Direct answer

Download plugins from the developer’s verified project page or a reputable repository. A plugin JAR runs inside the server process and can access the server machine; treat an untrusted JAR as executable software, not a harmless resource pack.

Recommended procedure

  1. Start from the developer’s official site, verified Hangar/Modrinth/Bukkit listing, or linked GitHub release. Cross-check the project name and author; beware lookalike domains and re-upload mirrors.
  2. Confirm the download is intended for your server type (Paper/Spigot versus a proxy or mod loader), Minecraft release, and Java runtime. Read the release notes and stated dependencies.
  3. Inspect the downloaded archive and filename. If it is a ZIP, check its contents and follow the author’s packaging instructions rather than installing arbitrary files.
  4. Review repository history, issue reports, and recent announcements if available. Malware scanning and hashes are useful extra signals but do not prove safety by themselves.
  5. Back up world data and configuration, then install on an isolated staging server. Start it and check logs/latest.log for unexpected behavior before deploying publicly.

Why this matters

PaperMC explicitly warns that plugins have extensive access to the computer. A source can be compromised, even if it was previously trusted; using minimal operating-system privileges and up-to-date backups reduces potential damage.

How to verify the result

  • Compare the downloaded file and version with the author’s release notes or checksum when published.
  • On staging, check /plugins, the startup log, network behavior and newly written files. A green plugin name means enabled, not secure.
  • If the source or requested permissions are unexplained, do not install the JAR on your production server.

Version and compatibility notes

Important

Proxy plugins and add-ons may use different directories and loading commands. Do not assume every JAR belongs in Paper’s plugins/ folder. No marketplace or antivirus result is a security guarantee.

Official references

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000