diff --git a/core/core.services.yml b/core/core.services.yml
index b619810a01..b7a648b433 100644
--- a/core/core.services.yml
+++ b/core/core.services.yml
@@ -442,8 +442,11 @@ services:
   queue.database:
     class: Drupal\Core\Queue\QueueDatabaseFactory
     arguments: ['@database']
+  path.alias_whitelist:
+    alias: path.alias_allowlist
+    deprecated: The "%service_id%" service is deprecated. You should use the 'path.alias_allowlist' service instead.
   path.alias_allowlist:
-    class: Drupal\Core\Path\AliasAllowlist
+    class: Drupal\Core\Path\AliasPrefixLookup
     tags:
       - { name: needs_destruction }
     arguments: [path_alias_allowlist, '@cache.bootstrap', '@lock', '@state', '@path.alias_storage']
diff --git a/core/includes/file.inc b/core/includes/file.inc
index c91a89f535..1058cd1e38 100644
--- a/core/includes/file.inc
+++ b/core/includes/file.inc
@@ -712,7 +712,7 @@ function file_munge_filename($filename, $extensions, $alerts = TRUE) {
     // http://php.net/manual/security.filesystem.nullbytes.php
     $filename = str_replace(chr(0), '', $filename);
 
-    $allowlist = array_unique(explode(' ', strtolower(trim($extensions))));
+    $allowed_extensions = array_unique(explode(' ', strtolower(trim($extensions))));
 
     // Split the filename up by periods. The first part becomes the basename
     // the last part the final extension.
@@ -727,7 +727,7 @@ function file_munge_filename($filename, $extensions, $alerts = TRUE) {
     // of allowed extensions.
     foreach ($filename_parts as $filename_part) {
       $new_filename .= '.' . $filename_part;
-      if (!in_array(strtolower($filename_part), $allowlist) && preg_match("/^[a-zA-Z]{2,5}\d?$/", $filename_part)) {
+      if (!in_array(strtolower($filename_part), $allowed_extensions) && preg_match("/^[a-zA-Z]{2,5}\d?$/", $filename_part)) {
         $new_filename .= '_';
       }
     }
diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php
index d8651815d8..164738798c 100644
--- a/core/lib/Drupal/Component/Utility/Xss.php
+++ b/core/lib/Drupal/Component/Utility/Xss.php
@@ -70,7 +70,7 @@ public static function filter($string, array $html_tags = NULL) {
 
     // Defuse all HTML entities.
     $string = str_replace('&', '&', $string);
-    // Change back only well-formed entities in our allowlist:
+    // Change back only well-formed entities in our allowed tags:
     // Decimal numeric entities.
     $string = preg_replace('/&#([0-9]+;)/', '&#\1', $string);
     // Hexadecimal numeric entities.
@@ -83,7 +83,7 @@ public static function filter($string, array $html_tags = NULL) {
     $splitter = function ($matches) use ($html_tags, $class) {
       return $class::split($matches[1], $html_tags, $class);
     };
-    // Strip any tags that are not in the allowlist.
+    // Strip any tags that are not in the allowed tags.
     return preg_replace_callback('%
       (
       <(?=[^a-zA-Z!/])  # a lone <
@@ -161,7 +161,7 @@ protected static function split($string, $html_tags, $class) {
       $elem = '!--';
     }
 
-    // When in allowlist mode, an element is disallowed when not listed.
+    // When in allowed tags mode, an element is disallowed when not listed.
     if ($class::needsRemoval($html_tags, $elem)) {
       return '';
     }
diff --git a/core/lib/Drupal/Core/Extension/Discovery/RecursiveExtensionFilterIterator.php b/core/lib/Drupal/Core/Extension/Discovery/RecursiveExtensionFilterIterator.php
index 5ae8943584..f9edf1c0ec 100644
--- a/core/lib/Drupal/Core/Extension/Discovery/RecursiveExtensionFilterIterator.php
+++ b/core/lib/Drupal/Core/Extension/Discovery/RecursiveExtensionFilterIterator.php
@@ -38,7 +38,7 @@ class RecursiveExtensionFilterIterator extends \RecursiveFilterIterator {
    *
    * @var array
    */
-  protected $allowlist = [
+  protected $allowedExtensionTypes = [
     'profiles',
     'modules',
     'themes',
@@ -53,7 +53,7 @@ class RecursiveExtensionFilterIterator extends \RecursiveFilterIterator {
    *
    * @var array
    */
-  protected $denylist = [
+  protected $skippedFolders = [
     // Object-oriented code subdirectories.
     'src',
     'lib',
@@ -86,13 +86,13 @@ class RecursiveExtensionFilterIterator extends \RecursiveFilterIterator {
    *
    * @param \RecursiveIterator $iterator
    *   The iterator to filter.
-   * @param array $denylist
+   * @param array $skippedFolders
    *   (optional) Add to the denylist of directories that should be filtered
    *   out during the iteration.
    */
-  public function __construct(\RecursiveIterator $iterator, array $denylist = []) {
+  public function __construct(\RecursiveIterator $iterator, array $skippedFolders = []) {
     parent::__construct($iterator);
-    $this->denylist = array_merge($this->denylist, $denylist);
+    $this->skippedFolders = array_merge($this->skippedFolders, $skippedFolders);
   }
 
   /**
@@ -101,13 +101,13 @@ public function __construct(\RecursiveIterator $iterator, array $denylist = [])
    * @param bool $flag
    *   Pass FALSE to skip all test directories in the discovery. If TRUE,
    *   extensions in test directories will be discovered and only the global
-   *   directory denylist in RecursiveExtensionFilterIterator::$denylist is
-   *   applied.
+   *   directory skip list in RecursiveExtensionFilterIterator::skippedFolders
+   *   is applied.
    */
   public function acceptTests($flag = FALSE) {
     $this->acceptTests = $flag;
     if (!$this->acceptTests) {
-      $this->denylist[] = 'tests';
+      $this->skippedFolders[] = 'tests';
     }
   }
 
