Links, downloads and the files people send you

Security & DDoS Reviewed September 6, 2026 2 min read

Server owners get sent things: a schematic, a «fixed» plugin, a screenshot of an error, a pack from a player. Most of it is exactly what it says. The category of attack aimed at you specifically works because the file is genuinely what you asked for, plus something else.

What people send, and what to watch

SentReasonable?Watch for
A screenshot of an errorYesNothing. Images are fine.
A log fileYesNothing, but read it before pasting it publicly.
A schematicYesPaste on a test world first — large ones can hang a server.
A plugin jarSometimesGet it from the project's own page instead, always.
A «cracked» or «free» paid pluginNoThis is the single most common infection route.
An executable or installerNoNothing about running a Minecraft server needs one.
A jar file is a program with your server's full access

There is no sandbox. A plugin someone hands you can read every file the server can read, including configs with your database credentials, and can run any command as the console. «It is just a small plugin, look at what it does» is exactly the pitch, and you cannot tell by looking at the description.

Handling a file you did not go and get yourself

  1. Find the original source

    If it is a real plugin, it has a project page. Download from there and ignore the copy you were sent — you lose nothing and you know what you have.

  2. If there is no original source, decline

    A plugin that exists only as a file someone sent you is a plugin nobody has reviewed. That is not a rule about trust; it is a rule about there being no way to check.

  3. Test on a copy, not on the live server

    For schematics and packs, which are usually fine but occasionally enormous. A test instance turns a bad afternoon into a shrug.

  4. Never run an executable

    No legitimate part of hosting a Minecraft server involves you running a program someone sent you.

The same rule protects your players

A link posted in your Discord reaches everyone in it. Removing links to «free» plugin sites and unknown downloads from your community is protecting your players, not censoring them — and it is worth saying out loud once so the rule is understood rather than resented.