Lower the default request and byte limits (closes #193)

Requests: 120 a minute, 1,500 an hour, 6,000 a day. Bytes: no minute
limit, 50G an hour, 100G a day. The README, SPEC.md, docs/settings.md
and docs/gitea.md give the new defaults and the reasons for them. The
README examples no longer raise the byte limits for gitea, and the
static-site example sits below the new request defaults.

Model: opus-5-5

README.md

@@ -27,9 +27,9 @@ It protects against:
 - Scrapers that fetch every page of a site, all day. Each client gets a limit on
   requests and on bytes per minute, per hour and per day. The defaults leave
   room for a person reading a site for hours. They catch a scraper that keeps up
-  one request every 2 seconds within an hour. A client over a limit is refused
-  and banned: for a while at first, for three times as long at each repeat, and
-  permanently when it keeps at it.
+  one request every 2 seconds. A client over a limit is refused and banned: for
+  a while at first, for three times as long at each repeat, and permanently when
+  it keeps at it.
 - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
   default rule file bans such a client at its first probe, and its next request
   during the ban makes the ban permanent. Your own rules, or a list of trap

SPEC.md

@@ -406,9 +406,9 @@ the main one.
   cache loads 20 to 60 files, and a handful once cached.
 - Per hour: 1,500. A person reading code in gitea for a whole hour, a page every
   20 seconds, makes about 900 requests. A scraper making one request every 2
-  seconds passes the limit within 50 minutes.
-- Per day: 6,000, four heavy hours of reading. A scraper making one request
-  every 10 seconds passes it within 17 hours.
+  seconds makes 1,800 an hour, more than the limit.
+- Per day: 6,000, four hours at the hour limit. A scraper making one request
+  every 10 seconds makes 8,640 a day, more than the limit.
 
 Counting cannot catch a client that stays under all three limits, about 4
 requests a minute around the clock. Only the other checks can catch an abuser
@@ -417,8 +417,7 @@ the blocklists. An abuser that trips none of them is not caught.
 
 Some legitimate clients pass the limits:
 
-- An Actions runner asks gitea for work every 2 seconds, about 1,800 requests an
-  hour.
+- An Actions runner asks gitea for work all day and can pass the limits.
 - Everyone behind one shared address, such as an office, shares one client's
   limits.
 

docs/gitea.md

@@ -32,11 +32,12 @@ version.
 - An Actions runner that reaches gitea through `smallwebwaf` sends requests all
   day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
   1,800 requests an hour. While it runs a job, it reports the job's log and
-  state every second instead, two requests a second. So one idle runner passes
-  the hour limit of 1,500 within 50 minutes. A busy one passes it within 13
-  minutes. Its address is then banned, its running jobs fail, and each repeat
-  within a day makes the ban longer. Newer runners ask for work less often. Put
-  the runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+  state every second instead, two requests a second. So one idle runner makes
+  1,800 requests an hour, more than the hour limit of 1,500. A busy one, at two
+  requests a second, passes the minute limit of 120 within two minutes. Its
+  address is then banned, its running jobs fail, and each repeat within a day
+  makes the ban longer. Newer runners ask for work less often. Put the runners'
+  addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ## What the Core Rule Set lets through
 

docs/settings.md

@@ -106,14 +106,15 @@ chooses between the two (see "The image's command" below).
 - `SWWAF_RATE_LIMIT_PER_HOUR` (default `1500`): the most requests a client may
   make in an hour. A count or `off`. It is the main limit against scrapers. A
   person reading code in gitea for an hour, a page every 20 seconds, makes
-  about 900. A scraper making one request every 2 seconds passes it within 50
-  minutes.
+  about 900. A scraper making one request every 2 seconds makes 1,800 an hour,
+  more than the limit.
 - `SWWAF_RATE_LIMIT_PER_DAY` (default `6000`): the most requests a client may
-  make in a day. A count or `off`. The default is four heavy hours of reading. A
-  scraper making one request every 10 seconds passes it within 17 hours.
-- Actions runners make about 1,800 requests an hour, and pass the hour limit.
-  Put their addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`. Do the same for a
-  network where many people share one address, such as an office.
+  make in a day. A count or `off`. The default is four hours at the hour limit.
+  A scraper making one request every 10 seconds makes 8,640 a day, more than the
+  limit.
+- An Actions runner asks gitea for work all day and can pass the limits. Put
+  their addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`. Do the same for a network
+  where many people share one address, such as an office.
 - Counting cannot catch a client that stays under all three limits (see "Request
   rate limits, per client" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from