diff --git a/src/components/button/__snapshots__/button.test.js.snap b/src/components/button/__snapshots__/button.test.js.snap
index 7a438cdc76b5..ce9827cec034 100644
--- a/src/components/button/__snapshots__/button.test.js.snap
+++ b/src/components/button/__snapshots__/button.test.js.snap
@@ -95,6 +95,21 @@ exports[`EuiButton props fill is rendered 1`] = `
 </button>
 `;
 
+exports[`EuiButton props href secures the rel attribute when the target is _blank 1`] = `
+<a
+  class="euiButton euiButton--primary"
+  href="#"
+  rel="noopener noreferrer"
+  target="_blank"
+>
+  <span
+    class="euiButton__content"
+  >
+    <span />
+  </span>
+</a>
+`;
+
 exports[`EuiButton props iconSide left is rendered 1`] = `
 <button
   class="euiButton euiButton--primary"
diff --git a/src/components/button/button.js b/src/components/button/button.js
index 37fbaae32077..c9e64ae4b3cd 100644
--- a/src/components/button/button.js
+++ b/src/components/button/button.js
@@ -2,7 +2,10 @@ import React from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 
-import checkHrefAndOnClick from '../../services/prop_types/check_href_and_onclick';
+import {
+  checkHrefAndOnClick,
+  getSecureRelForTarget,
+} from '../../services';
 
 import {
   ICON_TYPES,
@@ -43,7 +46,10 @@ export const EuiButton = ({
   fill,
   isDisabled,
   href,
+  target,
+  rel,
   onClick,
+  type,
   ...rest
 }) => {
 
@@ -73,10 +79,14 @@ export const EuiButton = ({
   }
 
   if (href) {
+    const secureRel = getSecureRelForTarget(target, rel);
+
     return (
       <a
         className={classes}
         href={href}
+        target={target}
+        rel={secureRel}
         {...rest}
       >
         <span className="euiButton__content">
@@ -91,6 +101,7 @@ export const EuiButton = ({
         disabled={isDisabled}
         className={classes}
         onClick={onClick}
+        type={type}
         {...rest}
       >
         <span className="euiButton__content">
@@ -124,6 +135,8 @@ EuiButton.propTypes = {
   size: PropTypes.oneOf(SIZES),
   isDisabled: PropTypes.bool,
   href: checkHrefAndOnClick,
+  target: PropTypes.string,
+  rel: PropTypes.string,
   onClick: PropTypes.func,
 
   /**
diff --git a/src/components/button/button.test.js b/src/components/button/button.test.js
index 21dc4d70b3d1..c73b2b9cc23d 100644
--- a/src/components/button/button.test.js
+++ b/src/components/button/button.test.js
@@ -95,5 +95,16 @@ describe('EuiButton', () => {
         });
       });
     });
+
+    describe('href', () => {
+      it('secures the rel attribute when the target is _blank', () => {
+        const component = render(
+          <EuiButton href="#" target="_blank" />
+        );
+
+        expect(component)
+          .toMatchSnapshot();
+      });
+    });
   });
 });
diff --git a/src/components/button/button_empty/__snapshots__/button_empty.test.js.snap b/src/components/button/button_empty/__snapshots__/button_empty.test.js.snap
index 0efdcabf2c8d..f92434b5c659 100644
--- a/src/components/button/button_empty/__snapshots__/button_empty.test.js.snap
+++ b/src/components/button/button_empty/__snapshots__/button_empty.test.js.snap
@@ -108,6 +108,21 @@ exports[`EuiButtonEmpty props flush right is rendered 1`] = `
 </button>
 `;
 
