If you watch this video you can see that an exploiter attaches himself to Alvin Blox while he was playing my game (the green guy at about 6:00 mins in).
How can I stop exploiters from being able to do that?
https://www.twitch.tv/videos/796399654
Thanks in advance!
It’s hard to know what “method” they were using just from that video, could be body movers or just cframing. In both cases there isn’t really an easy way to detect this on the server (that I know of).
If they were using body movers you could just have a simple LocalScript, this would then continously scan the player for any body movers that shouldn’t be there, and then remove them.
@Jhxan - Thanks! Is that similar to how in many games they make a pet follow you? (Just looking for a starting point in the research).
I would assume so, it’s really just a matter of having a BodyPosition in an object and then updating the Position property to wherever the target is.
Players have network ownership over their characters, meaning that any movement they do on their computer, it’s replicated on the server. What you can do is add some server checks to see if the players are moving in a weird way. A good way to check this particular problem is to check how far and in how much time the player is moving around.
The player seem to keep about the same offset at all times, so check the offset from the weird player to the target player, if it’s constantly similar while the target player is moving around, chances are the player is hacking.
Another check is on how much a player instantly teleports. As you can see, when alvinblox fell and respawned, the other guy instantly teleported to the spawn, you can detect this easly.
When an hacker is found, kick them for duspicious activity and put them into an “hacker only” matchmaking. This way hackers will play with other hackers and you wont lose potential profit from hackers. If someone dumb enough to buy hacks, they are probably going to buy your gamepasses too.
As @Jhxan suggested, you could use a LocalScript, and in some cases that might be the best available option. If they are only using a generic exploiting script that is supposed to work for all Roblox games, this could be effective. The downside is LocalScripts run client side, and if you have an exploiter that is actively trying to exploit your game, they can modify anything client side.
As @Orodex just now suggested, creating an anti-teleport server side script is a very viable option. I don’t know much about your particular game, but from what little I saw in the video it looks like an obby type game. You could track whether or not the player has met various checkpoints, and if they have not met those checkpoints disconnect them from the game. There are various ways to go about this. Basically you just need to use the server to track player behavior that would be impossible for an actual player to perform.
I would caution against ever allowing a script to put a player in a ban list. Anti-exploit scripts are very very useful, but they are not infallible. Lag and odd physics collisions could result in something that looked like exploiting to a script for example.
Hello. It appears that the exploiter is using a follow script. I believe I known the script which he uses. It could be the same one used by the “stalker” bots. Here is a video of it
you can make a passive anti-cheat that prevents BodyMovers, BodyGyro, and so on and so fourth, but what is being used here is setting the HumanoidRootPart CFrame to Alvin blox’s HumanoidRootPart CFrame, the laginess that you would experience in the video sample above is because the server replication is delayed, in this case, make an anti teleport, (Serversided), it will stop them from finishing the course instantly and also clinging onto people causes them to fling off the map effectively killing them, player collision could become an option but it doesn’t seem like your game needs it, considering its an obby, physics should be considered, make an anti teleport use logical math calculations such as Velocity and WalkSpeed, WalkSpeed is calculated now-a days as how fast can the player travel in a specific interval, but neither the less, it is 16 studs, you should add around ~3 extra on the capped limit in order to not false flag, as well if you check if they are in the air or they are doing some sort of velocity boost that may go past the capped speed limit of your anti-cheat
DONT forget: use logical calculation’s consult someone who has CRAZY math skills like AxisAngle (he is like a PhD in math and psychics in my opinion, he is crazy good at math, check some of his games out, the plane and gun demo is impressive for 2010-2014 at its time!)
good luck on keeping though exploiters out 
Adding on to this, regardless of how good your math is, please anticipate false positives. The last thing you want to do is punish a player who gets flung accidentally (it happens), or the server gets tripped up by someone who’s lagging.