Never mind, Nginx was actually limiting requests correctly. What I was seeing in my logs was requests for non-existent .js and .css files, which were then being passed to index.php as per my try_files in the / location block. Posted at Nginx Forum: https://forum.nginx.org/read.php?2,265244,265248#msg-265248