@@ -116,8 +116,8 @@ public function acceptTests($flag = FALSE) {
    */
   public function getChildren() {
     $filter = parent::getChildren();
-    // Pass on the denylist.
-    $filter->denylist = $this->denylist;
+    // Pass on the skipped folders list.
+    $filter->skippedFolders = $this->skippedFolders;
     // Pass the $acceptTests flag forward to child iterators.
     $filter->acceptTests($this->acceptTests);
     return $filter;
@@ -140,7 +140,7 @@ public function accept() {
       // recurse into the whole filesystem tree that possibly contains other
       // files aside from Drupal.
       if ($this->current()->getSubPath() == '') {
-        return in_array($name, $this->allowlist, TRUE);
+        return in_array($name, $this->allowedExtensionTypes, TRUE);
       }
       // 'config' directories are special-cased here, because every extension
       // contains one. However, those default configuration directories cannot
@@ -154,7 +154,7 @@ public function accept() {
         return substr($this->current()->getPathname(), -14) == 'modules/config';
       }
       // Accept the directory unless the name is denylisted.
-      return !in_array($name, $this->denylist, TRUE);
+      return !in_array($name, $this->skippedFolders, TRUE);
     }
     else {
       // Only accept extension info files.
diff --git a/core/lib/Drupal/Core/Extension/ExtensionDiscovery.php b/core/lib/Drupal/Core/Extension/ExtensionDiscovery.php
index fdbd69db21..29143f450b 100644
--- a/core/lib/Drupal/Core/Extension/ExtensionDiscovery.php
+++ b/core/lib/Drupal/Core/Extension/ExtensionDiscovery.php
@@ -164,8 +164,8 @@ public function scan($type, $include_tests = NULL) {
     $searchdirs[static::ORIGIN_SITES_ALL] = 'sites/all';
 
     // Search for contributed and custom extensions in top-level directories.
-    // The scan uses a allowlist to limit recursion to the expected extension
-    // type specific directory names only.
+    // The scan uses a list of extension types to limit recursion to the
+    //expected extension type specific directory names only.
     $searchdirs[static::ORIGIN_ROOT] = '';
 
     // Simpletest uses the regular built-in multi-site functionality of Drupal
diff --git a/core/lib/Drupal/Core/Path/AliasAllowlistInterface.php b/core/lib/Drupal/Core/Path/AliasAllowlistInterface.php
deleted file mode 100644
index fa69440c67..0000000000
--- a/core/lib/Drupal/Core/Path/AliasAllowlistInterface.php
+++ /dev/null
@@ -1,15 +0,0 @@
-<?php
-
-namespace Drupal\Core\Path;
-
-use Drupal\Core\Cache\CacheCollectorInterface;
-
-/**
- * Cache the alias allowlist.
- *
- * The allowlist contains the first element of the router paths of all
- * aliases. For example, if /node/12345 has an alias then "node" is added to
- * the allowlist. This optimization allows skipping the lookup for every
- * /user/{user} path if "user" is not in the allowlist.
- */
-interface AliasAllowlistInterface extends CacheCollectorInterface {}
diff --git a/core/lib/Drupal/Core/Path/AliasManager.php b/core/lib/Drupal/Core/Path/AliasManager.php
index e8d4ea9668..c53124d4e5 100644
--- a/core/lib/Drupal/Core/Path/AliasManager.php
+++ b/core/lib/Drupal/Core/Path/AliasManager.php
@@ -62,11 +62,11 @@ class AliasManager implements AliasManagerInterface, CacheDecoratorInterface {
   protected $noPath = [];
 
   /**
-   * Holds the array of allowlisted path aliases.
+   * Holds the array of alias prefix look path aliases.
    *
-   * @var \Drupal\Core\Path\AliasAllowlistInterface
+   * @var \Drupal\Core\Path\AliasPrefixLookupInterface
    */
-  protected $allowlist;
+  protected $aliasPrefixLookup;
 
   /**
    * Holds an array of paths that have no alias.
@@ -97,17 +97,17 @@ class AliasManager implements AliasManagerInterface, CacheDecoratorInterface {
    *
    * @param \Drupal\Core\Path\AliasStorageInterface $storage
    *   The alias storage service.
-   * @param \Drupal\Core\Path\AliasAllowlistInterface $allowlist
-   *   The allowlist implementation to use.
+   * @param \Drupal\Core\Path\AliasPrefixLookupInterface $aliasPrefixLookup
+   *   The alias prefix lookup implementation to use.
    * @param \Drupal\Core\Language\LanguageManagerInterface $language_manager
    *   The language manager.
    * @param \Drupal\Core\Cache\CacheBackendInterface $cache
    *   Cache backend.
    */
-  public function __construct(AliasStorageInterface $storage, AliasAllowlistInterface $allowlist, LanguageManagerInterface $language_manager, CacheBackendInterface $cache) {
+  public function __construct(AliasStorageInterface $storage, AliasPrefixLookupInterface $aliasPrefixLookup, LanguageManagerInterface $language_manager, CacheBackendInterface $cache) {
     $this->storage = $storage;
     $this->languageManager = $language_manager;
-    $this->allowlist = $allowlist;
+    $this->aliasPrefixLookup = $aliasPrefixLookup;
     $this->cache = $cache;
   }
 
@@ -191,10 +191,10 @@ public function getAliasByPath($path, $langcode = NULL) {
     // alias matching the URL path.
     $langcode = $langcode ?: $this->languageManager->getCurrentLanguage(LanguageInterface::TYPE_URL)->getId();
 
-    // Check the path allowlist, if the top-level part before the first /
+    // Check the path prefix lookup, if the top-level part before the first /
     // is not in the list, then there is no need to do anything further,
     // it is not in the database.
-    if ($path === '/' || !$this->allowlist->get(strtok(trim($path, '/'), '/'))) {
+    if ($path === '/' || !$this->aliasPrefixLookup->get(strtok(trim($path, '/'), '/'))) {
       return $path;
     }
 
@@ -265,11 +265,11 @@ public function cacheClear($source = NULL) {
     $this->langcodePreloaded = [];
     $this->preloadedPathLookups = [];
     $this->cache->delete($this->cacheKey);
-    $this->pathAliasAllowlistRebuild($source);
+    $this->pathAliasPrefixLookupRebuild($source);
   }
 
