Tools and combat
How weapons and tools decide who gets hit: damage from touches the attacker's own client reports, fire rates, ammo and reloads kept only on the client, lists of victims taken from the client as they are, team, duel and safe-zone rules the server never checks, and tool remotes that any player can fire. Range and line-of-sight checks for single hits are covered by Hits the server doesn't check were possible in server validation.
Back to categoriesCooldowns, ammo and reloads kept only in a LocalScript can be skipped. How to track shots, ammo and reload time on the server.
How to stop sword reach exploits in RobloxcriticalA tool's handle is simulated by its holder's client, which also reports its touches. How to check reach on the server before a Touched hit deals damage.
How to validate area attacks that send a list of hitscriticalA list of victims from the client can be any length and repeat the same player. How to cap it, remove duplicates and range-check every target.
How to enforce teams, duels and safe zones on the servercriticalFriendly fire, duel opponents and safe zones checked only on the client let exploiters hit anyone. How to check who may be attacked in every damage handler.
How to secure RemoteEvents inside toolscriticalA remote inside an equipped tool can be fired by any client. How to check the caller is the tool's holder before acting.
Why weapons should use TakeDamage instead of setting HealthwarningSetting Humanoid.Health ignores ForceFields, so spawn protection stops working. How to route every weapon's damage through TakeDamage.
How to stop explosions killing teammates in RobloxwarningA default Explosion kills every unprotected character in range, through walls. How to set DestroyJointRadiusPercent to 0 and apply your own damage in Hit.
How to stop players farming kill rewards with alt accountswarningPaying for every kill lets two accounts trade kills for currency. How to skip freshly spawned victims and limit repeat kills of the same player.
Each guide covers one problem. Fixing every one of them makes a game harder to exploit, but it doesn't make it secure on its own: review your own game logic too.