README.md

@@ -2158,13 +2158,14 @@ addresses sends, so that one client costs at most one check every
 `SWWAF_REPUTATION_CACHE_TTL`.
 
 Only a client whose history counts an offence is checked, so that the checks are
-spent on suspects: so far, one that has broken a rate limit or a byte limit,
+spent on suspects: so far, one that has broken a rate limit, a byte limit or the
-matched a ban rule, or had a request refused by a block rule or the Core Rule
+error burst, matched a ban rule, asked for a trap path, or had a request refused
-Set. A client dropped from the table of clients loses its history, and with it
+by a block rule, by the Core Rule Set or for a missing or wrong token. A client
-its offences. A client is checked in the background, at its first request after
+dropped from the table of clients loses its history, and with it its offences. A
-its offence that reaches the check: no request waits, a request refused under
+client is checked in the background, at its first request after its offence that
-its ban is not checked, and the request that has it checked, and any other from
+reaches the check: no request waits, a request refused under its ban is not
-it before the answer comes, goes on as from a client without a score.
+checked, and the request that has it checked, and any other from it before the
+answer comes, goes on as from a client without a score.
 
 A score at or over `SWWAF_ABUSEIPDB_MIN_SCORE`, 75 by default, is a hit, and
 `SWWAF_REPUTATION_ACTION` says what is done with its client, as for a DNSBL

SPEC.md

@@ -225,9 +225,9 @@ address or one /64, so a permanent ban does not reach neighbours who did
 nothing.
 
 An offence is a request `smallwebwaf` holds against the client: one that carries
-a clear sign of attack, breaks a limit, or is refused by a rule file or the Core
+a clear sign of attack, breaks a limit, or is refused by a rule file, by the
-Rule Set. Offences are counted by kind in the client's history. Two kinds lead
+Core Rule Set or for a missing or wrong token. Offences are counted by kind in
-to a ban, each by its own rule:
+the client's history. Two kinds lead to a ban, each by its own rule:
 
 - A clear sign of attack: a request that matches a rule file rule whose action
   is `ban`, or asks for a path in `SWWAF_TRAP_PATHS`. Examples are a probe for a