   /**
-   * Rebuild the path alias white list.
+   * Rebuild the path alias prefix lookup.
    *
    * @param string $path
    *   An optional path for which an alias is being inserted.
@@ -277,15 +277,33 @@ public function cacheClear($source = NULL) {
    * @return
    *   An array containing a white list of path aliases.
    */
-  protected function pathAliasAllowlistRebuild($path = NULL) {
-    // When paths are inserted, only rebuild the allowlist if the path has a top
-    // level component which is not already in the allowlist.
+  protected function pathAliasPrefixLookupRebuild($path = NULL) {
+    // When paths are inserted, only rebuild the prefix lookup if the path has a
+    // top level component which is not already in the prefix lookup.
     if (!empty($path)) {
-      if ($this->allowlist->get(strtok($path, '/'))) {
+      if ($this->aliasPrefixLookup->get(strtok($path, '/'))) {
         return;
       }
     }
-    $this->allowlist->clear();
+    $this->aliasPrefixLookup->clear();
+  }
+
+  /**
+   * Rebuild the path alias white list.
+   *
+   * @param string $path
+   *   An optional path for which an alias is being inserted.
+   *
+   * @return
+   *   An array containing a prefix lookup list of path aliases.
+   *
+   * @deprecated pathAliasAllowlistRebuild is deprecated in Drupal 8.7.x and
+   * will be removed before Drupal 9.0.x. Use
+   * \Drupal\Core\Path\AliasManager::pathAliasPrefixLookupRebuild instead.
+   */
+  protected function pathAliasWhitelistRebuild($path = NULL) {
+    @trigger_error('pathAliasAllowlistRebuild is deprecated in Drupal 8.7.x and will be removed before Drupal 9.0.x. Use \Drupal\Core\Path\AliasManager::pathAliasPrefixLookupRebuild instead.', E_USER_DEPRECATED);
+    return $this->pathAliasPrefixLookupRebuild($path);
   }
 
   /**
diff --git a/core/lib/Drupal/Core/Path/AliasAllowlist.php b/core/lib/Drupal/Core/Path/AliasPrefixLookup.php
similarity index 89%
rename from core/lib/Drupal/Core/Path/AliasAllowlist.php
rename to core/lib/Drupal/Core/Path/AliasPrefixLookup.php
index cae3896f67..a9189686e5 100644
--- a/core/lib/Drupal/Core/Path/AliasAllowlist.php
+++ b/core/lib/Drupal/Core/Path/AliasPrefixLookup.php
@@ -8,9 +8,9 @@
 use Drupal\Core\Lock\LockBackendInterface;
 
 /**
- * Extends CacheCollector to build the path alias allowlist over time.
+ * Extends CacheCollector to build the path alias alias prefix lookup over time.
  */
-class AliasAllowlist extends CacheCollector implements AliasAllowlistInterface {
+class AliasPrefixLookup extends CacheCollector implements AliasPrefixLookupInterface {
 
   /**
    * The Key/Value Store to use for state.
@@ -27,7 +27,7 @@ class AliasAllowlist extends CacheCollector implements AliasAllowlistInterface {
   protected $aliasStorage;
 
   /**
-   * Constructs an AliasAllowlist object.
+   * Constructs an AliasPrefixLookup object.
    *
    * @param string $cid
    *   The cache id to use.
@@ -52,8 +52,8 @@ public function __construct($cid, CacheBackendInterface $cache, LockBackendInter
   protected function lazyLoadCache() {
     parent::lazyLoadCache();
 
-    // On a cold start $this->storage will be empty and the allowlist will
-    // need to be rebuilt from scratch. The allowlist is initialized from the
+    // On a cold start $this->storage will be empty and the prefix lookup will
+    // need to be rebuilt from scratch. The lookup is initialized from the
     // list of all valid path roots stored in the 'router.path_roots' state,
     // with values initialized to NULL. During the request, each path requested
     // that matches one of these keys will be looked up and the array value set
diff --git a/core/lib/Drupal/Core/Path/AliasPrefixLookupInterface.php b/core/lib/Drupal/Core/Path/AliasPrefixLookupInterface.php
new file mode 100644
index 0000000000..e1a59fda6c
--- /dev/null
+++ b/core/lib/Drupal/Core/Path/AliasPrefixLookupInterface.php
@@ -0,0 +1,15 @@
+<?php
+
+namespace Drupal\Core\Path;
+
+use Drupal\Core\Cache\CacheCollectorInterface;
+
+/**
+ * Cache the alias prefix lookup.
+ *
+ * The alias prefix lookup contains the first element of the router paths of all
+ * aliases. For example, if /node/12345 has an alias then "node" is added to
+ * the alias prefix lookup. This optimization allows skipping the lookup for
+ * every /user/{user} path if "user" is not in the alias prefix lookup.
+ */
+interface AliasPrefixLookupInterface extends CacheCollectorInterface {}
diff --git a/core/lib/Drupal/Core/Path/AliasWhitelist.php b/core/lib/Drupal/Core/Path/AliasWhitelist.php
index 701ef9fe58..4229b72ab1 100644
--- a/core/lib/Drupal/Core/Path/AliasWhitelist.php
+++ b/core/lib/Drupal/Core/Path/AliasWhitelist.php
@@ -2,10 +2,14 @@
 
 namespace Drupal\Core\Path;
 
+@trigger_error('\Drupal\Core\Path\AliasWhitelist is deprecated in Drupal 8.7.x and will be removed before Drupal 9.0.x. Use \Drupal\Core\Path\AliasPrefixLookup instead.', E_USER_DEPRECATED);
+
 /**
  * Extends CacheCollector to build the path alias allowlist over time.
  *
- * @deprecated
+ * @deprecated \Drupal\Core\Path\AliasWhitelist is deprecated in Drupal 8.7.x
+ * and will be removed before Drupal 9.0.x. Use \Drupal\Core\Path\AliasPrefixLookup
+ * instead.
  */
-class AliasWhitelist extends AliasAllowlist {
+class AliasWhitelist extends AliasPrefixLookup {
 }
diff --git a/core/lib/Drupal/Core/Path/AliasWhitelistInterface.php b/core/lib/Drupal/Core/Path/AliasWhitelistInterface.php
index b662db7ace..29531fc147 100644
--- a/core/lib/Drupal/Core/Path/AliasWhitelistInterface.php
+++ b/core/lib/Drupal/Core/Path/AliasWhitelistInterface.php
@@ -2,6 +2,8 @@
 
 namespace Drupal\Core\Path;
 
