diff --git a/Gemfile b/Gemfile
index fe9faf36a45..1319c514388 100644
--- a/Gemfile
+++ b/Gemfile
@@ -50,7 +50,7 @@ gem 'redis-namespace'
 
 gem 'active_model_serializers', '~> 0.8.3'
 
-gem 'onebox', '1.9.17'
+gem 'onebox', '1.9.18'
 
 gem 'http_accept_language', '~>2.0.5', require: false
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 89de47af239..68169948e90 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -245,7 +245,7 @@ GEM
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
-    onebox (1.9.17)
+    onebox (1.9.18)
       htmlentities (~> 4.3)
       moneta (~> 1.0)
       multi_json (~> 1.11)
@@ -501,7 +501,7 @@ DEPENDENCIES
   omniauth-oauth2
   omniauth-openid
   omniauth-twitter
-  onebox (= 1.9.17)
+  onebox (= 1.9.18)
   openid-redis-store
   parallel_tests
   pg
diff --git a/app/assets/javascripts/discourse/lib/render-topic-featured-link.js.es6 b/app/assets/javascripts/discourse/lib/render-topic-featured-link.js.es6
index 7fa722a28d8..bcf13b115a8 100644
--- a/app/assets/javascripts/discourse/lib/render-topic-featured-link.js.es6
+++ b/app/assets/javascripts/discourse/lib/render-topic-featured-link.js.es6
@@ -21,7 +21,7 @@ export function extractLinkMeta(topic) {
     target: target,
     href,
     domain: topic.get("featured_link_root_domain"),
-    rel: "nofollow"
+    rel: "nofollow ugc"
   };
 
   if (_decorators.length) {
diff --git a/app/assets/javascripts/discourse/templates/components/image-uploader.hbs b/app/assets/javascripts/discourse/templates/components/image-uploader.hbs
index 4c9b410290d..24f33864fec 100644
--- a/app/assets/javascripts/discourse/templates/components/image-uploader.hbs
+++ b/app/assets/javascripts/discourse/templates/components/image-uploader.hbs
@@ -28,7 +28,7 @@
     <a class="lightbox"
        href={{imageCDNURL}}
        title={{imageFilename}}
-       rel="nofollow noopener">
+       rel="nofollow ugc noopener">
 
       <div class="meta">
         <span class="informations">
diff --git a/app/assets/javascripts/discourse/templates/components/user-card-contents.hbs b/app/assets/javascripts/discourse/templates/components/user-card-contents.hbs
index de207170d2d..96ec1845a50 100644
--- a/app/assets/javascripts/discourse/templates/components/user-card-contents.hbs
+++ b/app/assets/javascripts/discourse/templates/components/user-card-contents.hbs
@@ -151,7 +151,7 @@
               <span class='website-name'>
                 {{d-icon "globe"}}
                 {{#if linkWebsite}}
-                  <a href="{{user.website}}" rel={{unless removeNoFollow 'nofollow noopener'}}
+                  <a href="{{user.website}}" rel={{unless removeNoFollow 'nofollow ugc noopener'}}
                    target="_blank">{{user.website_name}}</a>
                 {{else}}
                   <span title={{user.website}}>{{user.website_name}}</span>
diff --git a/app/assets/javascripts/discourse/templates/user.hbs b/app/assets/javascripts/discourse/templates/user.hbs
index 8fbc7b440f8..43250c97d0d 100644
--- a/app/assets/javascripts/discourse/templates/user.hbs
+++ b/app/assets/javascripts/discourse/templates/user.hbs
@@ -98,7 +98,7 @@
             <div class="user-profile-website">
               {{d-icon "globe"}}
               {{#if linkWebsite}}
-                <a href={{model.website}} rel={{unless removeNoFollow 'nofollow noopener'}} target="_blank">{{model.website_name}}</a>
+                <a href={{model.website}} rel={{unless removeNoFollow 'nofollow ugc noopener'}} target="_blank">{{model.website_name}}</a>
               {{else}}
                 <span title={{model.website}}>{{model.website_name}}</span>
               {{/if}}
diff --git a/app/assets/javascripts/discourse/templates/user/summary.hbs b/app/assets/javascripts/discourse/templates/user/summary.hbs
index c094329ecad..e751d80e969 100644
--- a/app/assets/javascripts/discourse/templates/user/summary.hbs
+++ b/app/assets/javascripts/discourse/templates/user/summary.hbs
@@ -80,7 +80,7 @@
               <a class='domain'
                  href='{{unbound link.url}}'
                  title='{{unbound link.title}}'
-                 rel='{{unless user.removeNoFollow 'nofollow noopener'}}'
+                 rel='{{unless user.removeNoFollow 'nofollow ugc noopener'}}'
                  target='_blank'>
                 {{shorten-url link.url}}
               </a>
diff --git a/app/assets/javascripts/discourse/widgets/topic-map.js.es6 b/app/assets/javascripts/discourse/widgets/topic-map.js.es6
index 99d3d3cee77..fcd719fcb9c 100644
--- a/app/assets/javascripts/discourse/widgets/topic-map.js.es6
+++ b/app/assets/javascripts/discourse/widgets/topic-map.js.es6
@@ -247,7 +247,7 @@ createWidget("topic-map-link", {
       "data-user-id": attrs.user_id,
       "data-ignore-post-id": "true",
       title: attrs.url,
-      rel: "nofollow noopener"
+      rel: "nofollow ugc noopener"
     };
   },
 
diff --git a/app/assets/javascripts/pretty-text/white-lister.js.es6 b/app/assets/javascripts/pretty-text/white-lister.js.es6
index 5ea109398bb..5fd4f3cb277 100644
--- a/app/assets/javascripts/pretty-text/white-lister.js.es6
+++ b/app/assets/javascripts/pretty-text/white-lister.js.es6
@@ -126,6 +126,7 @@ const DEFAULT_LIST = [
   "a[data-bbcode]",
   "a[name]",
   "a[rel=nofollow]",
+  "a[rel=ugc]",
   "a[target=_blank]",
   "a[title]",
   "abbr[title]",