A whitelist for what?

Thank you Matt of your interest.

Without changing the core (the easiest way), I would like limit the username to a-z,0-9? And limit some username like admin, superuser, dot (.), etc. 

For example: 

if(preg_match("/^[a-zA-Z0-9]/", $username) == 1) {
    // username only contain the a to z , A to Z, 0 to 9
}

How would create a simple plug-in with start.php (and manifest). It should be very straight forward but my hooks do not catch the username (I am sure i am doing something wrong). A tutorial template would be helpful :)

And limit some username like admin, superuser, dot (.), etc. 

Just add these users via Administration -> Add new user

And then ban them ;)

Thanks but about username only contain the a to z , A to Z, 0 to 9 ???

http://learn.elgg.org/en/2.0/guides/hooks-list.html#user-hooks

Register a function to the 'registeruser:validate:username', 'all' plugin hook. Within the function check $params['username'] if the username contains characters (or whole specific usernames) you won't allow. Return true/false depending on the username is valid or not according to your requirements.

You can also take a look at the function validate_username() in vendor/elgg/elgg/engine/lib/users.php to see how Elgg validates a username