+@trigger_error('\Drupal\Core\Path\AliasWhitelistInterface is deprecated in Drupal 8.7.x and will be removed before Drupal 9.0.x. Use \Drupal\Core\Path\AliasPrefixLookupInterface instead.', E_USER_DEPRECATED);
+
 /**
  * Cache the alias allowlist.
  *
@@ -10,6 +12,8 @@
  * the allowlist. This optimization allows skipping the lookup for every
  * /user/{user} path if "user" is not in the allowlist.
  *
- * @deprecated
+ * @deprecated \Drupal\Core\Path\AliasWhitelistInterface is deprecated in Drupal
+ * 8.7.x and * will be removed before Drupal 9.0.x. Use
+ * \Drupal\Core\Path\AliasPrefixLookupInterface instead.
  */
-interface AliasWhitelistInterface extends AliasAllowlistInterface {}
+interface AliasWhitelistInterface extends AliasPrefixLookupInterface {}
diff --git a/core/lib/Drupal/Core/Render/theme.api.php b/core/lib/Drupal/Core/Render/theme.api.php
index 51e85991e8..5b29f6f3b4 100644
--- a/core/lib/Drupal/Core/Render/theme.api.php
+++ b/core/lib/Drupal/Core/Render/theme.api.php
@@ -274,7 +274,7 @@
  *   vectors while allowing a permissive list of HTML tags that are not XSS
  *   vectors. (For example, <script> and <style> are not allowed.) See
  *   \Drupal\Component\Utility\Xss::$adminTags for the list of allowed tags. If
- *   your markup needs any of the tags not in this allowlist, then you can
+ *   your markup needs any of the tags not in this allowed tags, then you can
  *   implement a theme hook and/or an asset library. Alternatively, you can use
  *   the key #allowed_tags to alter which tags are filtered.
  * - #plain_text: Specifies that the array provides text that needs to be
diff --git a/core/lib/Drupal/Core/Security/RequestSanitizer.php b/core/lib/Drupal/Core/Security/RequestSanitizer.php
index cc3b922294..6a6631bb87 100644
--- a/core/lib/Drupal/Core/Security/RequestSanitizer.php
+++ b/core/lib/Drupal/Core/Security/RequestSanitizer.php
@@ -17,9 +17,9 @@ class RequestSanitizer {
   const SANITIZED = '_drupal_request_sanitized';
 
   /**
-   * The name of the setting that configures the allowlist.
+   * The name of the setting that configures the safe array keys.
    */
-  const SANITIZE_WHITELIST = 'sanitize_input_allowlist';
+  const SANITIZE_WHITELIST = 'sanitize_input_whitelist';
 
   /**
    * The name of the setting that determines if sanitized keys are logged.
@@ -31,15 +31,15 @@ class RequestSanitizer {
    *
    * @param \Symfony\Component\HttpFoundation\Request $request
    *   The incoming request to sanitize.
-   * @param string[] $allowlist
-   *   An array of keys to allowlist as safe. See default.settings.php.
+   * @param string[] $safe_array_keys
+   *   An array of safe. See default.settings.php.
    * @param bool $log_sanitized_keys
    *   (optional) Set to TRUE to log keys that are sanitized.
    *
    * @return \Symfony\Component\HttpFoundation\Request
    *   The sanitized request.
    */
-  public static function sanitize(Request $request, $allowlist, $log_sanitized_keys = FALSE) {
+  public static function sanitize(Request $request, $safe_array_keys, $log_sanitized_keys = FALSE) {
     if (!$request->attributes->get(self::SANITIZED, FALSE)) {
       $update_globals = FALSE;
       $bags = [
@@ -48,7 +48,7 @@ public static function sanitize(Request $request, $allowlist, $log_sanitized_key
         'cookies' => 'Potentially unsafe keys removed from cookie parameters: %s',
       ];
       foreach ($bags as $bag => $message) {
-        if (static::processParameterBag($request->$bag, $allowlist, $log_sanitized_keys, $bag, $message)) {
+        if (static::processParameterBag($request->$bag, $safe_array_keys, $log_sanitized_keys, $bag, $message)) {
           $update_globals = TRUE;
         }
       }
@@ -65,8 +65,8 @@ public static function sanitize(Request $request, $allowlist, $log_sanitized_key
    *
    * @param \Symfony\Component\HttpFoundation\ParameterBag $bag
    *   The parameter bag to process.
-   * @param string[] $allowlist
-   *   An array of keys to allowlist as safe.
+   * @param string[] $safe_array_keys
+   *   An array of safe keys.
    * @param bool $log_sanitized_keys
    *   Set to TRUE to log keys that are sanitized.
    * @param string $bag_name
@@ -78,10 +78,10 @@ public static function sanitize(Request $request, $allowlist, $log_sanitized_key
    * @return bool
    *   TRUE if the parameter bag has been sanitized, FALSE if not.
    */
-  protected static function processParameterBag(ParameterBag $bag, $allowlist, $log_sanitized_keys, $bag_name, $message) {
+  protected static function processParameterBag(ParameterBag $bag, $safe_array_keys, $log_sanitized_keys, $bag_name, $message) {
     $sanitized = FALSE;
     $sanitized_keys = [];
-    $bag->replace(static::stripDangerousValues($bag->all(), $allowlist, $sanitized_keys));
+    $bag->replace(static::stripDangerousValues($bag->all(), $safe_array_keys, $sanitized_keys));
     if (!empty($sanitized_keys)) {
       $sanitized = TRUE;
       if ($log_sanitized_keys) {
@@ -90,7 +90,7 @@ protected static function processParameterBag(ParameterBag $bag, $allowlist, $lo
     }
 
     if ($bag->has('destination')) {
-      $destination_dangerous_keys = static::checkDestination($bag->get('destination'), $allowlist);
+      $destination_dangerous_keys = static::checkDestination($bag->get('destination'), $safe_array_keys);
       if (!empty($destination_dangerous_keys)) {
         // The destination is removed rather than sanitized because the URL
         // generator service is not available and this method is called very
@@ -131,23 +131,23 @@ protected static function checkDestination($destination, array $allowlist) {
    *
    * @param mixed $input
    *   The input to sanitize.
-   * @param string[] $allowlist
-   *   An array of keys to allowlist as safe.
+   * @param string[] $safe_array_keys
+   *   An array of safe keys.
    * @param string[] $sanitized_keys
    *   An array of keys that have been removed.
    *
    * @return mixed
    *   The sanitized input.
    */
-  protected static function stripDangerousValues($input, array $allowlist, array &$sanitized_keys) {
+  protected static function stripDangerousValues($input, array $safe_array_keys, array &$sanitized_keys) {
     if (is_array($input)) {
       foreach ($input as $key => $value) {
-        if ($key !== '' && $key[0] === '#' && !in_array($key, $allowlist, TRUE)) {
+        if ($key !== '' && $key[0] === '#' && !in_array($key, $safe_array_keys, TRUE)) {
           unset($input[$key]);
           $sanitized_keys[] = $key;
         }
         else {
-          $input[$key] = static::stripDangerousValues($input[$key], $allowlist, $sanitized_keys);
+          $input[$key] = static::stripDangerousValues($input[$key], $safe_array_keys, $sanitized_keys);
         }
       }
     }
diff --git a/core/lib/Drupal/Core/Template/Loader/StringLoader.php b/core/lib/Drupal/Core/Template/Loader/StringLoader.php
index 799c02fe38..35d5dc3ebb 100644
--- a/core/lib/Drupal/Core/Template/Loader/StringLoader.php
+++ b/core/lib/Drupal/Core/Template/Loader/StringLoader.php
@@ -9,7 +9,7 @@
 /**
  * Loads string templates, also known as inline templates.
  *
- * This loader is intended to be used in a Twig loader chain and allowlists
+ * This loader is intended to be used in a Twig loader chain and allowed
  * string templates that begin with the following comment:
  * @code
  * {# inline_template_start #}
diff --git a/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php b/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php
index 64d20d34ca..22f0588bc5 100644
--- a/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php
+++ b/core/lib/Drupal/Core/Template/TwigSandboxPolicy.php
@@ -16,26 +16,26 @@
 class TwigSandboxPolicy implements \Twig_Sandbox_SecurityPolicyInterface {
 
