Why can’t anti-exploits be client-sided?

If people exploiting is a huge deal, then get some mods to make sure the servers stay clear of exploiters.

1 Like

In my experience making a anti cheat is useless and a waste of time, let the Roblox staff handle that.

Exploiters on one of my games typically use basic walkspeed and fly scripts which can be easily detected on a local script.

To be fair, though, it does typically have over 100 players at a time and earning money or getting on the ranked leaderboard can get competitive at times, meaning that patching them won’t necessarily stop script kiddies who know what they’re doing from distributing damaging scripts in the future.

I do not agree with this on games that save stats and require grinding to compete with other players or exploits that could destroy servers like fling scripts.

Exploiters only have access over their client (They can’t mess properties on other players, such as flinging other players with platformstand unless if you have a remote event that does that.)

They can see what we can see in the explorer while testing in studio. (If they’re using Dex)

1 Like

Yes, but there is one exception where players have been able to fling players using physics by spinning their characters extremely fast and walking up to players or by using network ownership on other parts to modify their physics on the client.

The first issue can technically be solved by turning off player-to-player collisions, though.

1 Like

True, and the fact that a server-sided anti cheat can’t see/detect a instance created by a client. (Which makes it more difficult to making a accurate server-sided anti cheat)

1 Like

You can always just hide your checks inside a really big script and periodically change its location, but that is probably the best you can do

1 Like

All I can do to fight back to exploiters is just add “security checks” to the remote event scripts.

You can actually, 99% of exploiters are skids downloading scripts off v3rmillion or youtube videos, and don’t know a thing about actually hacking Roblox games so they will usually be clueless to LocalScripts that have security checks. Depending on the size of your game however, exploit developers who make game-specific scripts will likely be aware of these measures and render them useless.

Nonetheless, basic client-side detections for things like BodyMover instances can render most fly scripts useless, there are other things you can pick up on to, any exploit scripts that create specifically named Instances within access of Roblox scripts (not in CoreGui) are detectable as well.

4 Likes

Most fly scripts use PlatformStand, I noticed this 2 weeks ago that you can detect local/client changes on PlatformStand with a server/local script.

1 Like