Anti-Cheat Leaderboards: How to Keep Rankings Honest

An anti-cheat leaderboard is one where the server, not the player, decides what a score is, where unusual results get reviewed with evidence, and where sandbagging (losing on purpose to look weaker) is treated as seriously as faked high scores. The rest of this guide shows how that works in practice, for game developers and for clubs and academies that run ranked athlete boards.

TL;DR

• Never trust a number sent by the player’s device. Have the server compute or verify every score before it reaches the board.
• Add plausibility checks, session evidence and statistical flags, then send borderline cases to a human.
• Sandbagging and boosting show up in match patterns, not single scores, so watch rating history and opponent pairings.
• Do not auto-delete scores for looking too good. Use independent evidence, and keep an appeal route.
• For sports leaderboards, tie rankings to coach-approved evidence such as assessed video and logged sessions.

Table of Contents

• What cheating on a leaderboard actually means
• How players manipulate scores and rankings
• The core rule: the server owns the score
• A layered checklist for developers
• Avoiding false positives and unfair removals
• What to do when you spot a suspicious score
• Anti-cheat thinking for club and academy leaderboards
• Run your club rankings on LevelUp360HQ
• FAQ
• Sources

What cheating on a leaderboard actually means

Cheating is breaking the rules to gain an unfair advantage. That is the working definition used in a 2022 paper on esports cheating, and it is a useful starting point because every board writes its own rules. What counts depends on the game, its rules and the community’s consensus, as Wikipedia’s overview of online-game cheating puts it.

In practice, written policies tend to list the same families of behaviour. TrueTrophies’ cheat policy names profile editors, game-file manipulation, profile swapping and linking an account that is not yours. World Strategy League’s Fair Play page adds engines or AI assistance, collusion to fix results, exploiting bugs and using scripts instead of real play.

Cheating versus sandbagging

A faked high score pushes you up the board. Sandbagging does the opposite on purpose: a player intentionally lowers their rating by losing games, often to enter a lower-rated tournament and dominate it for prizes. Chess.com files it under rating manipulation, alongside arranged results, multiple accounts and picking the wrong skill level on a new account.

Sandbagging is not the same as smurfing. Smurfing means creating a fresh account to play weaker opponents, while sandbagging manipulates an existing account’s rating, according to the Games Learning Society. The distinction matters for detection: smurfs are new accounts with suspiciously strong early results, sandbaggers are old accounts with a sudden, unexplained slide.

A sandbagger on a youth ladder usually wants one of three things: an easier bracket, a prize, or a confidence-friendly matchup. The motive changes the response. A teenager who tanks to avoid a tougher group needs a conversation. An adult gaming a prize tier needs a sanction.

How players manipulate scores and rankings

Knowing the attack tells you where to put the defence. The common methods fall into four groups.

Editing the submitted number. On browser games, the easiest leaderboard cheat is changing the score in a copied developer-tools request. A request that simply posts a final integer can be edited with tools the player already has, and it will be edited once a board carries any social currency.

Tampering with the running game. Harder, but possible: changing game memory to set a score or become invincible. This is where client-side anti-cheat software tries to fight for control.

Boosting and match farming. Two or more players collude so one inflates a rating, typically by recording matches where one deliberately loses to the other. The fingerprints include a tight pair who play each other far more than anyone else, a one-sided results split such as 95% for one player, and rating gains concentrated against the same few opponents.

De-levelling and smurfing. In Elo-style systems, de-levelling happens by starting a new account or by losing on purpose to take negative rating updates. Stat boosting needs the boosters to control the outcome, for instance by having a stronger player use the account or by being matched with friendly opponents.

Platform fixes alone rarely end this. In Dota 2, Valve required accounts to be linked to a phone number and new accounts to play 100 hours of unranked games before ranked. Hotspawn reports that ban waves of 45,000 to 90,000 accounts have not stopped smurfs, because bots clear the hour requirement and cheap phone numbers feed account resale.

