More flexibility in limiting requests per second or minute

Question

We've read the docs on limiting the requests-per-second (max-rps), but we would actually like to set the threshold at less than one request per second. For example, we'd like to set the maximum requests to something like once every 5 seconds. But values like 0.2 for max-rps are not accepted. So the question is:
Is there a way to set the maximum frequency of requests to something like once every 5 or 10 seconds?
Is there an add-in that does that or could we create an add-in to do that?
It looks like the server is NOT open source, so we cannot change the current code to address this, but certainly let me know if I'm wrong about that.
In case it's helpful as background, the reason we want a lower threshold is that we only intend to limit access for html or jsp pages (not gif, jpg, js, css, etc.) That's because we don't want users to get half of a page, like the html, but no images or css, which would look like an ugly error. We want them to get the html complete with all the embeded files or get an error page. We're really only trying to block bots, which might make requests every second or slightly less often, and not block any human users. If there are other general suggestions for how to meet our goal, I'd love to hear them.

Answer 1

No, the lowest max limit is 1rps. The request limiting isn't really meant for what you're describing, it is for limiting high request rates. At less than 1/sec such detection would have false positive with real users anyway, so it wouldn't be such a great way of distinguishing users from bots. I'm not sure it would prove very satisfactory.
You could create your own NSAPI plugin (see docs on NSAPI usage) to implement your desired logic. I'd probably look into long term counters instead, but I don't really know the details of the exact problem you're trying to address.