This won't prevent all cheating but at least will make it harder for the average cheat engine/ change variable hack. Follow the simple advise: Don't trust the client.
Now what does that mean? Usually those hacks are about either freezing variables (your health does not go down when hit) or increasing them (money, ammo, consumables). This works in games where we trust the client to hold all important logic and variables. So we don't use that at the server. All the client should send is Player got hit by whom and from what. It is now the servers job to verify and do the math. Is the hit bringing down enough health to kill the player? Did the attacker had the ressource to make the attack? Once verified, the server would sent the result back and the games continue. You can still use the client as a prediction for players that don't cheat. But it can happen that a few frames later you would need to revert when the true state comes from the server.
Now this won't prevent players who are using aim bots, view hacks, manipulating hit boxes or similar. But those are way harder to code compared to simply changing variables. If you want/ need to verify as well the physics, you do not need to render the full canvas on your server. Most of the time it is possible to run it in a
headless mode or