# Avoiding false alarms

> The settings that decide when StatusTick opens an incident: confirmation from several regions, failures in a row, degraded and blocked states, maintenance.

A monitoring tool is only useful if people trust its alerts. StatusTick has five controls that decide whether a failed check becomes an incident. The defaults are safe; change them per monitor when you need to.

## 1. Confirmation from more than one region

Every check runs from all the regions you chose, at the same time. A network problem between one region and your site should not wake anyone up, so:

- By default, a monitor is **down** only when at least **2 regions** fail.
- When one region fails but not enough to confirm, StatusTick re-checks that region at once.
- You can set the number of failing regions from 1 up to the number of regions on the monitor.

The check result keeps each region's result, so you can see, for example, "down from EU West only".

## 2. Failed checks in a row

Short blips during a deploy can fail one check. In the incident settings you choose:

- **Failures to open:** how many failed checks in a row open an incident (1 to 10, default 2).
- **Successes to resolve:** how many good checks in a row resolve it.

The incident start time is the time of the first failed check, so your downtime numbers stay honest.

## 3. Slow is not down

Set a slow-response threshold on a monitor. A check that answers correctly but slower than the threshold is **Degraded**, not down. Degraded shows on dashboards and status pages as "Degraded performance".

## 4. Blocked is not down

Firewalls, WAFs and bot protection (for example a Cloudflare challenge) sometimes block monitoring requests while real users are fine. When StatusTick sees a typical block response, the check is **Blocked**, not down:

- You get one notice with steps to allow StatusTick, at most once a day.
- Blocked does not open an incident unless you turn that on for the monitor.
- A real `403` from your application still counts as down when `403` is not an expected status code.

See [Allowlisting StatusTick](https://statustick.com/docs/allowlisting-statustick).

## 5. Maintenance windows

During a maintenance window, failures do not open incidents or send alerts. Windows can be one-off or repeat daily, weekly on chosen days, or monthly, with a start time, a length and a time zone.

## Delays and escalation

- **Notification delay:** wait a few minutes after an incident opens before alerting, in case it resolves on its own.
- **Auto-resolve delay:** wait before resolving, so a flapping monitor does not open and close incidents again and again.
- **Escalation:** if nobody acknowledges an incident within the delay you set, StatusTick alerts a second set of channels, up to 3 times. Acknowledging or resolving the incident stops it.