The core rule: the server owns the score

A leaderboard is only as honest as the submission behind it. If the client sends a number and the server stores it, anyone can post any score. Client-side validation does not help, because a cheating client can bypass any check it performs.

Three design patterns follow, from strongest to lightest.

1. Server computes the score. One developer’s browser game sends guesses, never a score; the server works out the result. Another approach has the client submit its recorded input stream so the server can recompute the run, which closes almost every vector short of tampering with the simulation itself.
2. Server validates before writing. The server independently checks a submitted score before it touches the board. Supercraft makes the point that a valid login token is not score validation: a legitimate player can still submit a dishonest number if the API accepts client-authored scores.
3. Plausibility checks. For small teams without replay infrastructure, caps on score per second derived from the game’s theoretical maximum rate, and run-duration checks against the fastest possible clear time, catch most casual attempts.

Some limits are physical. A browser map game must send enough imagery data to display it, so client-side restrictions cannot make that information secret. Design assuming the player can see everything the client sees.

A layered checklist for developers

Riot Games’ anti-cheat team describes prevention, detection and deterrence as three separate jobs: stop what you can, catch what you cannot stop, and use penalties to encourage restraint. A leaderboard needs all three.

Safeguard’s list adds submission caps per account and per run token, tiered boards, and review of the top ranks before prizes are awarded. It also advises labelling rankings you cannot verify, which is an honest fallback when full validation is out of reach.

On the statistics side, Bugnet describes flagging scores more than three standard deviations above the mean and watching score velocity for sudden jumps up the ranking. Pair that with the session logs that prove a session actually happened.

Catching sandbagging specifically

Sandbagging hides in time series. Useful signals include a steep rating drop with no change in opponents or play time, a run of losses that end just before a bracket cut-off, and a sudden recovery after entry closes. Team Up’s boosting fingerprints work in reverse here: look for the same opponent pairings and lopsided results ahead of a drop.

Prevention is cheaper than detection. Lock bracket placement to a rating snapshot taken well before entry, as many chess-style organisations do through rules against deliberately losing to lower your rating, so there is nothing to gain from tanking in the final week.

Avoiding false positives and unfair removals

A board that punishes its best players is worse than one with a few cheaters. Anti-cheat must detect illicit behaviour without punishing legitimate players: lag, telemetry errors, legitimate software or hardware quirks can all look odd. The recommended answer is to combine independent indicators, look at continuity over time, and demand stronger evidence for heavier sanctions.

Some teams go further. One browser-game developer says it does not automatically discard scores for looking too good, because such rules catch the best real players first. Bounds catch nonsense, not cheating: a cap can reject 999999999 but cannot prove a plausible 48,210 was legal.

A very accurate result also is not proof. A player may simply know the location, so there is a difference between validating a submitted result and establishing how the player reached it, and each needs different evidence.

Bans need a standard of proof too. A community-server operator argues that upholding bans on an admin’s recollection leaves no evidentiary standard, and that players who see no point in appealing quietly leave. Write down what evidence is required, record it, and let players answer it.

What to do when you spot a suspicious score

Whether you are a player, a coach or a club admin, the same sequence keeps things fair.

1. Check the rules first. What counts as cheating depends on the game’s own policy, so read it before accusing anyone.
2. Gather evidence, not impressions. Note the score, the date, the opponent pairings and any replay or video. An unusually strong result alone proves nothing.
3. Report through the official route rather than posting accusations publicly. Organisers can only act on evidence they can verify.
4. Expect proportionate outcomes. Published policies describe a ladder: invalidated matches, rating adjustments, removal from rankings, suspension, then permanent bans for severe or repeated violations. Some boards park a suspect account in a status that omits it from all rankings while the matter is looked at.
5. If a board is compromised, say so. Supercraft’s advice is to freeze or retire the affected season, fix where the server trusts the client, and publish a clean season instead of pretending old ranks still mean something.

