diff --git a/internal/http/request/database.go b/internal/http/request/database.go
index f7376fbd..9f97791c 100644
--- a/internal/http/request/database.go
+++ b/internal/http/request/database.go
@@ -4,7 +4,7 @@ type DatabaseCreate struct {
 	ServerID   uint   `form:"server_id" json:"server_id" validate:"required|exists:database_servers,id"`
 	Name       string `form:"name" json:"name" validate:"required|regex:^[a-zA-Z0-9_-]+$"`
 	CreateUser bool   `form:"create_user" json:"create_user"`
-	Username   string `form:"username" json:"username" validate:"requiredIf:CreateUser,true"`
+	Username   string `form:"username" json:"username" validate:"requiredIf:CreateUser,true|not_in:root,admin|regex:^[a-zA-Z0-9_-]+$"`
 	Password   string `form:"password" json:"password" validate:"requiredIf:CreateUser,true"`
 	Host       string `form:"host" json:"host"`
 	Comment    string `form:"comment" json:"comment"`
diff --git a/internal/http/request/database_user.go b/internal/http/request/database_user.go
index dae511d7..463bede7 100644
--- a/internal/http/request/database_user.go
+++ b/internal/http/request/database_user.go
@@ -2,7 +2,7 @@ package request
 
 type DatabaseUserCreate struct {
 	ServerID   uint     `form:"server_id" json:"server_id" validate:"required|exists:database_servers,id"`
-	Username   string   `form:"username" json:"username" validate:"required"`
+	Username   string   `form:"username" json:"username" validate:"required|not_in:root,admin|regex:^[a-zA-Z0-9_-]+$"`
 	Password   string   `form:"password" json:"password" validate:"required"`
 	Host       string   `form:"host" json:"host"`
 	Privileges []string `form:"privileges" json:"privileges"`
diff --git a/internal/http/request/website.go b/internal/http/request/website.go
index e89f0ad3..a27e4ede 100644
--- a/internal/http/request/website.go
+++ b/internal/http/request/website.go
@@ -8,7 +8,7 @@ type WebsiteDefaultConfig struct {
 }
 
 type WebsiteCreate struct {
-	Name       string   `form:"name" json:"name" validate:"required|notExists:websites,name|regex:^[a-zA-Z0-9_-]+$"`
+	Name       string   `form:"name" json:"name" validate:"required|notExists:websites,name|not_in:phpmyadmin,default|regex:^[a-zA-Z0-9_-]+$"`
 	Listens    []string `form:"listens" json:"listens" validate:"required|isSlice"`
 	Domains    []string `form:"domains" json:"domains" validate:"required|isSlice"`
 	Path       string   `form:"path" json:"path"`