   /**
-   * An array of allowlisted methods in the form of methodName => TRUE.
+   * An array of allowed methods in the form of methodName => TRUE.
    *
    * @var array
    */
-  protected $allowlisted_methods;
+  protected $allowedMethods;
 
   /**
-   * An array of allowlisted method prefixes -- any method starting with one of
+   * An array of allowed method prefixes -- any method starting with one of
    * these prefixes will be allowed.
    *
    * @var array
    */
-  protected $allowlisted_prefixes;
+  protected $allowedMethodPrefixes;
 
   /**
    * An array of class names for which any method calls are allowed.
    *
    * @var array
    */
-  protected $allowlisted_classes;
+  protected $allowedClasses;
 
   /**
    * Constructs a new TwigSandboxPolicy object.
@@ -43,15 +43,15 @@ class TwigSandboxPolicy implements \Twig_Sandbox_SecurityPolicyInterface {
   public function __construct() {
     // Allow settings.php to override our default allowlisted classes, methods,
     // and prefixes.
-    $allowlisted_classes = Settings::get('twig_sandbox_allowlisted_classes', [
+    $allowed_classes = Settings::get('twig_sandbox_whitelisted_classes', [
       // Allow any operations on the Attribute object as it is intended to be
       // changed from a Twig template, for example calling addClass().
       'Drupal\Core\Template\Attribute',
     ]);
     // Flip the arrays so we can check using isset().
-    $this->allowlisted_classes = array_flip($allowlisted_classes);
+    $this->allowedClasses = array_flip($allowed_classes);
 
-    $allowlisted_methods = Settings::get('twig_sandbox_allowlisted_methods', [
+    $allowedMethods = Settings::get('twig_sandbox_whitelisted_methods', [
       // Only allow idempotent methods.
       'id',
       'label',
@@ -60,9 +60,9 @@ public function __construct() {
       '__toString',
       'toString',
     ]);
-    $this->allowlisted_methods = array_flip($allowlisted_methods);
+    $this->allowedMethods = array_flip($allowedMethods);
 
-    $this->allowlisted_prefixes = Settings::get('twig_sandbox_allowlisted_prefixes', [
+    $this->allowedMethodPrefixes = Settings::get('twig_sandbox_whitelisted_prefixes', [
       'get',
       'has',
       'is',
@@ -83,20 +83,20 @@ public function checkPropertyAllowed($obj, $property) {}
    * {@inheritdoc}
    */
   public function checkMethodAllowed($obj, $method) {
-    foreach ($this->allowlisted_classes as $class => $key) {
+    foreach ($this->allowedClasses as $class => $key) {
       if ($obj instanceof $class) {
         return TRUE;
       }
     }
 
     // Return quickly for an exact match of the method name.
-    if (isset($this->allowlisted_methods[$method])) {
+    if (isset($this->allowedMethods[$method])) {
       return TRUE;
     }
 
     // If the method name starts with a allowlisted prefix, allow it.
     // Note: strpos() is between 3x and 7x faster than preg_match in this case.
-    foreach ($this->allowlisted_prefixes as $prefix) {
+    foreach ($this->allowedMethodPrefixes as $prefix) {
       if (strpos($method, $prefix) === 0) {
         return TRUE;
       }
diff --git a/core/lib/Drupal/Core/Utility/Error.php b/core/lib/Drupal/Core/Utility/Error.php
index c4e2791c79..1e47e58079 100644
--- a/core/lib/Drupal/Core/Utility/Error.php
+++ b/core/lib/Drupal/Core/Utility/Error.php
@@ -19,11 +19,11 @@ class Error {
   const ERROR = 3;
 
   /**
-   * An array of denylisted functions.
+   * An array of denied functions.
    *
    * @var array
    */
-  protected static $denylistFunctions = ['debug', '_drupal_error_handler', '_drupal_exception_handler'];
+  protected static $deniedFunctions = ['debug', '_drupal_error_handler', '_drupal_exception_handler'];
 
   /**
    * Decodes an exception and retrieves the correct caller.
@@ -113,7 +113,7 @@ public static function getLastCaller(array &$backtrace) {
     // Errors that occur inside PHP internal functions do not generate
     // information about file and line. Ignore black listed functions.
     while (($backtrace && !isset($backtrace[0]['line'])) ||
-      (isset($backtrace[1]['function']) && in_array($backtrace[1]['function'], static::$denylistFunctions))) {
+      (isset($backtrace[1]['function']) && in_array($backtrace[1]['function'], static::$deniedFunctions))) {
       array_shift($backtrace);
     }
 
