The web page should only start the miner if the user is well informed and clicks a button to start it. Legitimate purposes include spam-proofing message boxes,

The web page should only start the miner if the user is well informed and clicks a button to start it. Legitimate purposes include spam-proofing message boxes, as well as cryptocurrencies whose PoW is somewhat CPU friendly, such as those bottlenecked by DRAM latency.