When should I use remotes and how do I secure them?

The Wiki has a page on this with a Best Practices section. Take a look at the flow charts to see an example flow on how to properly use RemoteEvents to safely handle shop transactions.

I'm going to assume you meant remote events. They are by far the best "remote" to use, for reasons I don't need to go into.

Remotes are used mainly for when you want a local script to communicate with a server script and vise versa, with filtering enabled. So you may use them for like a local script informing a server script that the player just clicked. Another reason you may want to use them is to transfer tables between a local script and a server script, since there is no table instances like there are for bool values, number values, etc.

As for a way to secure them, there are many ways. Presuming you know how to use them, you can fire a remote event with one parameter of it being some sort of password, and have the script receiving it check to see if that variable is valid. If you want, you can make it so that the script that fired it sent the player it fired from (assuming its local script to server script) and kick that player if the variable is invalid.

Another way to secure them is for a server script to create a remote event and let the local script fire that one, and destroy it once it's been fired. I don't recommend this one as it may cause lag and is easy to get pass.

Over all the first one is the better choice, since hackers will have to access your place through studios to see it even has a "password" and figure it out. There may be better ways, but these were the only ones that would come to mind.