reserved-slugs

A comprehensive list of 1,200+ reserved slugs that web applications should block when allowing user-generated URL paths — preventing users from claiming routes like /admin, /api, /login, or /settings as their username, team name, or organization URL.

Most existing reserved-username lists were last updated years ago and miss the patterns modern web apps actually use — SSO and MFA auth flows, health check endpoints, GraphQL and API versioning paths, SaaS concepts like workspaces and integrations, trust & safety routes, AI/ML endpoints, fintech terms, and more. This list covers all of that.

Install

npm install reserved-slugs

bun add reserved-slugs

pnpm add reserved-slugs

yarn add reserved-slugs

Usage

Check if a slug is reserved

import { isReservedSlug } from 'reserved-slugs'

isReservedSlug('admin')     // true
isReservedSlug('API')       // true (case-insensitive)
isReservedSlug('my-team')   // false

Access the full set

import { reservedSlugs } from 'reserved-slugs'

// reservedSlugs is a Set<string> with 1272 entries
reservedSlugs.has('dashboard')  // true
reservedSlugs.has('mycompany')  // false

Get the array form

import { reservedSlugsArray } from 'reserved-slugs'

// reservedSlugsArray is a string[] — useful for iteration, serialization, etc.
console.log(reservedSlugsArray.length)  // 1272

Import individual categories

Every slug is organized into one of 20 categories. You can import just the categories you need — as arrays, Sets, or check functions:

// Category arrays (readonly tuples with string literal types)
import {
  countryCodeSlugs,   // readonly ['ac', 'ad', 'ae', ...]
  authSlugs,          // readonly ['2fa', 'access', 'activate', ...]
  ecommerceSlugs      // readonly ['billing', 'cart', 'checkout', ...]
} from 'reserved-slugs'

// Category Sets
import {
  countryCodes,       // Set<string>
  auth,               // Set<string>
  ecommerce           // Set<string>
} from 'reserved-slugs'

// Category check functions (case-insensitive)
import {
  isCountryCodeSlug,
  isAuthSlug,
  isEcommerceSlug
} from 'reserved-slugs'

isCountryCodeSlug('US')  // true
isAuthSlug('login')      // true
isEcommerceSlug('cart')  // true

Programmatic access to all categories

import { categories } from 'reserved-slugs'

// categories is a Record<string, Set<string>> with all 20 categories
for (const [name, set] of Object.entries(categories)) {
  console.log(`${name}: ${set.size} slugs`)
}

Combine specific categories

Build a custom set from only the categories that matter for your use case:

import { authSlugs, impersonationSlugs, legalSlugs } from 'reserved-slugs'

const myBlocklist = new Set([
  ...authSlugs,
  ...impersonationSlugs,
  ...legalSlugs
])

Categories

The list covers 1,272 slugs across 20 categories:

Category	Export (array)	Export (Set)	Check function	Count	Examples
AI & machine learning	aiMlSlugs	aiMl	isAiMlSlug()	34	ai, copilot, chatbot, llm, prompt
API & developer	apiDeveloperSlugs	apiDeveloper	isApiDeveloperSlug()	52	graphql, swagger, sdk, v1–v4
Application routes	appRouteSlugs	appRoutes	isAppRouteSlug()	234	dashboard, settings, search, upload
Auth & security	authSlugs	auth	isAuthSlug()	51	login, sso, mfa, passkey, oauth
Country codes	countryCodeSlugs	countryCodes	isCountryCodeSlug()	252	us, uk, de, fr, jp
DNS & mail	dnsMailSlugs	dnsMail	isDnsMailSlug()	44	smtp, ns1–ns10, www, postmaster
E-commerce	ecommerceSlugs	ecommerce	isEcommerceSlug()	39	cart, checkout, shipping, wishlist
Financial & fintech	financialSlugs	financial	isFinancialSlug()	51	wallet, crypto, trading, portfolio
Health & monitoring	healthMonitoringSlugs	healthMonitoring	isHealthMonitoringSlug()	12	healthcheck, heartbeat, metrics, uptime
Impersonation risks	impersonationSlugs	impersonation	isImpersonationSlug()	36	admin, ceo, moderator, verified
Infrastructure	infrastructureSlugs	infrastructure	isInfrastructureSlug()	85	cgi-bin, docker, ssl, cdn, proxy
Languages	languageSlugs	languages	isLanguageSlug()	49	english, spanish, mandarin, arabic
Legal & compliance	legalSlugs	legal	isLegalSlug()	31	dmca, gdpr, privacy, cookie-policy
Media & streaming	mediaStreamingSlugs	mediaStreaming	isMediaStreamingSlug()	34	podcast, stream, live, channel
Profanity & offensive	profanitySlugs	profanity	isProfanitySlug()	41	Slurs, hate speech, and strong profanity
Protocol & tech	protocolTechSlugs	protocolTech	isProtocolTechSlug()	34	http, json, rss, websocket
SaaS routes	saasSlugs	saas	isSaasSlug()	39	workspace, org, subscription, trial
SEO & marketing	seoMarketingSlugs	seoMarketing	isSeoMarketingSlug()	70	about, pricing, careers, press
Social & platform	socialSlugs	social	isSocialSlug()	68	blog, follow, inbox, profile, wiki
Well-known paths	wellKnownPathsSlugs	wellKnownPaths	isWellKnownPathSlug()	29	wp-admin, xmlrpc, cpanel, well-known

Use without JavaScript

Every slug in the list is also available in six static data formats, committed to the repo and published in the npm package. You can fetch them directly from GitHub or from a CDN — no JavaScript or npm install required.

