Best prevention methods for exploits in FPS

[NinjoOnline]

I wanna prefice by saying I know it’s impossible to fully snub out exploiters in FPS games, however I wanna do as much as I can to catch out the average exploiter.

I am using FastCast and at the moment the client handles virtually everything. So when you hit a player (on the client) it sends a remote event to the server telling you hit the player, and the server does basic sanity checks, but there’s nothing really solid there.

--// Player hit (server)
local function Hit(player, playerHit)
	if player == playerHit then return end -- Creator can't tag themselves
	
	local Teams = GameSettings:GetAttribute("Teams")
	if player.Team == playerHit.Team and Teams then return end -- Can't tag your own team
	
	local Humanoid = playerHit.Character:FindFirstChild("Humanoid")
	if not Humanoid then return end
	
	-- Create all values associated with Creator
	local CreatorValue = Instance.new("ObjectValue")
	CreatorValue.Name = "Creator"
	CreatorValue.Value = player
	
	-- Player's level
	local LevelValue = Instance.new("NumberValue")
	LevelValue.Name = "Level"
	LevelValue.Value = player.PlayerData.Level.Value
	LevelValue.Parent = CreatorValue
	
	-- Gun used
	local EquippedValue = Instance.new("StringValue")
	EquippedValue.Name = "Equipped"
	EquippedValue.Value = player.PlayerData.Equipped.Value
	EquippedValue.Parent = CreatorValue
	
	-- Get distance
	--local Distance = (result.Position - cast.UserData.Origin).Magnitude
	--[[
	if Distance >= 100 then -- Longshot
		local Longshot = Instance.new("Folder")
		Longshot.Name = "Longshot"
		Longshot.Parent = CreatorValue
	end
	
	if Hit.Name == "Head" then -- Headshot
		local Headshot = Instance.new("Folder")
		Headshot.Name = "Headshot"
		Headshot.Parent = CreatorValue
	end
	]]
	CreatorValue.Parent = Humanoid
	
	Humanoid:TakeDamage(100) -- Kill player
end

When a player shoots, I do tell the server this, and the server also does FastCast, but I was having problems with the servers FastCast hit detection not being great, where your client would say you hit a player, but the servers FastCast would say you missed. Is there a way I could connect the client and servers bullets (so if the clients bullet says they hit someone, I could check the servers bullet and see if its like close enough to hit the player?)

--// Bullet fired (server)
local function FireBullet(player, mousePosition, firePoint)
	local Character = player.Character
	if not Character then return end
	
	local WeaponModel = Character:FindFirstChild("Weapon")
	if not WeaponModel then return end
	
	local Weapon = WeaponModel:GetAttribute("Weapon")
	
	local WeaponFolder = Weapons:FindFirstChild(Weapon)
	if not WeaponFolder then return end
	
	local Config = WeaponFolder:FindFirstChild("Config")
	if not Config then return end
	
	local SPEED = Config:GetAttribute("Speed")
	local GRAVITY = Config:GetAttribute("Gravity")
	
	CastParams.FilterDescendantsInstances = {Character, Splatter}
	
	if GameSettings:GetAttribute("Teams") then -- Team based gamemode
		CastParams.CollisionGroup = player.Team.Name == "Blue" and "BluePaint" or "RedPaint"
	end
	
	-- Set up cast behavior
	local CastBehavior = FastCast.newBehavior()
	CastBehavior.RaycastParams = CastParams
	CastBehavior.Acceleration = Vector3.new(0, -GRAVITY, 0)
	
	local Origin = firePoint
	local Direction = (mousePosition - Origin).Unit
	
	local ActiveCast = Caster:Fire(Origin, Direction, SPEED, CastBehavior) -- Fire shot
	
	ActiveCast.UserData = {
		Creator = player,
		Origin = Origin
	}
	
	for _, v in pairs(Players:GetPlayers()) do
		if v == player then continue end
		
		ReplicateBullet:FireClient(
			v,
			player,
			WeaponModel,
			mousePosition,
			firePoint
		)
	end
end

Shoot.OnServerEvent:Connect(FireBullet)

I’ve read through these forum posts, but still struggling to get a grasp on the best ways of preventing exploits

Secure Yet Accurate Gun Raycasting?

Is there not existential proof that any and all security algorithms won’t someday be broken? The point here is that we try to secure something. There is no perfect, permanent solution to any problem relating to security. As orange points out, there is very little hope in truly securing any game that requires any input from a client. This is an age old problem. This is why third party applications exist that monitor your activity as you play a game. Maybe his methods aren’t perfect but they’re a…

What are some good sanity check methods for my damage remote event?

I made a simple projectile system that goes from client -> server -> client -> then back to the server to deal damage, but the problem is that I know that exploiters can just fire this remote event for everyone, so it will be like a kill all script. What sanity check methods would prevent this?

[dthecoolest]

I have made several functions to compare the projectile path between server and client which should help.

First is the wall check checking if it hits a wall, second is the projectile path from when the bullet was fired compared to the time it was hit.

Using fastcast to check a shots validity?

Unfortunately fastcast doesn’t support immediate raycasting but we can achieve that ourselves by raycasting in segments along the projectile motions equation. I’m assuming the fastcast bullet is client sided with a remote telling the server “Hey I fired” and a remote telling the server “Hey this bullet I fired hit” and the system uses a bullet ID method like @BIackShibe fps framework tutorial credits to him. He uses a math.random method of generating an ID, I’m using HttpService Generate GUID t…