Server side AC is hard, yes, but it’s not less effective than client-side… As it’s security by obfuscation. If you can’t genuinely detect from server view the difference between an human and a cheater, that means a cheater can create a cheat controller (either hid spoof or even mechanicallly moving a mouse) that will spoof the client side too.
NEVER TRUST USER INPUT.
Bohdi linux. smoll and beautiful. Used to run it on my eeepc 701