Block Usernames

The Block Usernames module strengthens WordPress security by preventing the use of common or insecure usernames during registration and account creation. By blocking usernames like “admin” or “administrator,” it helps reduce brute-force attacks, enforce better username policies, and protect your site from targeted login attempts.

How to use

To enable the Block Usernames Module:

1. Click on the “Security” category
2. Search or scroll to locate the Block Usernames Module
3. Click on the switch to enable

What’s next?

This module helps secure your WordPress site by preventing the use of common or insecure usernames during registration and user creation.

1. Default Blocked Usernames

By default, the following usernames are blocked:

• admin
• administrator

2. Block Common Usernames (Pro Feature)

The Pro version allows you to block a list of 500+ common usernames with a single click, including:

• Common admin usernames (root, superuser, sysadmin)
• Service accounts (noreply, support, webmaster)
• Technical terms (api, dev, test, staging)
• Common file and directory names
• And many more…

3. Custom Blocked Usernames (Pro Feature)

Add your own list of usernames to block:

1. Go to WP mazic > Settings > Security > Block Usernames
2. Enter one username per line in the “Block Usernames” textarea
3. Save your changes

4. Checking for Existing Problematic Usernames

The module automatically checks for existing users with blocked usernames and displays a warning in the WordPress admin if any are found. The warning includes:

• Number of users with blocked usernames
• List of affected usernames (up to 5, with a count of any additional)
• A link to documentation on how to handle these users

5. Allowing Specific Usernames

If you need to allow specific usernames that would otherwise be blocked, use this filter in your theme’s

functions.php

:

add_filter('WPMazic/block-usernames/ignored_usernames', function($ignored_usernames, $username) {
    // Add usernames that should be allowed
    $allowed_usernames = array(
        'admin_user',
        'special_admin'
    );
    
    return array_merge($ignored_usernames, $allowed_usernames);
}, 10, 2);

6. Security Best Practices

• Always use unique, non-generic usernames
• Avoid usernames that reveal roles (e.g., ‘admin’, ‘editor’)
• Consider using email addresses as usernames
• Regularly audit user accounts and permissions

7. Developer Hooks

The module provides several hooks for developers:

// Filter blocked usernames
add_filter('WPMazic/block-usernames/blocked_usernames', function($usernames) {
    // Add your custom blocked usernames
    $custom_usernames = array(
        'superadmin',
        'webmaster',
        'root',
        'test'
    );
    
    // Merge with existing blocked usernames
    return array_merge($usernames, $custom_usernames);
});

// Customize the blocked username message
add_filter('WPMazic/block-usernames/blocked_message', function($message) {
    return __('Custom blocked username message', 'your-text-domain');
});

8. Troubleshooting

• Username still being blocked? Check if it’s in the blocked usernames list
• False positives? Add the username to the ignored usernames list
• Not seeing the admin notice? Make sure you have administrator privileges

9. Performance Considerations

The module is optimized for performance with:

• Cached regex patterns for username checking
• Efficient database queries when checking existing users
• Batch processing for large user bases

This module is particularly useful for:

• Hardening WordPress security
• Preventing brute force attacks
• Enforcing username policies
• Complying with security best practices