Instead of sending users a 403 forbidden could you send them a challenge page with CAPTCHA? That's what CloudFlare does. I think it would save a lot of time from having to deal with false positives.

It would also be nice for ASL to use something like Project Honey Pot.

Thank you, I recommend you take a look at the current feature candidates for the next version of ASL here, and cast your votes:

viewtopic.php?f=3&t=5245

Specifically:

"Atomicorp Candidate #4: Redirect blocked users to a web page that explains why they were blocked and provides options based on the policy set by the system owner (examp,e, give them a captcha and allow for spam, admin password and allow XSS rules, report as false positive, etc.) Also for cases where the system owner does not want them to disable the rule, or allow the event, give them information to reach out the system owner to resolve the issue. (the domain and/or system owner would be able to disable/enable this depending on the type of rule triggered)"

And:

"Atomicorp Candidate #1: ASL RBL - basically a system thats driven by our honeypots and contains all the IPs from attackers, spammers, etc. And advanced version of this would allow everyone to participate by contributing your own attack data to the system. And a really advanced version of this would allow you to create your own RBL based on your data sources."

We also already work with Project Honeypot, they use our realtime WAF rules.