+exports[`EuiButtonEmpty props href secures the rel attribute when the target is _blank 1`] = `
+<a
+  class="euiButtonEmpty euiButtonEmpty--primary"
+  href="#"
+  rel="noopener noreferrer"
+  target="_blank"
+>
+  <span
+    class="euiButtonEmpty__content"
+  >
+    <span />
+  </span>
+</a>
+`;
+
 exports[`EuiButtonEmpty props iconSide left is rendered 1`] = `
 <button
   class="euiButtonEmpty euiButtonEmpty--primary"
diff --git a/src/components/button/button_empty/button_empty.js b/src/components/button/button_empty/button_empty.js
index 0bbcf1f4531c..63e16ea6968f 100644
--- a/src/components/button/button_empty/button_empty.js
+++ b/src/components/button/button_empty/button_empty.js
@@ -2,7 +2,10 @@ import React from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 
-import checkHrefAndOnClick from '../../../services/prop_types/check_href_and_onclick';
+import {
+  checkHrefAndOnClick,
+  getSecureRelForTarget,
+} from '../../../services';
 
 import {
   ICON_TYPES,
@@ -51,7 +54,10 @@ export const EuiButtonEmpty = ({
   flush,
   isDisabled,
   href,
+  target,
+  rel,
   onClick,
+  type,
   ...rest
 }) => {
 
@@ -79,10 +85,14 @@ export const EuiButtonEmpty = ({
   }
 
   if (href) {
+    const secureRel = getSecureRelForTarget(target, rel);
+
     return (
       <a
         className={classes}
         href={href}
+        target={target}
+        rel={secureRel}
         {...rest}
       >
         <span className="euiButtonEmpty__content">
@@ -97,6 +107,7 @@ export const EuiButtonEmpty = ({
         disabled={isDisabled}
         className={classes}
         onClick={onClick}
+        type={type}
         {...rest}
       >
         <span className="euiButtonEmpty__content">
@@ -118,7 +129,10 @@ EuiButtonEmpty.propTypes = {
   flush: PropTypes.oneOf(FLUSH_TYPES),
   isDisabled: PropTypes.bool,
   href: checkHrefAndOnClick,
+  target: PropTypes.string,
+  rel: PropTypes.string,
   onClick: PropTypes.func,
+  type: PropTypes.string,
 };
 
 EuiButtonEmpty.defaultProps = {
diff --git a/src/components/button/button_empty/button_empty.test.js b/src/components/button/button_empty/button_empty.test.js
index 71de955c4217..37e62aabdf8c 100644
--- a/src/components/button/button_empty/button_empty.test.js
+++ b/src/components/button/button_empty/button_empty.test.js
@@ -98,5 +98,16 @@ describe('EuiButtonEmpty', () => {
         });
       });
     });
+
+    describe('href', () => {
+      it('secures the rel attribute when the target is _blank', () => {
+        const component = render(
+          <EuiButtonEmpty href="#" target="_blank" />
+        );
+
+        expect(component)
+          .toMatchSnapshot();
+      });
+    });
   });
 });
diff --git a/src/components/button/button_icon/__snapshots__/button_icon.test.js.snap b/src/components/button/button_icon/__snapshots__/button_icon.test.js.snap
index 9e36e223cf8f..ced817757e88 100644
--- a/src/components/button/button_icon/__snapshots__/button_icon.test.js.snap
+++ b/src/components/button/button_icon/__snapshots__/button_icon.test.js.snap
@@ -49,6 +49,16 @@ exports[`EuiButtonIcon props color text is rendered 1`] = `
 />
 `;
 
+exports[`EuiButtonIcon props href secures the rel attribute when the target is _blank 1`] = `
+<a
+  aria-label="button"
+  class="euiButtonIcon euiButtonIcon--primary"
+  href="#"
+  rel="noopener noreferrer"
+  target="_blank"
+/>
+`;
+
 exports[`EuiButtonIcon props iconType is rendered 1`] = `
 <button
   aria-label="button"
diff --git a/src/components/button/button_icon/button_icon.js b/src/components/button/button_icon/button_icon.js
index ac4373a1641b..8c0c2c30a3ab 100644
--- a/src/components/button/button_icon/button_icon.js
+++ b/src/components/button/button_icon/button_icon.js
@@ -2,7 +2,10 @@ import React from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 
-import checkHrefAndOnClick from '../../../services/prop_types/check_href_and_onclick';
+import {
+  checkHrefAndOnClick,
+  getSecureRelForTarget,
+} from '../../../services';
 
 import {
   ICON_TYPES,
@@ -41,6 +44,9 @@ export const EuiButtonIcon = ({
   isDisabled,
   href,
   onClick,
+  type,
+  target,
+  rel,
   ...rest
 }) => {
 
