Block Usernames
Block Usernames stops obvious usernames such as admin, administrator, or root from being registered - bots love them, and real teams can pick something safer.
What it does
Section titled “What it does”The module merges your blocklist into WordPress illegal_user_logins, so the same rules apply to front-end registration, admin user creation, and REST-based user creation.
- Optional default list: admin, administrator, root, test, demo, support, webmaster.
- Custom list: one username per line (up to 500 custom entries).
- Matching is case-insensitive and exact (admin blocks Admin, not admin1).
- Existing accounts that already use a blocked name can still log in.
When to use it
Section titled “When to use it”Enable it if:
- Your site allows public registration or frequent new user creation.
- You want to stop bots from claiming common admin-style logins.
- You need a shared blocklist for registration, Users -> Add New, and REST.
When not to use it
Section titled “When not to use it”Settings
Section titled “Settings”- Enable default blacklist - blocks admin, administrator, root, test, demo, support, webmaster.
- Blocked Usernames - textarea, one username per line (custom entries, max 500).
How to enable it
Section titled “How to enable it”- Go to WP PowerSuite -> Modules.
- Open Security or search for “Block Usernames”.
- Toggle Block Usernames on.
- Open settings, choose the default list and/or add custom names, then save.
How to test it
Section titled “How to test it”- Enable the module with the default blacklist on.
- Try to register or create a user named
admin(or another blocked name). - ✅ Pass: WordPress rejects the username as illegal/not allowed.
- ❌ Fail: confirm the module is on, the name is on the effective list, and no other plugin clears
illegal_user_logins.
Troubleshooting
Section titled “Troubleshooting”- Username still accepted. Check spelling, confirm default or custom list includes it, and save settings again.
- Custom list too long. Cap is 500 custom entries; trim the list and save.
- Existing admin user still works. Expected - only new registrations and username changes are blocked.
What does Block Usernames do?
It prevents selected usernames from being registered or created through WordPress illegal-login rules.
Is Block Usernames free?
Yes. Enable it under WP PowerSuite -> Modules.
Does it lock out existing users named admin?
No. Existing accounts keep working. Only new registrations and username changes to blocked values are stopped.
Is matching case-sensitive?
No. Matching is case-insensitive and exact after WordPress username sanitization.
How do I turn Block Usernames off?
Go to WP PowerSuite -> Modules, find Block Usernames, and toggle it off.
Developer notes (hooks & filters)
Source: modules/block-usernames/module.php.
Boot: critical · context: both.
Hooks: illegal_user_logins, wp_powersuite_module_settings_allowed_keys, wp_powersuite_sanitize_module_settings, wp_powersuite_module_settings_saved.