Glossary · Incidents and alerting

What is a false positive?

A false positive in monitoring is an alert that reports a problem when there isn’t one, such as a site reported as down that was working for its users.

How it works and why it matters

Common causes are a single network hiccup between the check location and the server, timeouts set too short, firewalls, CDNs or bot protection blocking the monitor, rate limits, and content checks on text that changes.

False positives cost more than the interruption: they teach people to doubt alerts, which slows the response to real ones (alert fatigue). A false negative, a real outage that is never alerted, is the opposite failure, and tuning hard against one can cause the other.

Confirming a failure with a second check removes most network blips. Allowing the monitor’s IP addresses or user agent through firewalls removes blocks.

How Uptimecheck helps

Uptimecheck repeats a failed check 10 seconds later before an incident opens, so a single blip never alerts; it shows as a re-check in the latest checks. Every incident keeps the failing response, with a screenshot or a traceroute, so you can see why it failed, and the firewall article lists the addresses and the user agent to allow.

See Uptime monitoring

14-day free trial · No credit card required

Read more in the guides

Guides 7 min read

How to Reduce False Alerts in Uptime Monitoring

False alerts teach teams to ignore monitoring. How to cut the noise: confirm every failure with a second check, set sensible timeouts, validate the right URL and route alerts to the people who can act.

Read

Questions

Why does my monitor say down when the site works for me?

Usually something between the monitor and the server blocks it or treats it differently: a firewall, a CDN’s bot protection, geo-blocking or a rate limit. The response saved with the incident shows which; a 403 or a challenge page points at blocking.

What is a false negative?

An outage that monitoring missed, for example a page that returns 200 with an error message on it. Content checks catch those.

How do I reduce false positives?

Confirm failures before alerting, set realistic timeouts, let the monitor through firewalls, and check for stable text rather than content that changes.

Downtime is obsolete.

Set up your first monitor in under a minute, or look around the live demo first.

14-day free trial · No credit card required