diff --git a/internal/validators/validators.go b/internal/validators/validators.go
index 4da756d..114ed3c 100644
--- a/internal/validators/validators.go
+++ b/internal/validators/validators.go
@@ -195,6 +195,20 @@ func validateWebsiteURL(ctx *ValidationContext, websiteURL string) *ValidationRe
 		result.AddIssue(issue)
 	}
 
+	// Reject characters that aren't valid in a URI per RFC 3986 and that have
+	// caused rendering issues when websiteUrl flows into the catalogue UI's
+	// href attributes. Publishers should percent-encode these in the source URL.
+	if i := strings.IndexAny(websiteURL, "\"'<> \t\n\r"); i >= 0 {
+		issue := NewValidationIssue(
+			ValidationIssueTypeSemantic,
+			ctx.String(),
+			fmt.Sprintf("websiteUrl contains an invalid character %q at position %d: %s", websiteURL[i], i, websiteURL),
+			ValidationIssueSeverityError,
+			"website-url-invalid-characters",
+		)
+		result.AddIssue(issue)
+	}
+
 	return result
 }
 
diff --git a/internal/validators/validators_test.go b/internal/validators/validators_test.go
index d4ff5c1..c3e5585 100644
--- a/internal/validators/validators_test.go
+++ b/internal/validators/validators_test.go
@@ -13,6 +13,8 @@ import (
 	"github.com/modelcontextprotocol/registry/pkg/model"
 )
 
+const websiteURLInvalidCharErrSubstr = "websiteUrl contains an invalid character"
+
 func TestValidate(t *testing.T) {
 	tests := []struct {
 		name          string
@@ -486,6 +488,98 @@ func TestValidate(t *testing.T) {
 			},
 			expectedError: "invalid websiteUrl:",
 		},
+		{
+			name: "server with websiteUrl containing double quote",
+			serverDetail: apiv0.ServerJSON{
+				Schema:      model.CurrentSchemaURL,
+				Name:        "com.example/test-server",
+				Description: "A test server",
+				Repository: &model.Repository{
+					URL:    "https://github.com/owner/repo",
+					Source: "github",
+				},
+				Version:    "1.0.0",
+				WebsiteURL: `https://example.com/"oops`,
+			},
+			expectedError: websiteURLInvalidCharErrSubstr,
+		},
+		{
+			name: "server with websiteUrl containing single quote",
+			serverDetail: apiv0.ServerJSON{
+				Schema:      model.CurrentSchemaURL,
+				Name:        "com.example/test-server",
+				Description: "A test server",
+				Repository: &model.Repository{
+					URL:    "https://github.com/owner/repo",
+					Source: "github",
+				},
+				Version:    "1.0.0",
+				WebsiteURL: "https://example.com/it's",
+			},
+			expectedError: websiteURLInvalidCharErrSubstr,
+		},
+		{
+			name: "server with websiteUrl containing angle brackets",
+			serverDetail: apiv0.ServerJSON{
+				Schema:      model.CurrentSchemaURL,
+				Name:        "com.example/test-server",
+				Description: "A test server",
+				Repository: &model.Repository{
+					URL:    "https://github.com/owner/repo",
+					Source: "github",
+				},
+				Version:    "1.0.0",
+				WebsiteURL: "https://example.com/<x>",
+			},
+			expectedError: websiteURLInvalidCharErrSubstr,
+		},
+		{
+			name: "server with websiteUrl containing space",
+			serverDetail: apiv0.ServerJSON{
+				Schema:      model.CurrentSchemaURL,
+				Name:        "com.example/test-server",
+				Description: "A test server",
+				Repository: &model.Repository{
+					URL:    "https://github.com/owner/repo",
+					Source: "github",
+				},
+				Version:    "1.0.0",
+				WebsiteURL: "https://example.com/has space",
+			},
+			expectedError: websiteURLInvalidCharErrSubstr,
+		},
+		{
+			name: "server with websiteUrl containing newline",
+			serverDetail: apiv0.ServerJSON{
+				Schema:      model.CurrentSchemaURL,
+				Name:        "com.example/test-server",
+				Description: "A test server",
+				Repository: &model.Repository{
+					URL:    "https://github.com/owner/repo",
+					Source: "github",
+				},
+				Version:    "1.0.0",
+				WebsiteURL: "https://example.com/has\nnewline",
+			},
+			// url.Parse rejects ASCII control chars before our character-set
+			// check runs; either path produces a validation error.
+			expectedError: "invalid websiteUrl:",
+		},
+		{
+			name: "server with websiteUrl with percent-encoded special chars is accepted",
+			serverDetail: apiv0.ServerJSON{
+				Schema:      model.CurrentSchemaURL,
+				Name:        "com.example/test-server",
+				Description: "A test server",
+				Repository: &model.Repository{
+					URL:    "https://github.com/owner/repo",
+					Source: "github",
+				},
+				Version:    "1.0.0",
+				WebsiteURL: "https://example.com/path/?q=hello%20world&r=a%22b",
+			},
+			expectedError: "",
+		},
 		{
 			name: "server with websiteUrl that matches namespace domain",
 			serverDetail: apiv0.ServerJSON{