Server owners get sent things: a schematic, a «fixed» plugin, a screenshot of an error, a pack from a player. Most of it is exactly what it says. The category of attack aimed at you specifically works because the file is genuinely what you asked for, plus something else.
What people send, and what to watch
| Sent | Reasonable? | Watch for |
|---|---|---|
| A screenshot of an error | Yes | Nothing. Images are fine. |
| A log file | Yes | Nothing, but read it before pasting it publicly. |
| A schematic | Yes | Paste on a test world first — large ones can hang a server. |
| A plugin jar | Sometimes | Get it from the project's own page instead, always. |
| A «cracked» or «free» paid plugin | No | This is the single most common infection route. |
| An executable or installer | No | Nothing about running a Minecraft server needs one. |
There is no sandbox. A plugin someone hands you can read every file the server can read, including configs with your database credentials, and can run any command as the console. «It is just a small plugin, look at what it does» is exactly the pitch, and you cannot tell by looking at the description.
Handling a file you did not go and get yourself
- Find the original source
If it is a real plugin, it has a project page. Download from there and ignore the copy you were sent — you lose nothing and you know what you have.
- If there is no original source, decline
A plugin that exists only as a file someone sent you is a plugin nobody has reviewed. That is not a rule about trust; it is a rule about there being no way to check.
- Test on a copy, not on the live server
For schematics and packs, which are usually fine but occasionally enormous. A test instance turns a bad afternoon into a shrug.
- Never run an executable
No legitimate part of hosting a Minecraft server involves you running a program someone sent you.
A link posted in your Discord reaches everyone in it. Removing links to «free» plugin sites and unknown downloads from your community is protecting your players, not censoring them — and it is worth saying out loud once so the rule is understood rather than resented.