The problem with JS script is users can get around any imposed restrictions by disabling JS on their browser. To securely impose restrictions, it must be done server side. The use of JS is still a good idea from a UX standpoint, but enforce server side.
Catacaustic is correct, there is no built in setting to manage username length, but it can be enforced by hooking the ‘validate_username’ filter and returning false if the name is too long, otherwise return the passed value.
In returning false, the error message “This username is invalid because it uses illegal characters. Please enter a valid username.” is returned, which is rather misleading.
You can alter the message by hooking ‘registration_errors’ and modifying the passed WP_Error object. You should check the username again for length to be sure the error is because of length and not some other problem.