diff --git a/core/lib/Drupal/Core/Utility/ProjectInfo.php b/core/lib/Drupal/Core/Utility/ProjectInfo.php
index 52c5874237..848deb7628 100644
--- a/core/lib/Drupal/Core/Utility/ProjectInfo.php
+++ b/core/lib/Drupal/Core/Utility/ProjectInfo.php
@@ -35,11 +35,11 @@ class ProjectInfo {
    * @param bool $status
    *   Boolean that controls what status (enabled or uninstalled) to process out
    *   of the $list and add to the $projects array.
-   * @param array $additional_allowlist
+   * @param array $additional_info_keys
    *   (optional) Array of additional elements to be collected from the .info.yml
    *   file. Defaults to array().
    */
-  public function processInfoList(array &$projects, array $list, $project_type, $status, array $additional_allowlist = []) {
+  public function processInfoList(array &$projects, array $list, $project_type, $status, array $additional_info_keys = []) {
     foreach ($list as $file) {
       // Just projects with a matching status should be listed.
       if ($file->status != $status) {
@@ -111,7 +111,7 @@ public function processInfoList(array &$projects, array $list, $project_type, $s
           'name' => $project_name,
           // Only save attributes from the .info.yml file we care about so we do
           // not bloat our RAM usage needlessly.
-          'info' => $this->filterProjectInfo($file->info, $additional_allowlist),
+          'info' => $this->filterProjectInfo($file->info, $additional_info_keys),
           'datestamp' => $file->info['datestamp'],
           'includes' => [$file->getName() => $file->info['name']],
           'project_type' => $project_display_type,
@@ -165,7 +165,7 @@ public function getProjectName(Extension $file) {
    * @param array $info
    *   Array of .info.yml file data as returned by
    *   \Drupal\Core\Extension\InfoParser.
-   * @param $additional_allowlist
+   * @param $additional_keys
    *   (optional) Array of additional elements to be collected from the .info.yml
    *   file. Defaults to array().
    *
@@ -174,8 +174,8 @@ public function getProjectName(Extension $file) {
    *
    * @see \Drupal\Core\Utility\ProjectInfo::processInfoList()
    */
-  public function filterProjectInfo($info, $additional_allowlist = []) {
-    $allowlist = [
+  public function filterProjectInfo($info, $additional_keys = []) {
+    $allowed_keys = [
       '_info_file_ctime',
       'datestamp',
       'major',
@@ -185,8 +185,8 @@ public function filterProjectInfo($info, $additional_allowlist = []) {
       'project status url',
       'version',
     ];
-    $allowlist = array_merge($allowlist, $additional_allowlist);
-    return array_intersect_key($info, array_combine($allowlist, $allowlist));
+    $allowed_keys = array_merge($allowed_keys, $additional_keys);
+    return array_intersect_key($info, array_combine($allowed_keys, $allowed_keys));
   }
 
 }
diff --git a/core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php b/core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php
index a3c1de0180..bd022f2ef3 100644
--- a/core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php
+++ b/core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php
@@ -210,8 +210,7 @@ protected static function createBigPipeJsPlaceholder($original_placeholder, arra
         'library' => [
           'big_pipe/big_pipe',
         ],
-        // Inform BigPipe' JavaScript known BigPipe placeholder IDs (an
-        // allowlist).
+        // Inform BigPipe' JavaScript known BigPipe placeholder IDs.
         'drupalSettings' => [
           'bigPipePlaceholderIds' => [$big_pipe_placeholder_id => TRUE],
         ],
diff --git a/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Internal.php b/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Internal.php
index 465aef9a0e..e78f8e30c4 100644
--- a/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Internal.php
+++ b/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Internal.php
@@ -572,7 +572,7 @@ protected function generateACFSettings(Editor $editor) {
             return $value === FALSE;
           });
           if (count($disallowed_attributes)) {
-            // No need to denylist the 'class' or 'style' attributes; CKEditor
+            // No need to filter the 'class' or 'style' attributes; CKEditor
             // handles them separately (if no specific class or style attribute
             // values are allowed, then those attributes are disallowed).
             if (isset($disallowed_attributes['class'])) {
diff --git a/core/modules/editor/js/editor.admin.es6.js b/core/modules/editor/js/editor.admin.es6.js
index c415a83dd0..d50025a53b 100644
--- a/core/modules/editor/js/editor.admin.es6.js
+++ b/core/modules/editor/js/editor.admin.es6.js
@@ -615,21 +615,21 @@
           // Otherwise, it is still possible that this feature is allowed.
 
           // Every tag must be explicitly allowed if there are filter rules
-          // doing tag allowlisting.
+          // doing tag allowing.
           if (!_.every(_.pluck(universe, 'tag'))) {
             return false;
           }
           // Every tag was explicitly allowed, but since the universe is not
           // empty, one or more tag properties are disallowed. However, if
-          // only denylisting of tag properties was applied to these tags,
-          // and no allowlisting was ever applied, then it's still fine:
-          // since none of the tag properties were denylisted, we got to
-          // this point, and since no allowlisting was applied, it doesn't
+          // only allowed tag properties was applied to these tags,
+          // and no allowing was ever applied, then it's still fine:
+          // since none of the tag properties were denied, we got to
+          // this point, and since no allowing was applied, it doesn't
           // matter that the properties: this could never have happened
           // anyway. It's only this late that we can know this for certain.
 
           const tags = _.keys(universe);
-          // Figure out if there was any rule applying allowlisting tag
+          // Figure out if there was any rule applying allowed tag
           // restrictions to each of the remaining tags.
           for (let i = 0; i < tags.length; i++) {
             const tag = tags[i];
@@ -641,7 +641,7 @@
           }
           return _.isEmpty(universe);
         }
-        // Otherwise, if all filter rules were doing denylisting, then the sole
+        // Otherwise, if all filter rules were doing denying, then the sole
         // fact that we got to this point indicates that this filter allows for
         // everything that is required for this feature.
 
@@ -831,8 +831,8 @@
    * Intended to be used in combination with {@link Drupal.FilterStatus}.
    *
    * A text filter rule object describes:
-   *  1. allowed or forbidden tags: (optional) allowlist or denylist HTML tags
-   *  2. restricted tag properties: (optional) allowlist or denylist
+   *  1. allowed or forbidden tags: (optional) allowed or denied HTML tags
+   *  2. restricted tag properties: (optional) allowed or denied
    *     attributes, styles and classes on a set of HTML tags.
    *
    * Typically, each text filter rule object does either 1 or 2, not both.
@@ -844,12 +844,12 @@
    *     no restrictions are applied.
    *  2. all nested within the "restrictedTags" key: use the "tags" subkey to
    *     list HTML tags to which you want to apply property restrictions, then
-   *     use the "allowed" subkey to allowlist specific property values, and
-   *     similarly use the "forbidden" subkey to denylist specific property
+   *     use the "allowed" subkey to allowed specific property values, and
+   *     similarly use the "forbidden" subkey to allow specific property
    *     values.
    *
    * @example
-   * <caption>Allowlist the "p", "strong" and "a" HTML tags.</caption>
+   * <caption>Allow the "p", "strong" and "a" HTML tags.</caption>
    * {
    *   tags: ['p', 'strong', 'a'],
    *   allow: true,
diff --git a/core/modules/editor/src/EditorXssFilter/Standard.php b/core/modules/editor/src/EditorXssFilter/Standard.php
index 48a692b733..996e004431 100644
--- a/core/modules/editor/src/EditorXssFilter/Standard.php
+++ b/core/modules/editor/src/EditorXssFilter/Standard.php
@@ -16,13 +16,13 @@ class Standard extends Xss implements EditorXssFilterInterface {
    * {@inheritdoc}
    */
   public static function filterXss($html, FilterFormatInterface $format, FilterFormatInterface $original_format = NULL) {
-    // Apply XSS filtering, but denylist the <script>, <style>, <link>, <embed>
+    // Apply XSS filtering, but deny the <script>, <style>, <link>, <embed>
     // and <object> tags.
-    // The <script> and <style> tags are denylisted because their contents
+    // The <script> and <style> tags are denied because their contents
     // can be malicious (and therefore they are inherently unsafe), whereas for
     // all other tags, only their attributes can make them malicious. Since
     // \Drupal\Component\Utility\Xss::filter() protects against malicious
-    // attributes, we take no denylisting action.
+    // attributes, we take no deny action.
     // The exceptions to the above rule are <link>, <embed> and <object>:
     // - <link> because the href attribute allows the attacker to import CSS
     //   using the HTTP(S) protocols which Xss::filter() considers safe by
@@ -37,7 +37,7 @@ public static function filterXss($html, FilterFormatInterface $format, FilterFor
     // embedded, hence ensuring the same origin policy always applies.
     $dangerous_tags = ['script', 'style', 'link', 'embed', 'object'];
 
