diff --git a/docs/plugins.md b/docs/plugins.md
index 5f53787..2b485d3 100644
--- a/docs/plugins.md
+++ b/docs/plugins.md
@@ -15,9 +15,10 @@ Every plugin must declare a `Plugin` table and implement the hooks it wants to u
 
 ```lua
 Plugin = {
-  name        = "My Plugin",
-  description = "What this plugin does.",
-  priority    = 0,  -- higher = runs before other plugins (default: 0)
+  name               = "My Plugin",
+  description        = "What this plugin does.",
+  priority           = 0,     -- higher = runs before other plugins (default: 0)
+  disable_by_default = true,  -- if true, plugin starts disabled on first load (default: false)
 
   -- Declare which hooks you use and whether they are synchronous (default: false).
   -- on_config and on_quit are always sync and do not need to be declared here.
diff --git a/internal/plugins/manager.go b/internal/plugins/manager.go
index 60e370c..a15db6e 100644
--- a/internal/plugins/manager.go
+++ b/internal/plugins/manager.go
@@ -117,6 +117,10 @@ func (m *Manager) loadPlugin(path string) (*Plugin, error) {
 		p.Priority = int(n)
 	}
 
+	if pluginTable.RawGetString("disable_by_default") == lua.LTrue {
+		p.Enabled = false
+	}
+
 	// Hooks configurable via the Plugin table (sync field).
 	configurableHooks := map[string]bool{
 		"on_start":         false, // async by default
diff --git a/plugins/ip_filter.lua b/plugins/ip_filter.lua
index ed634c9..d5569ec 100644
--- a/plugins/ip_filter.lua
+++ b/plugins/ip_filter.lua
@@ -10,6 +10,7 @@ Checks that the proxy's outbound IP is in an allowed list on startup.
 - if no IPs are configured, the check is skipped
   ]],
   on_start = { sync = false },
+  disable_by_default = true,
 }
 
 local whitelist = {}