How does Hacking work on roblox so I can prevent it?[SOLVED]

I need help on how hacking works on roblox so I don't feel the need to use 'Remote Function' and 'Remote Events'

You should feel the need to use Remote Events and Remote Functions. But use them safely.

Essentially, an exploiter would take advantage of what the game trusts the player to process locally, rather than on the server.

One example is movement. The player's movement is always trusted by the server. This is why exploiters can make their movement speed extremely high, jump very high or even sometimes fly - all while FilteringEnabled is on. If you want to prevent something like this, you could detect unusual changes in player movement, like walking over the default walkspeed.

Before FilteringEnabled was forced, exploiters could pretty much rule your entire game. When they make any changes on their client (which is easy for them), all changes would be replicated to the server. This means they can spawn in whatever they like and it would actually be valid. They could kill players, change their own money, etc.

But with FilteringEnabled, if they try to kill a player, it will only kill them on their screen (if at all), and nobody else would see anything change. If they try to spawn in a huge nuclear bomb that wipes out the map, only the exploiter would see it and the server wouldn't make any of those changes, meaning everyone else can continue to play normally.

With that being said, having client-server communication requires the usage of Remote Events and Remote Functions. You have to be safe though; if you have a Remote Event that takes in the number of coins as a parameter like this:

RemoteEvent.OnServerEvent:Connect(function(player, coins)
	givePlayerCoins(player, coins)
end)

Then the exploiter could simply fire the event with any number they like as the parameter:

RemoteEvent:FireServer(999999)

Poof. They are now the richest person on the block.

To prevent this, you need to make proper checks on the server side to ensure that the event is really true.

Let's say we have a Gun tool. Once clicked, a remote event will be fired that shoots a bullet from the gun, reduces the ammo and damages any player it touches. Locally, you check to make sure that the gun has enough ammo to shoot before sending the event.

If an exploiter found that remote event, they could keep firing the event without even having the gun, meaning they could non-stop fire bullets.

To prevent this, you could check on the server side as well - is the player holding the proper gun? Does the player have at least (1) ammo left?

Performing these checks on the server would prevent the exploiter from firing thousands of bullets per second by spamming that remote event.

I hope this gives you a better understanding on protecting your game! :)

A person can use fn+F9 or ctrl+f9 and go the client or server part of the gui that appears and type any code he/she wants to execute. The only way to block this from happening is to turn filtering enabled on. Click on "Workspace" go the properties and check filtering enabled. Some of your script may break if they are not compatible with filtering enabled because it could assume that a player is giving a command although it is a script.