Since plugins run within the server process, verify their source, version, and requirements before installing them. File name or popularity alone is not proof of trust.
Step by step
-
Find the developer's official distribution page. Download from a verifiable stream rather than a Discord attachment or repackaged file.
-
Read the project's release notes and expected dependencies. Compare the broadcast signature or file hash value if provided.
-
First boot on the test server without production data and passwords. Look at the files it creates and any unexpected links in the log.
-
Take a backup backup before going live. Test the expected feature of the plugin and the permissions it creates.
Keep in mind
The absence of a browser or antivirus warning does not confirm the behavior of the file.