Where to download Minecraft plugins and mods safely

A plugin or mod runs with full access to your server and its files. One from a dodgy site can wipe your world, steal your data or quietly add a backdoor. Stick to the official sites.

The safe places

• Modrinth: mods and plugins, checked when uploaded, with clear version and loader info. The Mods and Plugins tabs in the panel install from here.
• Hangar: Paper's own plugin site.
• SpigotMC: the biggest plugin library, including paid plugins.
• CurseForge: mods and modpacks, plus some plugins.
• A project's own GitHub releases page, if that's where its developer publishes.

Avoid

• "Free" copies of paid plugins. Leaked premium plugins are the most common way servers get backdoored.
• Download sites that wrap the file in an installer or ask you to run an .exe.
• Random links in Discord or YouTube descriptions that don't go to one of the sites above.

Check it will work before installing

On the download page, check three things:

1. Minecraft version. It must support your server's version, shown on the Startup tab.
2. Server software or loader.
   • Plugins run on Paper, Purpur or Spigot. They don't work on Fabric, Forge or NeoForge.
   • Mods need the matching loader: a Fabric mod needs a Fabric server, a NeoForge mod a NeoForge server.
3. Server side. Some mods are client-only (minimaps, shaders, HUD mods). They do nothing on a server and some crash it. Modrinth labels these.

Install one at a time

Add one, restart, check the Console for errors, then add the next. If you add ten at once and the server won't start, you won't know which one did it.