diff --git a/files/routes/posts.py b/files/routes/posts.py
index 803105c799..8d94a46556 100644
--- a/files/routes/posts.py
+++ b/files/routes/posts.py
@@ -857,7 +857,9 @@ def submit_post(v, sub=None):
 			reason = f"Remove the {domain_obj.domain} link from your post and try again. {domain_obj.reason}"
 			return error(reason)
 		elif "twitter.com" == domain:
-			try: embed = requests.get("https://publish.twitter.com/oembed", params={"url":url, "omit_script":"t"}, timeout=5).json()["html"]
+			try:
+				embed = requests.get("https://publish.twitter.com/oembed", params={"url":url, "omit_script":"t"}, timeout=5).json()["html"]
+				embed = embed.replace('<a href', '<a rel="nofollow noopener noreferrer" href')
 			except: pass
 		elif url.startswith('https://youtube.com/watch?v='):
 			url = unquote(url).replace('?t', '&t')