An Unreal plugin is a collection of code and data that can be enabled per project, and its descriptor lists modules that may be editor-only or runtime. Read the descriptor first: it tells you what could ship to players and what only runs in the editor. Then check the plugin's content folder and its source.
What the documentation says
Epic describes plugins as collections of code and data that developers can enable or disable in the Editor on a per-project basis. Plugins can add runtime gameplay functionality, modify built-in engine features, create new file types and extend the Editor with menus, toolbar commands and sub-modes.
On structure, Epic says plugin descriptors are discovered and loaded automatically by the Engine, Editor and UnrealBuildTool whenever those run. Most plugins have one module, but a plugin may have several, for example one holding editor-only functionality and another intended to run during the game. Plugins can also carry their own Content folder, and a descriptor setting called CanContainContent must be true for that content to be used. Plugins in a project live under its Plugins subfolder and are detected and loaded at engine or editor startup.
Reading a descriptor
The descriptor is a small file with the .uplugin extension, in JSON. Open it in a text editor before you add the plugin to a project.
| What to look for | Why it matters |
|---|---|
| The list of modules and each module's type | Editor-only modules should not appear in a packaged game; runtime modules can |
| Whether the plugin declares content | Content may include assets and blueprints that run logic |
| Which other plugins it enables | Each one is more code you now depend on |
| The supported platforms | A plugin claiming every platform may carry native libraries for each |
| Version and publisher fields | Record them for your register |
This describes what to inspect, not what a particular descriptor contains. Field names and options vary by engine version, so confirm against Epic's current documentation.
Steps before you ship with a plugin
- Read the
.upluginfile and write down every module and its type. - Look inside the plugin folder for a Source directory. If only binaries are present, you are trusting a precompiled build. Note that.
- Open the Content folder if present and list its blueprints and assets.
- Check the plugin's third party folder for bundled libraries and add each to your inventory. Bundled libraries are the part most teams forget.
- Package a test build and confirm editor-only modules are not in it.
- Decide whether to install it at engine level or project level. Our guide on engine or project level installs explains the trade offs.
- Add the plugin to a register with an owner, a version and a review date.
Why editor-only versus runtime is the key question
Editor-only code affects your team's machines and build farm. Runtime code reaches players and your support queue. A flaw in an editor-only module still matters, because developer machines hold source code and credentials, but the response is different: you update tools, not shipped builds. A flaw in a runtime module can mean a game patch.
Knowing which one you have lets you answer an advisory in minutes instead of hours.
Where scanning fits
Safeguard's SBOM and dependency scanning covers packages and libraries declared in your repositories, and you can try a free scan at gold.safeguard.sh/scan. Reading a plugin descriptor remains a manual intake step that feeds that inventory.
Quick check
Can one plugin have both editor and game code?
Yes. Epic says a plugin can have multiple modules, for example editor-only functionality in one and game code in another.
Do plugins load without my approval at startup?
Epic says plugins in a project's Plugins folder are detected and loaded at startup, and descriptors are discovered automatically, so anything placed there is in play.
What does CanContainContent do?
Epic's page says it must be set to true for a plugin's content to be usable.
Sources
Last reviewed: 19 October 2026.
