How to stop exploiters from spamming remote events?

[Ziaoscythe (Kuyoo)]

so I have some ability’s I have made and they all use remote Events
and I’m aware that exploiters can spam them I’ve looked on the dev forum but I don’t really understand and I just started scripting a month ago so this is new to me.
Help would be much apricated!

[BobygoWasTaken (bobygo)]

make a system that uses disables scripts, for example in a script instead of firing a remote event make it clone a disabled script that has the function needed and then enable it, once the job is done make the script delete itself.

[dthecoolest]

For a simple prevent spam method you can use a server side remote flood check or rate limiter.

Rate limiter module for Remotes

Hello there! Exploiters often try to spam your remotes to see if they exceed the limit the server can handle and causing it to crash. In general, it is good practice to limit the rate of your remotes to prevent that behavior. This module should make this process very easy for you. What it does: This module I made allows you to easily set a maximum request rate for your RemoteEvents or RemoteFunctions. With this module, you can simply ignore requests if your set maximum rate is exceeded by the…

[OfficialPogCat (POG_Cat)]

I mean if you can, adding cooldowns in the server script might be helpful. (I’m assuming that the remote event is client to server, if not let me know!)

Doing something like

local db = {}

Event.OnServerEvent:Connect(function(player)
if table.find(db, player.Name) == nil then
table.insert(db, player.Name)
task.wait(5)
table.remove(db, table.find(db, player.Name) )
       end
end)

Makes it so it can’t be fired for 5 seconds again. (I wrote this script on mobile, so it might not be entirely correct, but the concept is hopefully correct)

[Kyl3ST]

tbh bet both the rate limiter is the most securised one i know .

[Azul_Cult (黒死病)]

While it’s true it’s possible that an exploiter can do that, the chances are very low, super low, for someone to join you game and do that. If that doesn’t reassure you then I suggest you to only create the remote event for its intended purpose then delete it right after so there is no remote event for an exploiter to spam and use.

[Roebechaux (sofia)]

I don’t think using scripts and playing with the disabled property is a good idea, you can either do like @OfficialPogCat said with a debounce or just check in the server if the player is actually meant to fire the remote

[absentdenik (dauser)]

Clean version in my opinion, however it drops every request, even if function wasnt executed.

local db = {}
local debounce = 2
Event.OnServerEvent:Connect(function(plr)
    if table.find(db, plr) then
        return
    end
    table.insert(db, plr)
    task.delay(debounce, function()
        table.remove(db, table.find(db, plr))
    end)
end

I still prefer creating tick based debounce systems for each project.

[alksjdfl (ephemeralspirit)]

This is the best way and what I personally use, but I recommend os.clock() over task.delay()

local db = {}
local debounce = 2
Event.OnServerEvent:Connect(function(plr)
    if os.clock() - (db[plr] or 0) < debounce then
        return
    end
    db[plr] = os.clock()
    -- Your code here
end

Since this is all server-side, there’s no way an exploiter can bypass this.
Also you misspelled OnServerEvent as OnServiceEvent and you forgot to table.insert the player into db so it would actually work.