The minimum viable blocklist includes about 200 terms. Start with system admin terms (admin, root, system), support terms (support, help, contact), security terms (login, auth, password), and your own brand names. This covers 80% of attacks with minimal implementation effort.
Add infrastructure terms that match your architecture. If you use api.yoursite.com, reserve "api" as a username. If you have cdn.yoursite.com, reserve "cdn." Map your subdomains and routing patterns to the blocklist.
Include programming keywords that break things. null, undefined, true, false, and test are the top offenders. These cause bugs that only surface in production when someone actually registers them.
Reserve forward-looking terms. Even if you do not need them today, terms like official, verified, premium, and featured will matter when you grow. Same for trending tech terms — ai, blockchain, web3, and metaverse are worth reserving speculatively.