do not deny custom plugins by whitelist