Roblox has more kid users than any other platform, and gets a reputation it partly deserves. With the right account settings, it's reasonably safe; with defaults, it's genuinely risky. Do these steps.
Settings → Account Info. You can't change birthday after the fact — if it's wrong, contact Roblox support to reset, then recreate with the correct date.
Settings → Security → Parent PIN → Enable. Pick a 4-digit PIN. This is what locks the rest of the settings you're about to set.
Settings → Parental Controls → Account Restrictions → On. This limits the account to curated games, blocks chat, and disables friend requests from strangers.
Parental Controls → Allowed Experiences. Choose the age band — Minimal, Mild, Moderate. Start strict; loosen if needed.
Privacy → Who can chat with me in apps → Friends, and Who can chat with me in games → No one. In-game voice/text with strangers is where the worst stuff happens.
Privacy → Who can message me → Friends. DMs are the other major vector.
Every name on the list should be a real person your kid can identify. Unknown usernames get removed — no negotiation.
Billing → Spend Limit. Even small Robux purchases add up — most parents set this lower than they'd guess.
Once a month, scan logins and purchases together. This is less surveillance, more "did something weird happen" — and it models good habits.