# Reject Login Attempts for Common Usernames

> Refuses login attempts for usernames bots love to try, such as "admin", "administrator" or "root", before WordPress even checks a password.

- Type: PHP
- Runs: Run everywhere
- Category: [Login](https://wpide.com/library/category/login/)
- Tags: login, security, brute-force
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/reject-common-username-logins/

## Code

```php
// Usernames that can never log in.
$wpide_banned_logins = array( 'admin', 'administrator', 'root', 'test', 'user', 'demo' );

add_filter( 'authenticate', function ( $user, $username ) use ( $wpide_banned_logins ) {
    if ( is_string( $username ) && in_array( strtolower( trim( $username ) ), $wpide_banned_logins, true ) ) {
        return new WP_Error( 'wpide_banned_login', '<strong>Error:</strong> The username or password you entered is incorrect.' );
    }

    return $user;
}, 1, 2 );
```

## Notes

Make sure none of your real accounts use one of the listed usernames before activating.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Reject Login Attempts for Common Usernames" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/