How to prevent exploiters teleporting my players to other games?

[Rusiteblox]

Hi!!! I’m noob(started in november2019) and I’ve realised my first game and it was hacked in less than 24hs (fortunately). So that moved me to read a lot and watch a lot of videos of how to prevent all of this, the exploiter gived himself guns, a cloud in workspace, music… I’ve made almost all the checks in server-side and I though that this cannot be possible with FE… I was never so wrong

He could import things, make everybody into Ronald McDonnald and random stuff

---

these are not mine

---

I’ve figured out how to manage all of the problems mentioned before but I still don’t know how to prevent this: He could teleport players to an obby and then he kicked me out from my own game.

I can imagine that with a strong server-side protection and extreme carefoul with remotes this will not be possible, but I would also like to know if is there some way to detect if player is about to be teleported, detect it an stop it. Any help or tip is wellcomed, thank you

[DrKittyWaffles (x64dbg)]

You probably have a “Backdoor” in your game. Basically just a malicious model.

Try these:

How to remove backdoors from your game

Hello, recently I’ve seen a lot of backdoor, exploit, and hack related posts on the DevForum. A couple of people asked me to release my method of removing backdoors because I usually respond to these posts with a help offering, and fix their games. I’m gonna list steps, strings, and ways to prevent getting your game backdoored. The main question of all is : “What is a backdoor?” A backdoor is something that exploiters use to gain server-sided (fully-replicated) access to your games. It is impo…

Removing Backdoors 101

My Method: Press CTRL + SHIFT + F The most common backdoors use require() So search for “Require” [require] Browse for anything out of the ordinary for example a part with a script in it should raise red flags [image] BUT Not all require scripts are bad. Many good scripts use require() For example adonis admin. [image] So if you see something suspicious open the script by clicking on it. If you are unsure about if its a backdoor. You can copy the ID [image] and paste it in here: htt…

[Rusiteblox]

Hello! Maybe… but not a model, I’ve reviewed all scripts in my game before releasing it

[Btkelley17 (Btkelley)]

Step 1:
Hit ctrl + shift + f

Step 2: Search for require

Look through the scripts, if its suspicious delete it.

[AsyncFunctions (Zach)]

The only way this is possible is through a backdoor. Inspect every script in your game and look for require, loadstring, and getfenv.

[Rusiteblox]

Hi! All of the scripts in the game was made by me and if I grabsomething from toolbox I clean it up always. There is no require anywhere and I don’t have suspicious script. My question was is there is some way to detect if a players is about to be teleported. I’ve read something like that a while ago but I can’t find it

[3rdhoan123 (Future Noob)]

Even if you believe its only your scripts, they have the ability to “hide” it inside the game, ensure ALL plugins currently installed, disabled or not, are made by the real developer.

[Rusiteblox]

I have those

[posatta (pasta)]

Those are all made by trustworthy people, it’s almost definitely not a plugin. Like UhOh said, try Ctrl+Shift+F-ing for keywords like loadstring, getfenv, setfenv, or TeleportService. If you can’t find anything, there’s other ways they could obfuscate it, so I’d do Ctrl+Shift+X(? I’m pretty sure that’s it), type “Script”, and look for any scripts you don’t remember writing.

[Rusiteblox]

Thank to you I discover a getfenv in a model in workspace… I cheked everywhing before realising it but the designer added this model and no body checked it. Thank you

---

---

[Rusiteblox]

Hi! what do you thing of this way of protecting the remoteevent?

[AsyncFunctions (Zach)]

This is not an issue with remotes, but it is always good practice to check everything on the server to protect against exploiters.

[Btkelley17 (Btkelley)]

I’m not sure what you are trying to do there?
The remote fires player automatically you don’t need to check if they are in the game.