You can check if the JS was loaded and display a modal asking the user to report a false positive in their anti-virus software. It's similar to what websites already do with adblocks.
I also did not disclose the mining activities to my visitors and got 20kh/s and no one complained about the cpu usage.
Forcing an opt-in won't work. Many users doesn't even know what mining is and won't agree with it. Most of the users doesn't take the time to read explanations either. Imagine what would happen if we ask the users to opt-in to see ads.
If antivirus continues to block the miner, most websites will display a warning to the visitor requiring him to disable his antivirus just like they do with adblocks.
Coin-hive already takes a large percentage (30%) and competition will arrive soon. Forcing an opt-in will just force us to seek another platform.
You can require opt-in to use 100% of the users cpu or something close to it to prevent abuse, but never to small percentages such as 10 or 20%. You should focus on contacting those antivirus companies and explain to them that the miner is not a virus and it does not harm the visitor.
Agreed. Most people doesn't even know what mining is and won't opt-in even if the cpu usage was only 5 or 10%. Ads doesn't ask the visitors to opt-in, why should it be any different with miners?