-    // Simply denylisting these five dangerous tags would bring safety, but
+    // Simply deny these five dangerous tags would bring safety, but
     // also user frustration: what if a text format is configured to allow
     // <embed>, for example? Then we would strip that tag, even though it is
     // allowed, thereby causing data loss!
@@ -52,7 +52,7 @@ public static function filterXss($html, FilterFormatInterface $format, FilterFor
       $original_format_restrictions = $original_format->getHtmlRestrictions();
     }
 
-    // Any tags that are explicitly denylisted by the text format must be
+    // Any tags that are explicitly denied by the text format must be
     // appended to the list of default dangerous tags: if they're explicitly
     // forbidden, then we must respect that configuration.
     // When switching from another text format, we must use the union of
@@ -63,7 +63,7 @@ public static function filterXss($html, FilterFormatInterface $format, FilterFor
       $forbidden_tags = array_merge($forbidden_tags, self::getForbiddenTags($original_format_restrictions));
     }
 
-    // Any tags that are explicitly allowlisted by the text format must be
+    // Any tags that are explicitly allowed by the text format must be
     // removed from the list of default dangerous tags: if they're explicitly
     // allowed, then we must respect that configuration.
     // When switching from another format, we must use the intersection of
@@ -74,14 +74,14 @@ public static function filterXss($html, FilterFormatInterface $format, FilterFor
       $allowed_tags = array_intersect($allowed_tags, self::getAllowedTags($original_format_restrictions));
     }
 
-    // Don't denylist dangerous tags that are explicitly allowed in both text
+    // Don't deny dangerous tags that are explicitly allowed in both text
     // formats.
-    $denylisted_tags = array_diff($dangerous_tags, $allowed_tags);
+    $denied_tags = array_diff($dangerous_tags, $allowed_tags);
 
     // Also denylist tags that are explicitly forbidden in either text format.
-    $denylisted_tags = array_merge($denylisted_tags, $forbidden_tags);
+    $denied_tags = array_merge($denied_tags, $forbidden_tags);
 
-    $output = static::filter($html, $denylisted_tags);
+    $output = static::filter($html, $denied_tags);
 
     // Since data-attributes can contain encoded HTML markup that could be
     // decoded and interpreted by editors, we need to apply XSS filtering to
@@ -164,8 +164,8 @@ protected static function getForbiddenTags($restrictions) {
    * {@inheritdoc}
    */
   protected static function needsRemoval($html_tags, $elem) {
-    // See static::filterXss() about how this class uses denylisting instead
-    // of the normal allowlisting.
+    // See static::filterXss() about how this class uses denying instead
+    // of the normal allowing.
     return !parent::needsRemoval($html_tags, $elem);
   }
 
diff --git a/core/modules/editor/tests/src/Unit/EditorXssFilter/StandardTest.php b/core/modules/editor/tests/src/Unit/EditorXssFilter/StandardTest.php
index 7cb7618ee1..2fa98ab441 100644
--- a/core/modules/editor/tests/src/Unit/EditorXssFilter/StandardTest.php
+++ b/core/modules/editor/tests/src/Unit/EditorXssFilter/StandardTest.php
@@ -510,7 +510,7 @@ public function providerTestFilterXss() {
     // @see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#URL_string_evasion
     // This one is irrelevant for Drupal; Drupal doesn't forbid linking to some
     // sites, it only forbids linking to any protocols other than those that are
-    // allowlisted.
+    // allowed.
 
     // Test XSS filtering on data-attributes.
     // @see \Drupal\editor\EditorXssFilter::filterXssDataAttributes()
@@ -558,17 +558,17 @@ public function testFilterXss($input, $expected_output) {
    * @param array $disallowed_tags
    *   (optional) The disallowed HTML tags to be passed to \Drupal\Component\Utility\Xss::filter().
    *
-   * @dataProvider providerTestDenyListMode
+   * @dataProvider providerTestDeniedTagsMode
    */
-  public function testDenyListMode($value, $expected, $message, array $disallowed_tags) {
+  public function testDeniedTagsMode($value, $expected, $message, array $disallowed_tags) {
     $value = Standard::filter($value, $disallowed_tags);
     $this->assertSame($expected, $value, $message);
   }
 
   /**
-   * Data provider for testDenyListMode().
+   * Data provider for testDeniedTagsMode().
    *
-   * @see testDenyListMode()
+   * @see testDeniedTagsMode()
    *
    * @return array
    *   An array of arrays containing the following elements:
@@ -577,7 +577,7 @@ public function testDenyListMode($value, $expected, $message, array $disallowed_
    *     - The assertion message.
    *     - (optional) The disallowed HTML tags to be passed to \Drupal\Component\Utility\Xss::filter().
    */
-  public function providerTestDenyListMode() {
+  public function providerTestDeniedTagsMode() {
     return [
       [
         '<unknown style="visibility:hidden">Pink Fairy Armadillo</unknown><video src="gerenuk.mp4"><script>alert(0)</script>',
diff --git a/core/modules/filter/src/Element/TextFormat.php b/core/modules/filter/src/Element/TextFormat.php
index 7c745f7d1c..d2dfcb8dfe 100644
--- a/core/modules/filter/src/Element/TextFormat.php
+++ b/core/modules/filter/src/Element/TextFormat.php
@@ -84,7 +84,7 @@ public static function processFormat(&$element, FormStateInterface $form_state,
 
