Where to get plugins and mods safely

Plugins and mods run as code on your server with full access to your files, so the single most important security habit is downloading them only from the sites the developers actually publish on.

6 min read · Updated Oct 21, 2026 · By GuavaHost Team

Why a jar file is not like a texture pack

A plugin or a mod is a program. When your server loads a .jar from the plugins or mods folder, that code runs with the same access your server has: it can read and write every file, open network connections, run commands as the console, and read anything stored on disk. There is no sandbox between a plugin and your world.

That is not a reason to avoid plugins. It is a reason to care where they came from. Almost every "my server got wiped and I do not know how" story starts with a jar from a link in a Discord DM.

If you are still getting your head around the different kinds of add-on, Mods, plugins, modpacks and datapacks explained is worth five minutes first.

The places worth trusting

These are the sites where developers publish, where uploads are reviewed or at least accountable, and where you can see a version history:

The common thread is that a named developer stands behind the file and a bad upload has consequences for them. A random mediafire or anonfiles link has neither.

Warning signs of a reupload or a backdoor

A reupload is somebody else's plugin hosted somewhere the author did not put it. Sometimes that is just laziness. Sometimes the jar has been opened, had code added and been repacked. Treat these as reasons to stop:

• The download leaves the site you searched on. A plugin page that sends you to a file locker, an ad gateway or a shortened link is not distributing its own file.
• A premium plugin is offered free. If a plugin normally costs money and a site has it for nothing, somebody has paid for your download in another way. This is the single most common delivery route for backdoored jars.
• The version does not match the dates. A page claiming support for a Minecraft version released last month, with a file uploaded two years ago, is lying about one of the two.
• No changelog, no issue tracker, no source. Established projects leave a trail. A plugin with one version, no history and a glowing description is a blank page.
• Someone sent you the file directly. A jar attached to a Discord DM, even from a familiar name, has no provenance at all. Ask for the source link instead.
• The file size is wildly off. A small utility plugin that arrives as a 40MB jar, or a big modpack that arrives as 80KB, is not what it claims. Compare against the file size shown on the official page, which most sites display next to the download.
• It asks you to turn things off. Instructions telling you to disable a scanner, ignore a warning or run a .exe to install a server plugin are a flat no.

Cracked paid plugins are a security problem, not a bargain

The cracked plugin scene exists to distribute malware. That is not moralising, it is the practical shape of it: the only reason to spend effort cracking and hosting somebody else's paid plugin is to attach something to it, because the audience is server owners whose machines hold player data, worlds and sometimes payment details for a store.

The code added to cracked jars usually does one of three things: adds a hidden operator or a command that grants full access to one account, fetches more code later so the jar itself looks clean, or quietly collects credentials from config files. Your database password, your Discord bot token and your store API keys all sit in plain text in configs, which is why Keep your Discord bot token safe applies here too.

Buy the plugin or use a free alternative.

Check before you install, not after

A short routine, two minutes:

1. Take a backup first. Open the Backups page and click Create backup. If a plugin misbehaves, a restore is the fastest exit. See Backups.
2. Confirm the loader and version. A Paper plugin will not load on Fabric, and a mod built for one Minecraft version usually refuses a different one. The download page states both.
3. Read the last page of recent comments or reviews. Not the top ones. Recent reports of odd behaviour show up there first.
4. Look inside the jar if you are unsure. A .jar is a zip file. Rename a copy to .zip and open it. You should see the plugin's own package folders and a plugin.yml or fabric.mod.json. Bundled extras you did not expect, like an unrelated project's package or a second jar inside, deserve a question.
5. Install one thing at a time. Upload the jar on the Files tab or over SFTP, restart, and watch the Console tab as it loads. One plugin per restart means you always know which one caused what.
6. Read the startup log. A plugin phoning home, failing a licence check or complaining about a missing dependency says so in the console.

If you run a public server, consider testing new jars on a second cheap server before they touch the live one. How many plugins is too many covers why a slimmer list is easier to keep clean as well as faster.

Keep what you installed current

Old plugins are a bigger real-world risk than fake ones. Published vulnerabilities in widely used plugins get scanned for, and an abandoned plugin never gets a fix. Once a term, open your plugins folder and ask of each file: do I still use this, and has it had an update this year? Delete the rest.

If something has already gone wrong, work through What to do if your server was griefed or hacked and restore from a backup taken before the jar arrived, rather than cleaning files by hand.

Common questions

Is CurseForge or Modrinth safer?

Both are reasonable. Modrinth has a review step on new projects and clearer version tagging, while CurseForge has far more history and most large modpacks. The bigger factor is that you are on either of them rather than on a reupload site.

Can I just scan the jar with my antivirus?

It helps a little, but do not rely on it. Antivirus tools are built for Windows executables, not Java server plugins, and a backdoor that only downloads its payload after the server starts has nothing for a scanner to find. Provenance and a recent backup protect you better.

A plugin I need has not been updated for the current version. What now?

Look for a maintained fork on Modrinth or Hangar first, since popular abandoned plugins usually have one. If there is no fork, prefer going without the feature over running an old jar on a public server, and never reach for a reupload claiming to have patched it.

Do Steam Workshop mods carry the same risk?

Less, because Workshop items are content and scripts loaded by the game rather than free-running server code, and Valve can remove an item globally. The habits still apply: subscribe from the game's own Workshop pages, and back up before adding a batch.

Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.

• plugins
• mods
• downloads
• malware
• security

Still need help? Our team is online 24/7 to answer questions.

Contact support