The short answer
The most effective anti-cheat for a small multiplayer game is an authoritative server that validates everything players send and never shares information they should not have. Add free or low-cost layers on top: Easy Anti-Cheat or VAC on PC, Google Play Integrity and Apple App Attest on mobile, server-side purchase validation, and player reporting with replays. Spend on heavier tools only for competitive, ranked modes where cheating directly ruins the experience.
Layer 1: never trust the client
If a player's device decides who won, someone will change it. In an authoritative design, clients send inputs, such as "move forward" or "fire", and the server decides the results. This one decision blocks the most common cheats: speed hacks, teleporting, infinite currency and changed damage values.
- Validate movement against maximum speed and collision.
- Enforce cooldowns, ammo and resources on the server.
- Calculate damage and rewards on the server.
- Validate every purchase and reward grant on the server.
Our comparison of Photon, Netcode and Mirror explains which stacks support server authority.
Layer 2: do not leak information
Wallhacks and map hacks work because the client knows things the player should not see. Where practical, only send positions of enemies a player can actually perceive, and never send hidden cards, future loot or other players' private data. This is cheaper to design in early than to retrofit.
Layer 3: sanity checks and rate limits
- Flag impossible stats: accuracy, kill rates or scores far outside normal ranges.
- Rate-limit actions and API calls to slow bots.
- Log match events so suspicious results can be reviewed and replayed.
Layer 4: client-side anti-cheat on PC
| Tool | What it is | Notes |
|---|---|---|
| Easy Anti-Cheat | Client and server anti-cheat from Epic | Available free to developers through Epic Online Services |
| Valve Anti-Cheat (VAC) | Steam's anti-cheat for multiplayer games | Available to Steamworks partners; see Valve's documentation |
| Commercial alternatives | Third-party anti-cheat services | Licensed; consider for high-stakes competitive games |
Client anti-cheat raises the effort needed to cheat but never replaces server authority. Kernel-level solutions are powerful but raise privacy, compatibility and Steam Deck considerations; weigh them carefully for a small game.
Layer 5: device integrity on mobile
On Android, the Play Integrity API helps your server confirm requests come from your genuine app on a genuine device. On iOS, App Attest does the same for Apple devices. Use them for high-value actions such as ranked results and purchases, and handle failures gracefully, since some legitimate devices fail checks.
Layer 6: purchases
Validate App Store and Google Play receipts on your server before granting premium items. Client-only purchase checks are one of the easiest things to bypass on mobile.
Layer 7: community
- In-game reporting with a reason and the match ID.
- Replays or logs reviewers can check.
- Clear, published rules and a ban policy with appeals.
- Shadow queues that match suspected cheaters with each other, used carefully.
Common cheats and the layer that stops them
| Cheat | What it does | Main defence |
|---|---|---|
| Speed hack or teleport | Moves faster than allowed | Server movement validation |
| Aimbot | Aims automatically | Client anti-cheat on PC, statistical review, reporting |
| Wallhack or map hack | Shows hidden players or items | Do not send hidden information to the client |
| Currency or item hack | Edits local values | Economy on the server; client values are display only |
| Fake purchases | Spoofs store receipts | Server-side receipt validation |
| Bots and farming | Automates play for rewards | Rate limits, device integrity, behaviour analysis |
| Modified client | A tampered app talks to your server | Play Integrity and App Attest on mobile; anti-cheat on PC |
Measuring the problem
Before buying tools, measure. Track reports per thousand matches, the share of top leaderboard scores that look impossible, and how quickly cheaters reappear after bans. These numbers tell you whether cheating is a real problem for your players or a fear, and they show whether each new layer actually helps.
What not to waste money on
- Obfuscation as a solution: it slows cheat makers down, but determined ones get through. Treat it as a speed bump.
- Heavy client anti-cheat in casual co-op: if cheating only affects the cheater, the cost and friction may not be worth it.
- Fighting every cheat at once: watch reports and data, then fix what players actually encounter.
Match the protection to the mode
| Mode | Recommended protection |
|---|---|
| Casual co-op | Server validation of rewards and purchases; reporting |
| Casual competitive | Server authority, sanity checks, reporting, device integrity on mobile |
| Ranked competitive | All of the above, plus client anti-cheat on PC, replays and active review |
Handling bans fairly
False positives hurt honest players and reviews. Start with temporary restrictions for automated flags, keep permanent bans for confirmed cases reviewed by a person, and offer a simple appeal route. Explain the rules in plain language. Fair, visible enforcement deters cheaters more than secret tools do.
Building it in from the start
We design multiplayer games with server authority and validation from the first prototype, so anti-cheat is cheap rather than a late rewrite. See multiplayer FPS development or our multiplayer cost guide.
Sources: Epic Online Services: Easy Anti-Cheat · Steamworks: anti-cheat · Android: Play Integrity API · Apple: App Attest · Unity: Netcode documentation. Checked October 20, 2026.
Related: Multiplayer FPS development · PC game development · Get a quote
Originally published on A Plus Games Studio, a game, AR and VR development studio in Sacramento, CA.
Top comments (0)