Anti-Cheat Roblox: Speed Hack and Teleport Hack Detector
ESCOPO
Generate a server-side anti-cheat system to monitor impossible movement, suspicious speed changes, and unauthorized teleports. The prompt prioritizes reducing false positives, taking into account lag, spawning, vehicles, moving platforms, legitimate teleports, and special character states.
Ideal for developers who need a professional, extensible detection foundation in Roblox Studio. The requested result includes a complete, commented, configurable Luau Script ready to be placed in ServerScriptService, plus guidance for testing and integration with the actual game structure.
Conteudo
Prompt principal
Act as a senior Roblox Luau developer, specialized in multiplayer security, server-authoritative systems, and exploit mitigation. Create a complete Luau Script to reliably detect speed hack and teleport hack on the server, ready to paste into Roblox Studio. Before writing the code, consider the context of my game below. Use the provided names and paths when relevant. If any data is missing, assume a safe implementation and keep constants/configurations clear at the top of the script, without inventing required dependencies. MY GAME CONTEXT (I will fill in): - Game place/name/genre: [PREENCHER] - Relevant objects, folders, and paths in Explorer: [PREENCHER] - Existing RemoteEvents/RemoteFunctions and their respective purposes: [PREENCHER] - Special movement system (dash, sprint, double jump, grapple, flight, knockback etc.): [PREENCHER] - Legitimate forms of teleport (portals, checkpoints, admin commands, cutscenes, teleport between areas): [PREENCHER] - Vehicles, seats, moving platforms, or mounted characters: [PREENCHER] - Desired action when suspicion is detected (log only, warn, reset position, kick after repeat offenses): [PREENCHER] - Desired limits, if already defined (WalkSpeed, maximum distance, strikes): [PREENCHER] SCRIPT TYPE AND LOCATION: generate a single server Script to be placed in ServerScriptService, for example named AntiMovementExploitDetector.server.lua. Do not create a LocalScript as the authority mechanism. If you recommend an optional RemoteEvent or ModuleScript for future integration, explain that after the code, but the main script must work on its own using native Roblox services. MANDATORY TECHNICAL REQUIREMENTS: 1. Monitor players on the server using Players, RunService, and HumanoidRootPart/AssemblyLinearVelocity, without trusting values sent by the client. 2. Detect speed hack by horizontal displacement incompatible with elapsed time and the allowed WalkSpeed, applying a configurable margin for latency, physics, and small frame variations. Do not use a simplistic rule that compares only Humanoid.WalkSpeed, since exploiters can alter movement without necessarily changing that property on the server. 3. Detect teleport hack by position jumps above a configurable distance within a short interval, but avoid false positives on spawn, respawn, streaming, falls, ragdoll states, seats/vehicles, moving platforms, and approved teleports. 4. Include a central configuration at the top: sampling interval, tolerance multipliers, maximum horizontal speed, maximum jump distance, strike count, strike window, detection cooldown, Debug mode, and disciplinary action. Document each option in comments. 5. Implement per-player state, with last valid position, last measurement time, strike count, and timestamps. Perform full cleanup in PlayerRemoving, CharacterRemoving, and when a new Character is loaded, avoiding memory leaks and duplicate connections. 6. Create a simple, documented server-side API to authorize legitimate teleports: for example, a clearly identified local function or use of Attributes on the Player/Character such as AllowServerTeleportUntil. Show how other server Scripts can mark a temporary exception before changing CFrame/PivotTo. Never allow a LocalScript or client RemoteEvent to grant this authorization. 7. When a violation occurs, log a detailed warning on the server containing UserId, name, suspicion type, distance, calculated speed, applied tolerance, and strikes. The default response must be safe and configurable: restore the last valid position when possible and only kick after repeated offenses. Do not apply permanent bans or DataStore automatically. 8. If the game has RemoteEvents related to dash, sprint, or teleport, explain how to validate them on the server: rate limits, distance, character state, permissions, and destination position. All RemoteEvent/RemoteFunction input must be validated on the server; never trust the client for damage, currency, inventory, speed, position, or teleport authorization. 9. The code must use modern Luau, clear names, useful comments, nil checks, and correct handling of Character, Humanoid, and HumanoidRootPart. Avoid unnecessarily expensive per-player loops and do not use obsolete APIs. REQUIRED RESPONSE FORMAT: - Start with a short summary of the strategy and the inevitable limitations of anti-cheat in Roblox. - Deliver the full code in a single markdown block identified exactly as ```lua. The code must be complete, with no pseudocode, no omitted snippets, and ready to paste into ServerScriptService. - After the code, explain which constants I should calibrate for my game and provide server-side integration examples for a portal/checkpoint and for a legitimate dash ability. - End with objective instructions for testing in Roblox Studio using Start Server with multiple Players, respawn tests, simulated lag, vehicles, and legitimate teleport. Also explain how to check the logs in Output. Prioritize accuracy, security, and a low incidence of false positives. If there is a conflict between punishing aggressively and avoiding punishing legitimate players, prefer logging, applying gradual strikes, and making the limits configurable.
