how do exploiters fly in my roblox game and how do i stop it?

One thing I'd add on the server side: never trust what the client sends through RemoteEvents either. If you've got a remote like "give coins" or "complete stage", the server should check the player could actually have done that. Exploiters fire remotes directly, flying is just the visible part.

every player's client owns the physics of their own character, so whatever position their client says it's at gets replicated to the server. that's why they can fly without touching any of your scripts. for an obby there's a simpler fix than position checks. make the server own progress: touching stage 12 only counts if the server already has them on stage 11, and if they got there quicker than is possible, send them back. then flying just doesn't get them anything. if you add a fly check on top, give it some slack. laggy players rubberband and you don't want to kick them.