Anti-exploit
How the game spots and handles exploiters: whether its checks run where an exploiter can't switch them off, whether the server watches the things a client controls, such as its own character's movement and touches, and whether bans, jails and other punishments hold.
Back to categoriesReport buttons, vote-kicks and client anti-cheat that let one client punish another. How to keep punishment decisions on the server or with moderators.
How to secure Touched rewards in RobloxcriticalCoins, checkpoints and finish lines that pay on Touched without checking the character is there. How to add distance checks and debounces on the server.
How to make a jail players can't reset out ofwarningJails and freezes that only move the character or set its walk speed end with a reset. How to hold players on the server instead.
Why RespectFilteringEnabled should stay onwarningTurning it off lets any client play sounds for the whole server. How to play shared sounds from the server with checks instead.
Why client-side anti-cheat isn't enough in RobloxwarningAn exploiter controls their own client, so checks that only run there can be switched off. How to move movement checks to the server.
Why server anti-cheat shouldn't ban on one readingwarningLag, falls, flings and the game's own teleports trip movement checks. How to move players back instead of kicking, and allow for your own movement.
How to protect VIP, beta and test places in your universewarningClients can teleport to any place in the universe, and content replicates before a kick runs. How to use Secure within universe only and fail closed.
Why checking WalkSpeed on the server catches nobodywarningExploiters change WalkSpeed and JumpPower on their own client, so the server never sees it. How to measure movement on the server instead.
Why server logic in ReplicatedStorage modules is exposedwarningAny module that reaches the client can be decompiled, even if it never runs there. How to keep anti-cheat rules and unreleased content on the server.
How to keep impossible scores off your global leaderboardswarningWriting raw stats to an ordered data store puts every exploit on show. How to check times and rates of gain before a score is saved.
How to ban players properly in RobloxwarningBans kept in a script table or saved by username don't stop anyone for long. How to use Players:BanAsync or save bans by UserId.
Why a VIP door isn't enough to protect a VIP roomwarningExploiters can walk through walls and doors. How to check access on the server for everything inside a restricted area.
Each guide covers one problem. Fixing every one of them makes a game harder to exploit, but it doesn't make it secure on its own: review your own game logic too.