Prevent Predictable WordPress Usernames From Being Created
A WordPress login requires both a username and password. When an account uses an extremely predictable username such as admin, anyone attempting to guess its credentials already has one part of that combination.
That does not mean a username should be treated as a secret or that changing admin suddenly makes an account secure. Strong passwords, Two-Factor Authentication, and appropriate login protections remain far more important. However, there is usually little reason to continue creating privileged or public accounts with obvious generic login names when more distinctive usernames are available.
Block Usernames lets you establish a simple account-naming policy directly in WordPress. Once a username is on the effective blocklist, WordPress will reject it when someone attempts to create or assign that login through supported account-management workflows.
This is particularly useful on sites with public registration, multiple administrators, client-managed accounts, or automated account creation where you cannot personally review every username before it enters the system.
Apply the Blocklist Across WordPress, Not Just One Form
A username restriction is much less useful if it protects only the public registration form.
WordPress accounts can be created or modified through several different interfaces. A visitor may register from the frontend, an administrator can create a user through Users → Add New, an application may create users through REST, and another plugin may use WordPress's normal account APIs.
Block Usernames integrates with WordPress's native illegal_user_logins filter. This is the same username restriction mechanism WordPress itself uses across supported user-creation and username-validation workflows.
As a result, the policy is not tied to one particular form. The same blocked-name list can apply to frontend registration, administrator-created accounts, REST user creation, and supported username changes.
This provides a more consistent rule: if a username has been reserved, supported WordPress account workflows should not assign it.
