I'm having trouble with exploiters in my game, so far I've stopped them from removing their humanoid, and I'm attempting on creating a speed checker soon.
I've done some research and I've found some interesting things, and I have some questions for people who have been able to remove exploiters. For example, exploiters can disable and delete local scripts with anti-exploit stuff to detect walkspeed changes, etc. I can detect the localscript being deleted serverside but not it being disabled serverside.
How do I create these anti-exploits in localscripts if exploiters can easily bypass them? For example, my game is a sword fighting game and exploiters use a reach exploit to allow them to hit anyone far away, totally ruining the game. I could make a check for this with a local script, but then again exploiters can bypass the localscript and reach exploits can't be detected by server scripts either (tried already). I'm not sure what to do about them, any help is appreciated!

10 comments
Does this place have FilteringEnabled on?
Of course
testing for remote events and making sure all parts are locked (you can also test speed but most of the time roblox does that for you)
You cannot see things client side so you cannot really test for removed things (you can make it send a quick remote events though)
In that case, I would probably kick the user if something detects their anti-exploit client being removed or disabled as a "quick and easy" solution.
If you want to prevent against reach, simply check the distance between the player1 and player2 (check if the distance isn't too big) with a server script
@ScriptGuider I could detect the anti-exploit script being removed serverside, but not disabled, and if I made another localscript to check if it gets disabled exploiters could disable both localscripts. @RecommanderV2 I've been able to detect most client side stuff through localscripts, but exploiters can easily bypass the localscripts
Good idea @Kiriot22, thank you I'll try that now
I actually know a very easy way to prevent your anti exploit script from getting disabled, but I can't share it or I will get blacklisted from Synapse /shrug
They can, the you should kick players when they pass unvalid arguments trough the remote event (server side)