The best plugins for a Minecraft server: the essentials first

Almost every Paper server needs the same backbone: permissions (LuckPerms), an anticheat (DGuard), block logging with rollbacks (CoreProtect), regions (WorldGuard with WorldEdit) and backups. After that it depends on your mode: commands and economy (EssentialsX, Vault), placeholders (PlaceholderAPI), other client versions (ViaVersion), world pre-generation (Chunky). The spark profiler already ships with Paper.

Every plugin installs the same way: the .jar goes into plugins/, then a restart. The full walkthrough with dependencies and error fixes is in how to install a plugin.

The short list#

Permissions: LuckPerms#

LuckPerms is a permissions plugin: groups, inheritance, prefixes, temporary ranks and a web editor. Install it first: other plugins check player permissions, and without LuckPerms all you have is OP — all or nothing.

By default its data lives in an H2 file database inside the plugin folder; networks move it to MySQL or MariaDB. A ready default → helper → moderator → admin setup is in LuckPerms in 10 minutes.

Anticheat: DGuard#

Without an anticheat, the first player with KillAura, Fly or Scaffold ruins the game for everyone else. DGuard is an anticheat for Paper and Leaf 1.21–26.3: 11 checks and 80+ rules watch combat, movement, building, inventory and packets at once. In the comparison across 47 kinds of cheats, DGuard has a check for every one — and every rival mark is sourced from that anticheat's code or docs, see the comparison.

Free up to 30 players online — one server, no time limit, no card, and the same protection as the paid plans. DGuard runs on top of the PacketEvents plugin, so you install both. How to pick an anticheat for your mode is covered in the best Minecraft anticheat.

Block logging and rollback: CoreProtect#

CoreProtect records who placed and broke each block, who took what from a chest and what people said in chat — and rolls back any damage with one command. It needs no setup: drop it into plugins/ and restart. On a survival server without it, a griefer wrecks a base and you're left guessing who did it.

How to find the culprit and roll back the damage is in the CoreProtect guide.

Regions: WorldGuard and WorldEdit#

WorldGuard protects areas from griefers and turns off individual mechanics inside a region: PvP at spawn, fire, explosions. It won't run on its own — it needs WorldEdit, the in-game map editor with selections, schematics and copy-paste. Install both files together.

Commands, economy and placeholders#

• EssentialsX — the core command suite for Paper and Spigot: over 160 commands, homes, warps, teleports, kits. Its developers recommend LuckPerms alongside it, and prefixes and suffixes need Vault.
• Vault — not a feature but a bridge: a permissions, chat and economy API that lets plugins find each other. Without it, many shops, chat formatters and economies can't see money or prefixes.
• PlaceholderAPI — shows other plugins' data anywhere: tab list, scoreboard, chat, holograms. You need it once you start dressing up the server.

Client versions: ViaVersion#

ViaVersion lets clients newer than the server join. Older clients also need ViaBackwards, and 1.7–1.8 need ViaRewind on top. Players on 1.21–26.x clients who join through ViaVersion are checked by DGuard the same way. Details in the ViaVersion guide.

Performance: Chunky and spark#

Generating new chunks is one of the heaviest things a server does. Chunky pre-generates the world before launch: you can pause a task and resume it later, and it reports progress and time remaining. How to pick a radius is in pre-generating the world.

spark is a profiler that shows which plugin or mechanic eats your ticks. Since 1.21 Paper ships spark itself, so there's nothing to install: /spark profiler start --timeout 600. How to read the report is in why your server lags.

Offline-mode servers: password login#

With online-mode=false in server.properties, the server doesn't verify accounts: anyone can join under any name, including yours. An authentication plugin such as AuthMeReloaded makes players register and log in with a password. The risks of this mode and how to cover them are in offline-mode servers.

Backups#

CoreProtect undoes what players did, but it won't save you from a dead disk, a botched update or a corrupted config. Copies of the world and the plugins/ folder are made with your host's tools or a scheduled script and kept away from the server. Step by step in server backups.

PacketEvents: a library, not a feature#

PacketEvents adds nothing to the game — it's a library other plugins use to read packets. DGuard needs it, and so do some other plugins. DGuard runs on the latest release only: developer builds (dev, SNAPSHOT) won't do, and the DGuard panel tells you when a new release is out. More in the PacketEvents guide.

How not to break your server with plugins#

• Official pages only. Hangar, Modrinth, SpigotMC, the project's own GitHub or website. Paper's docs say plainly: fully trust the source before installing a plugin.
• No leaked or "nulled" copies of paid plugins. A repackaged jar can contain anything, including malicious code with access to the whole server and its files. Saving on a license can easily cost you the server.
• Fewer plugins, fewer problems. Every extra plugin is one more source of conflicts, update breakage and load. If two plugins do the same job, keep one.
• Match versions. Check on the plugin's page which Minecraft and server versions it supports, especially after you move the server to a new version.
• Test on a copy. Run a new plugin or a big update on a test server with a copy of the world first.

FAQ#