How do I stop getting false-positive downtime alerts?

Require two consecutive failed checks from at least two different regions before alerting, add a short re-verify pause (3–5 s) between the failures, and exclude bot-blocked (403/429 from WAF) responses from the failure count.

• Single-region failures are almost always network blips — never alert on one datapoint.
• A 4-second re-verify pause suppresses ~80% of transient timeouts without delaying real outages.
• Cloudflare / Akamai WAF challenges look like 403s; classify them as bot-blocked, not down.
• Rolling 3-of-5 windows work better than static thresholds for response-time alerts.