@@ -65,10 +71,14 @@ export const EuiButtonIcon = ({
   }
 
   if (href) {
+    const secureRel = getSecureRelForTarget(target, rel);
+
     return (
       <a
         className={classes}
         href={href}
+        target={target}
+        rel={secureRel}
         {...rest}
       >
         {buttonIcon}
@@ -80,6 +90,7 @@ export const EuiButtonIcon = ({
         disabled={isDisabled}
         className={classes}
         onClick={onClick}
+        type={type}
         {...rest}
       >
         {buttonIcon}
@@ -96,7 +107,10 @@ EuiButtonIcon.propTypes = {
   isDisabled: PropTypes.bool,
   'aria-label': accessibleButtonIcon,
   href: checkHrefAndOnClick,
+  target: PropTypes.string,
+  rel: PropTypes.string,
   onClick: PropTypes.func,
+  type: PropTypes.string,
 };
 
 EuiButtonIcon.defaultProps = {
diff --git a/src/components/button/button_icon/button_icon.test.js b/src/components/button/button_icon/button_icon.test.js
index d8b0214b47f4..352fc67ce97a 100644
--- a/src/components/button/button_icon/button_icon.test.js
+++ b/src/components/button/button_icon/button_icon.test.js
@@ -49,5 +49,16 @@ describe('EuiButtonIcon', () => {
         });
       });
     });
+
+    describe('href', () => {
+      it('secures the rel attribute when the target is _blank', () => {
+        const component = render(
+          <EuiButtonIcon aria-label="button" href="#" target="_blank" />
+        );
+
+        expect(component)
+          .toMatchSnapshot();
+      });
+    });
   });
 });
diff --git a/src/components/link/__snapshots__/link.test.js.snap b/src/components/link/__snapshots__/link.test.js.snap
index b6a0d5242bbf..0dfcc20f384d 100644
--- a/src/components/link/__snapshots__/link.test.js.snap
+++ b/src/components/link/__snapshots__/link.test.js.snap
@@ -6,6 +6,7 @@ exports[`EuiLink is rendered 1`] = `
   class="euiLink euiLink--primary testClass1 testClass2"
   data-test-subj="test subject string"
   href="#"
+  rel="noopener noreferrer"
   target="_blank"
 />
 `;
diff --git a/src/components/link/link.js b/src/components/link/link.js
index 9a3a3af5c389..209eef8da13c 100644
--- a/src/components/link/link.js
+++ b/src/components/link/link.js
@@ -2,6 +2,11 @@ import React from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 
+import {
+  checkHrefAndOnClick,
+  getSecureRelForTarget,
+} from '../../services';
+
 const colorsToClassNameMap = {
   'primary': 'euiLink--primary',
   'subdued': 'euiLink--subdued',
@@ -16,10 +21,13 @@ export const COLORS = Object.keys(colorsToClassNameMap);
 
 export const EuiLink = ({
   children,
-  type,
   color,
   className,
+  href,
+  target,
+  rel,
   onClick,
+  type,
   ...rest
 }) => {
   const classes = classNames('euiLink', colorsToClassNameMap[color], className);
@@ -27,9 +35,9 @@ export const EuiLink = ({
   if (onClick) {
     return (
       <button
-        type={type}
         className={classes}
         onClick={onClick}
+        type={type}
         {...rest}
       >
         {children}
@@ -37,9 +45,14 @@ export const EuiLink = ({
     );
   }
 
+  const secureRel = getSecureRelForTarget(target, rel);
+
   return (
     <a
       className={classes}
+      href={href}
+      target={target}
+      rel={secureRel}
       {...rest}
     >
       {children}
@@ -50,9 +63,12 @@ export const EuiLink = ({
 EuiLink.propTypes = {
   children: PropTypes.node,
   className: PropTypes.string,
+  href: checkHrefAndOnClick,
+  target: PropTypes.string,
+  rel: PropTypes.string,
   onClick: PropTypes.func,
-  color: PropTypes.oneOf(COLORS),
   type: PropTypes.string,
+  color: PropTypes.oneOf(COLORS),
 };
 
