<?php
/**
 * Slug lists for the Custom Login URL validator.
 *
 * One file, so the server validator, the settings-screen JS (localized from
 * the validator) and the later WP-CLI command all read the same data. The
 * `ao_login_url_reserved_slugs` and `ao_login_url_common_slugs` filters are
 * applied by Custom_Login_Url_Validator, not here.
 *
 * @package admin-optimizer
 */

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

return [
	// Paths WordPress owns and common admin aliases. A login slug that matches one is blocked.
	'reserved' => [
		'wp-admin',
		'wp-login',
		'wp-login-php',
		'login',
		'admin',
		'wp-json',
		'feed',
		'rss',
		'atom',
		'wp-content',
		'wp-includes',
		'xmlrpc',
		'wp-cron',
		'wp-signup',
		'wp-activate',
		'wp-register',
		'sitemap',
		'robots',
		'favicon',
		// Core rewrite bases that exist even on a plain-permalink site.
		'author',
		'category',
		'tag',
		'search',
		'comments',
		'embed',
		'page',
		'trackback',
		'attachment',
		'type',
	],

	// Whole words that make a slug easy to guess when they appear as a hyphen- or underscore-separated part
	// ("your-login", "admin-area-2"). Matched as exact parts only: "loginmenow" does not match "login".
	'giveaway' => [
		'login',
		'logon',
		'signin',
		'signon',
		'admin',
		'administrator',
		'dashboard',
		'portal',
		'panel',
		'backend',
		'secure',
		'secret',
		'staff',
		'member',
		'members',
		'account',
		'user',
		'users',
		'cms',
		'access',
		'console',
		'manager',
		'webmaster',
	],

	// Slugs attackers and visitors guess. Allowed, but the user must acknowledge the warning.
	'common'   => [
		'dashboard',
		'signin',
		'sign-in',
		'signon',
		'sign-on',
		'log-in',
		'logon',
		'log-on',
		'logout',
		'log-out',
		'signout',
		'sign-out',
		'secure',
		'secret',
		'private',
		'portal',
		'panel',
		'backend',
		'back-end',
		'backoffice',
		'back-office',
		'frontend',
		'manage',
		'manager',
		'management',
		'member',
		'members',
		'membership',
		'account',
		'accounts',
		'my-account',
		'myaccount',
		'profile',
		'user',
		'users',
		'username',
		'administrator',
		'administration',
		'admin-login',
		'adminlogin',
		'admin-panel',
		'adminpanel',
		'admin-area',
		'admin-access',
		'admin-dashboard',
		'site-admin',
		'siteadmin',
		'sysadmin',
		'webadmin',
		'webmaster',
		'cms',
		'control',
		'control-panel',
		'controlpanel',
		'cpanel',
		'console',
		'access',
		'enter',
		'entrance',
		'gateway',
		'door',
		'staff',
		'employee',
		'employees',
		'team',
		'customer',
		'customers',
		'client',
		'clients',
		'authenticate',
		'authentication',
		'auth',
		'password',
		'passwd',
		'reset',
		'lostpassword',
		'lost-password',
		'forgot',
		'register',
		'registration',
		'signup',
		'sign-up',
		'join',
		'connect',
		'wp',
		'wordpress',
		'wp-admin-login',
		'wplogin',
		'wp-panel',
		'wp-dashboard',
		'wpadmin',
		'wp-manage',
		'wp-secure',
		'wp-secret',
		'wp-access',
		'wp-enter',
		'wp-user',
		'wp-members',
		'wp-backend',
		'wp-cms',
		'site-login',
		'sitelogin',
		'web-login',
		'weblogin',
		'user-login',
		'userlogin',
		'users-login',
		'member-login',
		'memberlogin',
		'client-login',
		'staff-login',
		'secure-login',
		'securelogin',
		'private-login',
		'my-login',
		'mylogin',
		'new-login',
		'newlogin',
		'custom-login',
		'customlogin',
		'login-page',
		'loginpage',
		'login-here',
		'loginhere',
		'logins',
		'signins',
		'home',
		'index',
		'main',
		'default',
		'test',
		'demo',
		'temp',
		'hidden',
		'root',
		'master',
		'owner',
		'editor',
		'author-login',
		'writer',
		'moderator',
		'system',
		'server',
		'host',
		'hosting',
		'config',
		'setup',
		'install',
		'settings',
		'tools',
		'utility',
		'api',
		'app',
		'apps',
	],
];