Web security is hard, especially in Javascript where all the code is locally viewable. However the size of Construct 2's engine actually works to something of an advantage here: it's so big, and all obfuscated by Closure Compiler, that it can actually be quite a lot of work just to find out where the relevant code for posting a score will be.
The most important thing IMO is not to have a single URL where you post a score, i.e. game.com/submit.php That's trivially controllable. You should make it more complicated than that, e.g. introduce a back-and-forth (so there are multiple posts with other processing/logic steps in between). Then at least the bar is raised from being able to find or emulate the javascript logic running that rather than being able to enter a single URL. Then there are some cheap tricks you can throw in like appending the URL from individual characters so the URL isn't directly viewable in the source. Combine that with some other ideas in this thread and you should be able to make it script-kiddy proof, but I still wouldn't pretend it's actually secure, it's just obscure. If you put a prize on a highscore, even with these methods the prize would probably provide enough motivation for someone to crack it. You should avoid giving prizes for highscores, unless you require substantial proof like a complete playthrough video, which would be a pain.