BuildPublisherPlugin.doCheckHudsonUrl calls HudsonURL, which is useless since it does not consider authentication. Assuming that the public Jenkins server uses authentication—which is almost certain—this form validation can never work; it is just misleading and would be better deleted than left in its current state.

Probably what you want is for BuildPublisher.BuildPublisherDescriptor to have a doCheckUrl method that uses multiple @QueryParameter arguments to load also login and password fields. global.jelly may need to simplified/normalized to use the field attribute, ideally with HudsonInstance getting its own config.jelly page that gets inserted automatically by <f:repeatableProperty>. Not sure about all the details here (tried in https://github.com/jenkinsci/jenkins/pull/816 but did not get everything working). Alternately, continue to manually encode the textbox values (though this will not trigger correct logic for retrying validation after edits).