 EuiLink.defaultProps = {
diff --git a/src/services/index.js b/src/services/index.js
index 85997597564a..c51a5a0817df 100644
--- a/src/services/index.js
+++ b/src/services/index.js
@@ -23,6 +23,14 @@ export {
   Pager,
 } from './paging';
 
+export {
+  checkHrefAndOnClick,
+} from './prop_types';
+
+export {
+  getSecureRelForTarget,
+} from './security';
+
 export {
   SortableProperties,
 } from './sort';
diff --git a/src/services/prop_types/check_href_and_onclick.js b/src/services/prop_types/check_href_and_onclick.js
index b655947cff43..62d873d835e4 100644
--- a/src/services/prop_types/check_href_and_onclick.js
+++ b/src/services/prop_types/check_href_and_onclick.js
@@ -1,4 +1,4 @@
-export default function checkHrefAndOnClick(props, propName, componentName) {
+export function checkHrefAndOnClick(props, propName, componentName) {
   if (props.href && props.onClick) {
     throw new Error(
       `${componentName} must either specify an href property (if it should be a link) ` +
diff --git a/src/services/prop_types/index.js b/src/services/prop_types/index.js
new file mode 100644
index 000000000000..7469b983400e
--- /dev/null
+++ b/src/services/prop_types/index.js
@@ -0,0 +1 @@
+export { checkHrefAndOnClick } from './check_href_and_onclick';
diff --git a/src/services/security/get_secure_rel_for_target.js b/src/services/security/get_secure_rel_for_target.js
new file mode 100644
index 000000000000..e688bcf678dd
--- /dev/null
+++ b/src/services/security/get_secure_rel_for_target.js
@@ -0,0 +1,30 @@
+/**
+ * Secures outbound links. See https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/
+ * for more info.
+ */
+export const getSecureRelForTarget = (target, rel) => {
+  if (!target) {
+    return rel;
+  }
+
+  if (!target.includes('_blank')) {
+    return rel;
+  }
+
+  if (!rel) {
+    return 'noopener noreferrer';
+  }
+
+  let secureRel = rel;
+
+  if (!secureRel.includes('noopener')) {
+    secureRel = `${secureRel} noopener`;
+  }
+
+
+  if (!secureRel.includes('noreferrer')) {
+    secureRel = `${secureRel} noreferrer`;
+  }
+
+  return secureRel.trim();
+};
diff --git a/src/services/security/get_secure_rel_for_target.test.js b/src/services/security/get_secure_rel_for_target.test.js
new file mode 100644
index 000000000000..9a2415fd1f8d
--- /dev/null
+++ b/src/services/security/get_secure_rel_for_target.test.js
@@ -0,0 +1,37 @@
+import {
+  getSecureRelForTarget,
+} from './get_secure_rel_for_target';
+
+describe('getSecureRelForTarget', () => {
+  describe('returns rel', () => {
+    test('when target is not _blank', () => {
+      expect(getSecureRelForTarget('_self', 'hello')).toBe('hello');
+    });
+
+    test('when target is undefined', () => {
+      expect(getSecureRelForTarget('_self', 'hello')).toBe('hello');
+    });
+  });
+
+  describe('returns noopener noreferrer', () => {
+    test('when rel contains neither', () => {
+      expect(getSecureRelForTarget('_blank')).toBe('noopener noreferrer');
+    });
+
+    test('when rel contains both', () => {
+      expect(getSecureRelForTarget('_blank', 'noopener noreferrer')).toBe('noopener noreferrer');
+    });
+
+    test('when rel contains noopener', () => {
+      expect(getSecureRelForTarget('_blank', 'noopener')).toBe('noopener noreferrer');
+    });
+
+    test('when rel contains noreferrer', () => {
+      expect(getSecureRelForTarget('_blank', 'noreferrer')).toBe('noreferrer noopener');
+    });
+
+    test('including the original rel value', () => {
+      expect(getSecureRelForTarget('_blank', 'nofollow')).toBe('nofollow noopener noreferrer');
+    });
+  });
+});
diff --git a/src/services/security/index.js b/src/services/security/index.js
new file mode 100644
index 000000000000..1e5c8b8293a3
--- /dev/null
+++ b/src/services/security/index.js
@@ -0,0 +1 @@
+export { getSecureRelForTarget } from './get_secure_rel_for_target.js';