You really should tell us how this is being constructed as different technologies can have different advantages to your situation. Is it in Flash? PHP? HTML5? JavaSript? Java? The "web" tag doesn't give us much to go off.
That being said:
One of the most secure ways to transmit points score is to not let the client side decide what those points are. What you want is to create points based events:
Willem killed a zombie! - Score_KillZombie
Willem looted a zombie! - Score_LootZombie
Willem became a zombie! - Score_OopsIAmZombie
These could be represented as enums in your client and get transmitted to the server on a per score event basis. You just killed a zombie? Excellent take the zombies ID - apply the killed zombie event and send this packet of info to the server. The server then confirms the actions - keeps tally of the score and confirms this with the client side so it can display it.
The zombie having an ID prevents your players from replicating any ID's they can't send Score_KillZombie on a zombie ID "10000000" that your server knows isn't there or already dead. They can also not reloot a zombie that your server flags as empty of loot.
These situations go on and on but the important thing is that you give your server all the control on what actually is set in the game environment. Your client should simply tell the server what predefined event has happened and the server itself will decide if the client is lying or not (remember - it doesn't always have to listen to a client - that's where it weeds out any cheaters.)
Pretty much any implementation of a web game that relies on interaction with a client-server model does this predefined event driven approach. FPS's tell the server when they have shot and in which direction - the server decides if it actually hit the player. MMO's tell the server who their target it is and what spell they want to cast - the server decides if they have enough mana and are in range to do so, reporting back if the target dies. Even Facebook apps will authenticate actions like in Marvel Avengers, sending a move and the target bad guy, the server will decide how much damage it did and what the bad guy does as a reaction.
In conclusion
Never let the client make any authoritative decisions.