Suggestion: additional counting periods for rate limiting

Dear Peter

Rate limiting has been the killer feature of this plugin! That said, some malicious actors seem to have by now figured out how to circumvent detection by spreading out numerous 404 requests over the span of an hour yet staying well below the per 60 seconds (or under) threshold that’d trigger WF.

So it seems to me that the next step WF could take in adapting to the changing patterns of attack is probably to add an additional layer of blocking logic that’s based on counting periods of, say, per 15 minutes and upwards granularity (while keeping intact the original blocking logic for 60 seconds or under, which is also indispensable).