Available formats (combined)

Format	File	Description
JSON	data/slugs.json	JSON array of strings
Plain text	data/slugs.txt	One slug per line
CSV	data/slugs.csv	Single column with slug header
YAML	data/slugs.yml	YAML list
XML	data/slugs.xml	XML document
TOML	data/slugs.toml	TOML array

Per-category data files

Each category has its own subfolder under data/categories/ with all six formats:

data/categories/auth/slugs.json
data/categories/auth/slugs.txt
data/categories/country-codes/slugs.json
data/categories/ecommerce/slugs.json
...

Category folders: ai-ml, api-developer, app-routes, auth, country-codes, dns-mail, ecommerce, financial, health-monitoring, impersonation, infrastructure, languages, legal, media-streaming, profanity, protocol-tech, saas, seo-marketing, social, well-known-paths.

Fetch from GitHub (raw)

# Combined JSON
curl -sL https://raw.githubusercontent.com/miketromba/reserved-slugs/main/data/slugs.json

# Combined plain text
curl -sL https://raw.githubusercontent.com/miketromba/reserved-slugs/main/data/slugs.txt

# Single category (e.g. auth)
curl -sL https://raw.githubusercontent.com/miketromba/reserved-slugs/main/data/categories/auth/slugs.json

Fetch from CDN (npm package)

Since the data/ directory is included in the npm package, you can also fetch these files from jsDelivr or unpkg:

# jsDelivr
curl -sL https://cdn.jsdelivr.net/npm/reserved-slugs/data/slugs.json
curl -sL https://cdn.jsdelivr.net/npm/reserved-slugs/data/categories/auth/slugs.json

# unpkg
curl -sL https://unpkg.com/reserved-slugs/data/slugs.json
curl -sL https://unpkg.com/reserved-slugs/data/categories/auth/slugs.json

Why use this?

When your application lets users choose a slug (for a username, team, or organization URL), you need to block slugs that would conflict with your application's own routes or could be used for abuse:

• Route collisions — A user claiming /api, /admin, or /graphql could shadow your application's critical paths
• Auth flow conflicts — Slugs like /sso, /verify, /mfa, or /oauth can break authentication flows
• Phishing & impersonation — Slugs like /support, /security, /official, or /ceo can be used to trick other users
• SEO conflicts — User pages at /blog, /pricing, or /about compete with your own marketing pages
• Infrastructure conflicts — Slugs like /health, /metrics, /cdn, or /ns1 can interfere with monitoring, DNS, and other services
• Legal exposure — Slugs like /dmca, /abuse, or /compliance can undermine trust & safety workflows
• Profanity & abuse — Slugs containing slurs or strong profanity cause brand damage and harm users
• Financial confusion — Slugs like /wallet, /crypto, or /trading can mislead users on fintech platforms
• Scanner targets — Bots constantly probe /wp-admin, /xmlrpc, and /cpanel; reserving these reduces noise

Existing reserved-username lists floating around GitHub and Google Sheets were created years ago and haven't kept up with how modern web applications are built. They'll catch /admin and /ftp, but miss /graphql, /sso, /healthcheck, /workspace, /v1, /dmca, /ai, or /wallet — the kinds of routes that every production app ships today.

This list was built on top of those earlier efforts, then significantly expanded to cover modern auth patterns, API conventions, SaaS routing, monitoring endpoints, legal/compliance paths, impersonation risks, AI/ML endpoints, financial/fintech terms, media/streaming routes, profanity filtering, and well-known scanner targets.

Contributing

PRs are welcome to add missing slugs or suggest improvements!

To contribute:

1. Edit the appropriate file in src/categories/ — these are the source of truth
2. Run bun run build to regenerate all data formats
3. Run bun test to verify everything passes
4. Submit your PR

Please keep slugs lowercase and alphabetically sorted within each category file.

Category files

File	Description
src/categories/ai-ml.ts	AI & machine learning
src/categories/api-developer.ts	API & developer tooling
src/categories/app-routes.ts	Common application routes
src/categories/auth.ts	Authentication & security
src/categories/country-codes.ts	ISO country codes
src/categories/dns-mail.ts	DNS & mail servers
src/categories/ecommerce.ts	E-commerce terms
src/categories/financial.ts	Financial & fintech
src/categories/health-monitoring.ts	Health checks & monitoring
src/categories/impersonation.ts	Impersonation risks
src/categories/infrastructure.ts	Server & infrastructure
src/categories/languages.ts	Language names
src/categories/legal.ts	Legal & compliance
src/categories/media-streaming.ts	Media & streaming
src/categories/profanity.ts	Profanity & offensive terms
src/categories/protocol-tech.ts	Protocols & technology
src/categories/saas.ts	SaaS routes
src/categories/seo-marketing.ts	SEO & marketing pages
src/categories/social.ts	Social & platform features
src/categories/well-known-paths.ts	Well-known paths & scanner targets

Credits

The initial version of this list was seeded from several community sources:

• shouldbee/reserved-usernames
• benbowler's reserved username list
• Reserved URL slugs spreadsheet

It has since been significantly expanded with modern auth flows, API conventions, SaaS routing patterns, health/monitoring endpoints, legal & trust/safety paths, impersonation risks, and more.

License

MIT