Client & Server hitboxes both have their drawbacks. Use client hitboxes if you want mediorce security (you can only do approximate checks on the server) & seamless gameplay smoothness. Use server hitboxes for high security, at the expense of accuracy. (laggier players will have a major disadvantage)
For your question, I’d recommend going with client hitboxes, because:
- Attackers get a WYSIWYG (What You See Is What You Get) experience.
- Depending on your implementation, they can also be quite secure. Trust the client as little as possible.
- Most roblox games do it, and on the most part, they have no exploiter problems.
However: if you care A LOT about security and seamlessness, and willing to spend a medium-to-large amount of time, consider this:
Lag compensation
In short, lag compensation plays around with the 4th dimension (time) to calculate what your client should’ve been seeing at an x timestamp, fully on the server. This is done by interpolating between snapshots.
Various AAA games use this method, such as COD, Valorant, Fortnite, CS, etc.
I’m not the best teacher to explain you how it works, but there are countless articles and youtube videos on how it’s done.
I am doing something similar in my roblox game too, but I don’t recommend doing this if your game is already big, as it will require a lot of rewriting and studying.
Summary
Don’t do server hitboxes. It’s insanely inaccurate & massively nerfs laggy players. Either try to mix client hitboxes with alot of server sanity checks, or consider adding lag compensation.