Block User Registration with Certain Usernames in Joomla

Someone registers as "support" or "admin" and starts posting in your forum, and other members take them for staff. Or a new user picks your brand name and you can't use it for your own account later. Joomla only checks that a username is free, not whether it's a name you want to give away. You can block user registration with certain usernames in Joomla with one PHP snippet in Code Snippets.

The PHP snippet code

The snippet runs right before Joomla stores a new account. When the username matches your list, Joomla cancels the registration and shows your message on the form, and the visitor can pick another name. Logins, profile edits and existing accounts aren't affected.

use Joomla\CMS\Factory;

// Usernames no one can register. A * matches anything, so 'test*' covers
// test, test1 and tester, and '*joomla*' covers any name that contains joomla.
$blockedUsernames = [
    'admin',
    'administrator',
    'root',
    'support',
    'test*',
    '*joomla*',
];

// Message shown on the registration form instead of the welcome message.
$message = 'This username is not available. Please choose another one.';

// Do not edit below.

$app = Factory::getApplication();

$app->registerEvent('onUserBeforeSave', function ($event) use ($blockedUsernames, $message)
{
    // Only new accounts. Profile edits pass through.
    if (!$event->getArgument('isNew', $event->getArgument(1, false)))
    {
        return;
    }

    $data     = $event->getArgument('data', $event->getArgument(2, []));
    $username = strtolower(trim($data['username'] ?? ''));

    foreach ($blockedUsernames as $pattern)
    {
        $pattern = strtolower(trim($pattern));

        if ($pattern !== '' && fnmatch($pattern, $username))
        {
            // Joomla cancels the registration and shows this message.
            throw new RuntimeException($message);
        }
    }
});

Change the 2 settings at the top:

• $blockedUsernames: the names no one can register. A plain entry like admin blocks that exact name. A * matches anything, so test* blocks test, test1 and tester, and *joomla* blocks any name that contains joomla. The list isn't case sensitive, so admin also blocks Admin and ADMIN.
• $message: the text Joomla shows on the registration form. It appears after "Registration failed:".

How to add this snippet

1. Install Code Snippets if it isn't installed already.
2. Log into your Joomla backend.
3. Go to Components → Tassos Code Snippets.
4. Click New.
5. Enter a title, for example Block reserved usernames.
6. Set Code Type to PHP.
7. Set Insertion Method to Auto-Insert Locations.
8. Set Location to On Page Load.
9. Paste the code above into the editor.
10. Replace the sample names with the ones you want to reserve.
11. Click Save & Close.

Check that it works

1. Open your site's registration page in a private browser window.
2. Submit the form with the username tester.

Joomla shows "Registration failed: This username is not available. Please choose another one." and creates no account. Submit the form again with a name that isn't on the list, and the registration goes through.

To block sign-ups by IP address, email address or country, see Block User Registration by IP Address in Joomla, Block User Registration by Email Address in Joomla and Block User Registration by Country in Joomla. To learn more about how PHP snippets work, read the PHP snippet docs.