I want to kick players for changing specific values in their characters, but I am not sure if exploiters can change the values of other characters. Is this something an exploiter can achieve? For now, in my anti cheat, I am constantly changing the values back to what they should be, but an exploiter could easily just use a loop to constantly change their speed/jump power.
They can change properties under other players but only on their client (i.e only on their client will others have altered properties) since such changes won’t replicate to all other clients.
If your anti-cheat detects things on the client, an exploiter can just stop that code from running or circumvent your checks in any way, if you’re doing it on the server it won’t work since WalkSpeed and properties of the like don’t replicate to the server (the Velocity property for BaseParts under the character does, so you could use that instead for speed checks).
3 Likes
Obviously no. For a client to have access to another client he needs to go through the server first which redirects him. Exploiters can’t even cross the server boundary, so don’t worry. Unless an exploiter has a backdoor planted somewhere in your server (a bad module or model that you imported) he might be able to, if that backdoor is designed to do that.
4 Likes
I am constantly changing the value of their walkspeed and jump power through the server using a local script that constantly gets added and removed to their playergui through a script in ServerScriptService so they cannot get rid of it. Will this work?
Well it will work, but use it only if you’re rightly cautious about speed hacks (since you’ll have to constantly set the speed for every player in the game, it might get expensive), remember that you can always alter your game structure so that such cheats don’t benefit the player to a considerable extent.
Exploiters can still always change their own WalkSpeed, but if you set the speed back fast enough the increase in speed might not be too helpful.
1 Like
Now I just have a local script making sure that the player’s walkspeed and jump power is what it is supposed to be. If the value is tampered with, the player is kicked. The local script checking locally will be able to detect the player’s actual speed, correct?
It’ll be able to detect it, but then again since it’s on the client and the client has full control over itself, it can circumvent any checks.
That’s why it’s a good idea to move checks server-side
if character.HumanoidRootPart.Velocity > highestPossibleVelocity then
character.Humanoid.WalkSpeed = 24
endSadly this method of checking speed with a localscript will not work very effectively 
.
an Exploiter can easily delete the localscript with ease. You should create a script on the server that is checking that player’s velocity to see if it is too fast because server scripts cannot be tampered with unless you have a remote function.
How so? The client can fake its speed to be 16 when it’s actually 32?
walkspeed does NOT replicate to the server (the value) but the character’s position DOES (Hope that cleared it up 
(This is why teleport hacks work and jump hacks)
Using a local script, would I be able to get the correct walkspeed value from the character?
Yes but the exploiter could easily delete it right when they join the game
If they change the walkspeed on the client the server won’t see this change so this is pointless.
I have a script in ServerScriptService that constantly adds, deletes, and readds the local script to the player.
Hacks can’t change the walkspeed of other players they only have control over there character, even if they change the walkspeed the server won’t see it. You will have to make some sort of distance tracking system.
This still will not work because exploiters can just keep deleting the script and also constantly readding the script may lag the client for people not exploiting (The best way to check for speedhacking is velocity checks)
My question is: can a local script get the correct walkspeed of an exploiter?
The exploiter is immediately kicked when the walkspeed is not 16.
Also, you can’t just check if the character’s position changes because they might be lagging.
1 Like
Yes but what i’m saying is that the exploiter can keep deleting the scripts no matter what