There are some usernames that shouldn't be allowed to register on online services, for example:

administrator, admin, root, system, owner, hostmaster, webmaster, sitename or sitenameadmin

As far as I know, those shouldn't be allowed because they might cause a security risk, due to users registering those usernames might be able to impersonate a website official, and some users might be fooled by this.


Where can I find a list of all those usernames that shouldn't be allowed to register by anonymous users?

  • This would be bad practice to have a static (admin) account encoded in the application, but not already used/created so that it may be used by the first non-admin user. Either don't have such accounts or create those accounts at bootstrap phase. Then you can let your database handle those cases by setting a unique/primary key column or something like that. If you don't have such static accounts, then what is the harm in letting users register with those usernames or email addresses? – Artjom B. Aug 17 '14 at 0:19
  • @ArtjomB. the reason is posted in my question, some users, if they received a message from administrator@example.com they might be fooled into thinking it is a real administrator at that website, .. , specially users that are not cautious. .. and regardless of the method of blocking future users to register, I am only looking for this list in my question, .. adding them to database as pre-set users is not a bad option. – sharp12345 Aug 17 '14 at 0:30
  • 1
    Given that it's fairly easy to forge email From address, you always need to be careful when receiving emails from unknown senders, whether or not it has official titles in name that they introduced themselves as. You need to identify admins by special symbols or statuses, for example on stack exchange community moderators are given the diamond symbol. Then you only need to prohibit the diamonds symbol from being used by regular username and teach your users how to identify admins correctly rather than relying on name itself. – Lie Ryan Aug 17 '14 at 0:48

This is really the wrong solution to the problem: trying to prohibit "administrator"-like names will become a constant game of whack-a-mole with increasingly creative impersonators.

A blacklist of official-sounding names can be a starting point, but you should also provide an easy way to positively identify admins, such as a unique naming pattern (only admins can register a username ending in "(admin)"), or displaying their names or messages in a unique color.


You can start with a bad words list, such as:


then tack on any other strings you feel are unsafe or undesirable user names.

I suggest you use substring matching, otherwise it's very easy for users to manipulate the results, such as registering account "Administrator01" instead of "Administrator".

If you want to be extremely thorough, you could also use a spell check to score how close the user name is to any of the bad words. That way, you can catch even mispelt attempts like "Administater".


Here is a list of reserved usernames

  • First link is broken. – Goose Nov 3 '17 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.