False positive

What is the difference to a false negative?

NIST defines a false positive in SP 800-115 as an alert that incorrectly indicates that a vulnerability is present. The opposite error is a false negative, where a real problem produces no alert. Wikipedia notes that a balance has to be chosen between the two risks. Raising a threshold removes false positives and makes false negatives more likely, and lowering it does the reverse.

Why do false positives matter?

Contrast Security describes false positives as a drag on teams, since each one takes time to investigate. Repeated false alarms also teach people to ignore alerts, so a later real alert may go unread.

What causes false alarms in SEO monitoring?

Common causes include:

• a check that fails once because of a short network problem
• content that changes by design, such as prices, dates or rotating banners
• a threshold set without knowing the normal variation
• a crawl that hits a rate limit or a bot protection and reports blocked pages as errors

How can they be reduced?

• Confirm a failed check with a second request before alerting.
• Require a condition to hold for a period (Datadog suggests, for example, five consecutive minutes).
• Compare against the usual range rather than a fixed value.
• Exclude areas known to change, and review each false alarm to adjust the rule.

Example

In an invented example, a monitor reports 400 broken links after a crawl. The target server had rate-limited the crawler for ten minutes and answered with 429. A repeat check an hour later finds no errors. The first alert was a false positive.

Last updated: October 8, 2026