit-enqueued-assets/helper.php b/plugins/performance-lab/includes/site-health/audit-enqueued-assets/helper.php
index 9c441c25d8..1ef767efc2 100644
--- a/plugins/performance-lab/includes/site-health/audit-enqueued-assets/helper.php
+++ b/plugins/performance-lab/includes/site-health/audit-enqueued-assets/helper.php
@@ -200,7 +200,7 @@ function perflab_aea_enqueued_blocking_assets_test(): array {
 		$result['status']  = 'recommended';
 		$result['actions'] = sprintf(
 			/* translators: 1: HelpHub URL. 2: Link description. 3.URL to clean cache. 4. Clean Cache text. */
-			'<p><a target="_blank" href="%1$s">%2$s</a></p>',
+			'<p><a target="_blank" rel="noopener" href="%1$s">%2$s</a></p>',
 			esc_url( __( 'https://wordpress.org/support/article/optimization/', 'performance-lab' ) ),
 			__( 'More info about performance optimization', 'performance-lab' )
 		);
diff --git a/plugins/performance-lab/includes/site-health/webp-support/helper.php b/plugins/performance-lab/includes/site-health/webp-support/helper.php
index 72015d6922..23ce651659 100644
--- a/plugins/performance-lab/includes/site-health/webp-support/helper.php
+++ b/plugins/performance-lab/includes/site-health/webp-support/helper.php
@@ -45,7 +45,7 @@ function perflab_webp_uploads_check_webp_supported_test(): array {
 		$result['actions'] = sprintf(
 			'<p>%s</p>',
 			/* translators: Accessibility text. */
-			__( 'WebP support can only be enabled by your hosting provider. Please contact them to inquire about switching to a plan that supports WebP, or consider switching to a host that offers this capability. <a href="https://make.wordpress.org/hosting/2022/03/30/wordpress-hosting-and-webp-support/" target="_blank">Learn more</a> about WebP image support for WordPress sites.', 'performance-lab' )
+			__( 'WebP support can only be enabled by your hosting provider. Please contact them to inquire about switching to a plan that supports WebP, or consider switching to a host that offers this capability. <a href="https://make.wordpress.org/hosting/2022/03/30/wordpress-hosting-and-webp-support/" target="_blank" rel="noopener">Learn more</a> about WebP image support for WordPress sites.', 'performance-lab' )
 		);
 	}
 
diff --git a/plugins/speculation-rules/settings.php b/plugins/speculation-rules/settings.php
index 8f2ada9961..d647e3d8b5 100644
--- a/plugins/speculation-rules/settings.php
+++ b/plugins/speculation-rules/settings.php
@@ -73,7 +73,7 @@ function plsr_get_field_description( string $field ): string {
 		'eagerness'      => __( 'The eagerness setting defines the heuristics based on which the loading is triggered. "Eager" will have the minimum delay to start speculative loads, "Conservative" increases the chance that only URLs the user actually navigates to are loaded.', 'speculation-rules' ),
 		'authentication' => sprintf(
 			/* translators: %s: URL to persistent object cache documentation */
-			__( 'Only unauthenticated pages are typically served from cache. So in order to reduce load on the server, speculative loading is not enabled by default for logged-in users. If your server can handle the additional load, you can opt in to speculative loading for all logged-in users or just administrator users only. For optimal performance, regardless of the user authentication status but <em>especially</em> when logged-in, ensure you have a <a href="%s" target="_blank">persistent object cache</a> configured. This only applies to pages on the frontend; admin screens remain excluded.', 'speculation-rules' ),
+			__( 'Only unauthenticated pages are typically served from cache. So in order to reduce load on the server, speculative loading is not enabled by default for logged-in users. If your server can handle the additional load, you can opt in to speculative loading for all logged-in users or just administrator users only. For optimal performance, regardless of the user authentication status but <em>especially</em> when logged-in, ensure you have a <a href="%s" target="_blank" rel="noopener">persistent object cache</a> configured. This only applies to pages on the frontend; admin screens remain excluded.', 'speculation-rules' ),
 			'https://developer.wordpress.org/advanced-administration/performance/optimization/#object-caching'
 		),
 	);
@@ -316,13 +316,14 @@ function plsr_render_settings_field( array $args ): void {
 					echo wp_kses(
 						sprintf(
 							/* translators: %s: URL to persistent object cache documentation */
-							__( 'Enabling speculative loading for authenticated users may significantly increase the server load. Consider setting up a <a href="%s" target="_blank">persistent object cache</a> before enabling this feature for logged-in users.', 'speculation-rules' ),
+							__( 'Enabling speculative loading for authenticated users may significantly increase the server load. Consider setting up a <a href="%s" target="_blank" rel="noopener">persistent object cache</a> before enabling this feature for logged-in users.', 'speculation-rules' ),
 							'https://developer.wordpress.org/advanced-administration/performance/optimization/#object-caching'
 						),
 						array(
 							'a' => array(
 								'href'   => array(),
 								'target' => array(),
+								'rel'    => array(),
 							),
 						)
 					);
@@ -359,6 +360,7 @@ function plsr_render_settings_field( array $args ): void {
 					'a'  => array(
 						'href'   => array(),
 						'target' => array(),
+						'rel'    => array(),
 					),
 					'em' => array(),
 				)