diff --git a/src/Extension/Bfstop.php b/src/Extension/Bfstop.php
index 0a0d068..89a603c 100644
--- a/src/Extension/Bfstop.php
+++ b/src/Extension/Bfstop.php
@@ -47,6 +47,13 @@ class Bfstop extends CMSPlugin implements SubscriberInterface
 		'adaptiveDelayMax' => 0,
 		'adaptiveDelayThresholdMin' => 50,
 		'adaptiveDelayThresholdMax' => 200,
+		// failed logins are purged after this many weeks unless the
+		// administrator chose another time (0 = never). Keeping them for ever
+		// is not needed to protect anything, and they are personal data
+		// (addresses, usernames)
+		'deleteOld' => 4,
+		'logLevel' => 8, // Log::ERROR
+		'riskCommonUsernames' => "admin\nadministrator\nroot\ntest\nwebmaster",
 	);
 
 	private LoggerHelper $logger;
@@ -390,7 +397,7 @@ private function accountThrottleDelay($logEntry)
 
 	private function init()
 	{
-		$this->logger = new LoggerHelper($this->getIntParam('logLevel', LoggerHelper::Disabled),
+		$this->logger = new LoggerHelper($this->getIntParam('logLevel', self::DefaultSettings['logLevel']),
 			LoggerHelper::maxBytesFromMegabytes($this->getIntParam('logMaxSize', LoggerHelper::DefaultMaxSizeMB)));
 		$this->mydb = new DatabaseHelper($this->logger);
 		$this->notifier = new NotifierHelper($this->logger, $this->mydb,
@@ -794,7 +801,7 @@ public function onAfterInitialise($event)
 		$now = time();
 		if ($now > ($lastPurge + $purgeInterval))
 		{
-			$purgeAge = $this->getIntParam('deleteOld', DatabaseHelper::$DEFAULT_PURGE_WEEKS);
+			$purgeAge = $this->getIntParam('deleteOld', self::DefaultSettings['deleteOld']);
 			if ($purgeAge > 0)
 			{
 				$this->mydb->purgeOldEntries($purgeAge);
diff --git a/src/Helper/DatabaseHelper.php b/src/Helper/DatabaseHelper.php
index 3f75079..cb75441 100644
--- a/src/Helper/DatabaseHelper.php
+++ b/src/Helper/DatabaseHelper.php
@@ -28,10 +28,6 @@ class DatabaseHelper
 	// TokenunblockModel::TokenValidDays must stay in sync with this
 	public static $UNBLOCK_TOKEN_VALID_DAYS = 3;
 
-	// failed logins are purged after this many weeks unless the administrator
-	// chose another time (0 = never). Keeping them for ever is not needed to
-	// protect anything, and they are personal data (addresses, usernames)
-	public static $DEFAULT_PURGE_WEEKS = 4;
 
 	// upper bound for the rows of the failed logins, however the purge age is
 	// set: a visitor can add one for every request, from as many addresses as
diff --git a/src/Helper/RiskHelper.php b/src/Helper/RiskHelper.php
index 67c818e..ca11165 100644
--- a/src/Helper/RiskHelper.php
+++ b/src/Helper/RiskHelper.php
@@ -10,6 +10,7 @@
 
 defined('_JEXEC') or die;
 
+use Codeling\Plugin\System\Bfstop\Extension\Bfstop;
 use Joomla\CMS\Log\Log;
 use Joomla\Registry\Registry;
 
@@ -58,7 +59,7 @@ private static function knownIpScore(DatabaseHelper $db, LoggerHelper $logger, R
 	 */
 	public static function isCommonUsername(Registry $params, $username)
 	{
-		$list = (string) $params->get('riskCommonUsernames', '');
+		$list = (string) $params->get('riskCommonUsernames', Bfstop::DefaultSettings['riskCommonUsernames']);
 		$candidates = array_filter(array_map('trim', explode("\n", str_replace("\r", '', $list))));
 		foreach ($candidates as $candidate)
 		{