The short answer
A score sent from a browser is a claim, not a fact. Anyone motivated can send whatever number they like, and if there is a prize, somebody will.
How much you invest in preventing that should follow the value of the prize.
Proportionate responses
| Prize value | Reasonable approach |
|---|---|
| None, just a score | Accept it, sanity check extremes |
| Small or token | Basic validation and manual review of winners |
| Significant | Server validation or replay verification |
| Substantial | Verify winners individually before awarding |
| Any | Terms allowing you to disqualify |
The bottom row costs nothing and is the most useful. Clear terms permitting disqualification let you act without argument.
Basic checks worth having
- Reject scores above what is physically achievable.
- Reject impossibly short completion times.
- Rate limit submissions per player.
- Record enough to review a suspicious entry.
- Verify before awarding rather than after publishing.
Point five avoids the worst outcome, which is announcing a winner publicly and then withdrawing it.
Server validation where it matters
For substantial prizes, the server needs either to run the game logic or to verify a recorded sequence of inputs that reproduces the score.
That is real work and is only justified where the prize warrants it. For most campaign games it does not.
Decide the rules beforehand
- How the winner is determined
- What happens if a score cannot be verified
- Whether multiple entries are allowed
- When the competition closes, precisely
- Who decides in a dispute
Writing these down before launch turns a dispute into a reference to the rules rather than a negotiation you will lose publicly.