Server validation
Whether the server checks that an action is allowed before it happens: that the player owns or has unlocked what they picked, hasn't claimed a reward already, is close enough to what they're using and could really have landed a hit, and that the round or their state allows it. It also covers values that only look server-side, such as teleport data and parts a client simulates, and making sure nothing can slip in between a check and the change it guards.
Back to categoriesTeam menus, auto-assigned teams and team spawns can put anyone on a team with extra powers. How to check who may join each team on the server.
How to stop players teleporting to places they haven't unlockedcriticalA remote that teleports to any place id or access code the client sends skips paywalls and private matches. How to use server-side destination lists.
How network ownership lets clients move reward partscriticalAn unanchored part near a player is simulated by their client. How to stop balls, crates and carts deciding rewards from client physics.
How to stop trade scams in a Roblox trading systemcriticalOffers that change after the other player accepts are the classic trade scam. How to reset acceptance on every change and recheck items when the trade completes.
Why teleport data can't be trusted in RobloxcriticalTeleportData passes through the client, even with a SourcePlaceId check. How to carry coins, boosts and entry fees between places safely.
How to check the round state before allowing an actioncriticalBets after the winner is known and answers after the reveal. How to keep round and player state on the server and check it in every handler.
How to validate building placement on the servercriticalA CFrame from the client can put furniture on other players' plots or across the map. How to check the whole item fits inside the player's own plot.
How to secure ProximityPrompts and ClickDetectors on the servercriticalExploiters can fire prompt and click events from anywhere, ignoring Enabled and MaxActivationDistance. How to check distance, state and timing on the server.
Why tycoon collectors need an owner checkcriticalA pad that pays whoever touches it lets anyone take another player's earnings. How to check the plot's owner on the server.
How to check a player owns the item or zone they pickcriticalChecking that an id exists isn't the same as checking the player has it. How to check pets, skins, classes and zones against the player's own data.
How to stop daily rewards and codes being claimed twicecriticalDaily rewards, promo codes and quest prizes that pay out again on every call or rejoin. How to record claims in saved data before paying.
How to validate combat hits on the server in RobloxcriticalIf the client reports hits and the server just applies damage, hits can land from anywhere. How to check range, cooldowns and ranged shots on the server.
How to stop yields letting players claim or spend twicecriticalA yield between a check and the change it guards lets the same remote pass the check twice. How to order handlers so the change happens first.
How to add server-side distance checks in RobloxwarningChests, shops and sell pads that work from anywhere on the map. How to check on the server that the player's character is close enough to use them.
How to stop players farming referral rewardswarningReferral links never expire, so paying on every join pays again and again. How to pay each invitee once and cap rewards per inviter.
How to stop players dragging other players' thingswarningDragDetectors let everybody drag by default. How to use a Scriptable permission policy that checks ownership on the server.
Each guide covers one problem. Fixing every one of them makes a game harder to exploit, but it doesn't make it secure on its own: review your own game logic too.