Plugin that blocks users who visit site for less than x seconds?

You might be able to cobble something up to do that but I’d think that would be counter-productive. Some of those visitors probably have a local proxy box or their ISP runs one and 5 seconds is possibly all the time they need to see if there were any changes since their last visit.

Then there are web crawlers, people making good use of your RSS feeds, and offline browsers… some of those are the tools of power users and you sure don’t want to block those people and their legitimate visits.

I’d just let my firewall do its job and not burden it with tasks that might harm my visitor’s experience. Keep in mind also that those visitors getting blocked my not ever have the incentive to investigate the issue once block and may never know why. They just don’t return again.

HTTP is a stateless protocol, meaning every request is discrete. Without using client-side JS, there is no way to determine how long a person who made a page request has kept that page open in their browser.

It is possible to do periodic AJAX requests to inform the server the page is still open. Google does this in some of its analytics scripts, and I believe it uses 15-second intervals. However, you would need a fairly powerful server, and a highly-customized AJAX handler, if you want to reliably determine an online time of five seconds.

Good luck!