diff --git a/core/modules/node/src/Controller/NodePreviewController.php b/core/modules/node/src/Controller/NodePreviewController.php
index 2134abe..ecf41ca 100644
--- a/core/modules/node/src/Controller/NodePreviewController.php
+++ b/core/modules/node/src/Controller/NodePreviewController.php
@@ -32,6 +32,11 @@ public function view(EntityInterface $node_preview, $view_mode_id = 'full', $lan
     unset($build['nodes']['#cache']);
 
     foreach ($node_preview->uriRelationships() as $rel) {
+      // Only add links the user is allowed to visit.
+      if (!$node_preview->urlInfo($rel)->access()) {
+        continue;
+      }
+
       // Set the node path as the canonical URL to prevent duplicate content.
       $build['#attached']['html_head_link'][] = array(
         array(
diff --git a/core/modules/taxonomy/taxonomy.module b/core/modules/taxonomy/taxonomy.module
index 95f6a6b..a23fa31 100644
--- a/core/modules/taxonomy/taxonomy.module
+++ b/core/modules/taxonomy/taxonomy.module
@@ -110,6 +110,11 @@ function taxonomy_page_attachments_alter(array &$page) {
   $route_match = \Drupal::routeMatch();
   if ($route_match->getRouteName() == 'entity.taxonomy_term.canonical' && ($term = $route_match->getParameter('taxonomy_term')) && $term instanceof TermInterface) {
     foreach ($term->uriRelationships() as $rel) {
+      // Only add links the user is allowed to visit.
+      if (!$term->urlInfo($rel)->access()) {
+        continue;
+      }
+
       // Set the URI relationships, like canonical.
       $page['#attached']['html_head_link'][] = array(
         array(