For youth sport, add a parent or guardian to the conversation before any sanction is discussed with a young athlete.

Anti-cheat thinking for club and academy leaderboards

A ranked board in a club is not the same threat model as a public game. The athletes know each other, the coach sees the training, and the prizes are often a place in a squad or a tier badge. Two things carry over from game design directly: rankings should depend on evidence the athlete cannot simply type in, and results should be linked to a verified account.

Gaming of systems is not limited to scores. Clubs also see members use automation to jump a queue, as in this look at automated tee-time booking advantage. The principle is the same: clear club-controlled rules, verified members and limits on repeated attempts keep access fair.

Our perspective

Most leaderboard cheating comes from one design mistake: a ranking that rewards a number nobody checked. In sport, we have an advantage game studios lack. There is a coach in the room, and there is video.

That is why we built LevelUp360HQ around live player cards, XP challenges and tier progression that sit alongside coach video assessments and approval workflows, so a rating can be backed by something a coach has actually reviewed. We designed it so an athlete owns their development, and the club keeps oversight, with youth safeguarding built in.

Our view: a leaderboard should motivate the whole squad, including the athlete in the middle of the table. Evidence-backed ratings, visible tiers and a fair review route do that better than any penalty after the fact.

Chris

Run your club rankings on LevelUp360HQ

LevelUp360HQ is a gamified athlete development platform for clubs, academies, coaches, athletes and parents, covering football, cricket, netball, rugby and more. Clubs get FIFA-style player cards with real-time ratings, XP-driven challenges, badges, leaderboards, session management and coach approval workflows, plus white-label branding, CRM and subscription tools.

The Pro plan is £49 per month, with an active athlete platform fee of £1.50 per month per active athlete. A revenue share applies to integrated payments, with no published price. See the details on the LevelUp360HQ pricing and demo page.

If you want the full picture first, start from the LevelUp360HQ home page.

FAQ

What is the difference between cheating and sandbagging?

Cheating is any rule-breaking that gives an unfair advantage, such as editing scores or using unauthorised software. Sandbagging is a specific kind of rating manipulation: deliberately losing or underperforming to look weaker, then dominating easier opponents or brackets. Both are usually banned under a board’s fair play rules.

What is the most reliable way to stop fake scores?

Stop the client from deciding the score. Have the server compute it, or recompute it from recorded inputs, before writing to the board. Where that is not possible, plausibility checks and submission caps catch most casual attempts.

Should suspicious scores be deleted automatically?

Not on looks alone. Strong performances, lag and telemetry errors can all look unusual, so combine independent indicators and look at behaviour over time. Reserve heavier sanctions for stronger evidence, and give players a way to appeal.

How do you spot boosting on a ranked ladder?

Look for the same two players meeting far more often than anyone else, very one-sided results between them, and rating gains concentrated against a handful of opponents. Review those pairs by hand before acting.

Sources

• The dark side of e-sports: an analysis of cheating
• Cheating in online games, Wikipedia
• TrueTrophies Cheat Policy
• World Strategy League Fair Play
• What is a Sandbagger? Chess.com Help Center
• What does sandbagging mean in gaming? Games Learning Society
• How browser game leaderboards get cheated
• Server-Side Leaderboard Validation, Flukz devlog
• Detecting Smurfs, Boosting and Farming on Leaderboards
• Elo rating systems and how to manipulate them
• What Is Smurfing In Dota 2? Hotspawn
• Keeping leaderboards honest: score submission integrity
• Debugging Leaderboard Score Anomalies, Bugnet
• Leaderboard Cheating: Validate Scores Server-Side
• How EarthGuessr Validates Guesses and Scores
• Removing Cheaters from LoL, Riot Games
• False Positives: When an Anti-Cheat Can Be Wrong, UIS OFBR
• Ban Appeals: A Process That Isn’t a Popularity Contest
• RetroAchievements Global Leaderboard rules
• Automated tee-time booking advantage