     // Ensure that children appear as subkeys of this element.
     $element['#tree'] = TRUE;
-    $denylist = [
+    $disallowed_keys = [
       // Make \Drupal::formBuilder()->doBuildForm() regenerate child properties.
       '#parents',
       '#id',
@@ -108,7 +108,7 @@ public static function processFormat(&$element, FormStateInterface $form_state,
     // Move this element into sub-element 'value'.
     unset($element['value']);
     foreach (Element::properties($element) as $key) {
-      if (!in_array($key, $denylist)) {
+      if (!in_array($key, $disallowed_keys)) {
         $element['value'][$key] = $element[$key];
       }
     }
diff --git a/core/modules/filter/src/Entity/FilterFormat.php b/core/modules/filter/src/Entity/FilterFormat.php
index 9e325f24d4..e5b17a1450 100644
--- a/core/modules/filter/src/Entity/FilterFormat.php
+++ b/core/modules/filter/src/Entity/FilterFormat.php
@@ -304,7 +304,7 @@ public function getHtmlRestrictions() {
         // with the existing set, to ensure we only end up with the tags that are
         // allowed by *all* filters with an "allowed html" setting.
         else {
-          // Track the union of forbidden (denylisted) tags.
+          // Track the union of forbidden tags.
           if (isset($new_restrictions['forbidden_tags'])) {
             if (!isset($restrictions['forbidden_tags'])) {
               $restrictions['forbidden_tags'] = $new_restrictions['forbidden_tags'];
@@ -314,15 +314,15 @@ public function getHtmlRestrictions() {
             }
           }
 
-          // Track the intersection of allowed (allowlisted) tags.
+          // Track the intersection of allowed tags.
           if (isset($restrictions['allowed'])) {
             $intersection = $restrictions['allowed'];
             foreach ($intersection as $tag => $attributes) {
-              // If the current tag is not allowlisted by the new filter, then
+              // If the current tag is not allowed by the new filter, then
               // it's outside of the intersection.
               if (!array_key_exists($tag, $new_restrictions['allowed'])) {
                 // The exception is the asterisk (which applies to all tags): it
-                // does not need to be allowlisted by every filter in order to be
+                // does not need to be allowed by every filter in order to be
                 // used; not every filter needs attribute restrictions on all tags.
                 if ($tag === '*') {
                   continue;
@@ -375,10 +375,10 @@ public function getHtmlRestrictions() {
         }
       }, NULL);
 
-      // Simplification: if we have both a (intersected) allowlist and a (unioned)
-      // denylist, then remove any tags from the allowlist that also exist in the
-      // denylist. Now the allowlist alone expresses all tag-level restrictions,
-      // and we can delete the denylist.
+      // Simplification: if we have both (intersected) allowed and (unioned)
+      // disallowed keys, then remove any tags from the allowed tags that also
+      // exist in the disallowed keys. Now the allowed tags alone expresses all
+      // tag-level restrictions, and we can delete the disallowed tags.
       if (isset($restrictions['allowed']) && isset($restrictions['forbidden_tags'])) {
         foreach ($restrictions['forbidden_tags'] as $tag) {
           if (isset($restrictions['allowed'][$tag])) {
@@ -390,7 +390,7 @@ public function getHtmlRestrictions() {
 
       // Simplification: if the only remaining allowed tag is the asterisk (which
       // contains attribute restrictions that apply to all tags), and only
-      // allowlisting filters were used, then effectively nothing is allowed.
+      // allowed tags filters were used, then effectively nothing is allowed.
       if (isset($restrictions['allowed'])) {
         if (count($restrictions['allowed']) === 1 && array_key_exists('*', $restrictions['allowed']) && !isset($restrictions['forbidden_tags'])) {
           $restrictions['allowed'] = [];
diff --git a/core/modules/filter/src/FilterFormatInterface.php b/core/modules/filter/src/FilterFormatInterface.php
index fd28a779c3..bc4c818e7b 100644
--- a/core/modules/filter/src/FilterFormatInterface.php
+++ b/core/modules/filter/src/FilterFormatInterface.php
@@ -73,7 +73,7 @@ public function getFilterTypes();
    * @return array|false
    *   A structured array as returned by FilterInterface::getHTMLRestrictions(),
    *   but with the intersection of all filters in this text format.
-   *   Will either indicate denylisting of tags or allowlisting of tags. In
+   *   Will either indicate disallowed tags or allowed tags. In
    *   the latter case, it's possible that restrictions on attributes are also
    *   stored. FALSE means there are no HTML restrictions.
    */
diff --git a/core/modules/filter/src/Plugin/Filter/FilterHtml.php b/core/modules/filter/src/Plugin/Filter/FilterHtml.php
index 31641317f2..2637607801 100644
--- a/core/modules/filter/src/Plugin/Filter/FilterHtml.php
+++ b/core/modules/filter/src/Plugin/Filter/FilterHtml.php
@@ -113,7 +113,7 @@ public function filterAttributes($text) {
     $xpath = new \DOMXPath($html_dom);
     foreach ($restrictions['allowed'] as $allowed_tag => $tag_attributes) {
       // By default, no attributes are allowed for a tag, but due to the
-      // globally allowlisted attributes, it is impossible for a tag to actually
+      // globally allowed attributes, it is impossible for a tag to actually
       // completely disallow attributes.
       if ($tag_attributes === FALSE) {
         $tag_attributes = [];
@@ -149,23 +149,23 @@ public function filterAttributes($text) {
   }
 
   /**
-   * Filter attributes on an element by name and value according to a allowlist.
+   * Filter attributes on an element by allowed name and value.
    *
    * @param \DOMElement $element
    *   The element to be processed.
    * @param array $allowed_attributes
-   *   The attributes allowlist as an array of names and values.
+   *   The allowed attributes as an array of names and values.
    */
   protected function filterElementAttributes(\DOMElement $element, array $allowed_attributes) {
     $modified_attributes = [];
     foreach ($element->attributes as $name => $attribute) {
-      // Remove attributes not in the allowlist.
+      // Remove attributes not in the allowed attributes.
       $allowed_value = $this->findAllowedValue($allowed_attributes, $name);
       if (empty($allowed_value)) {
         $modified_attributes[$name] = FALSE;
       }
       elseif ($allowed_value !== TRUE) {
-        // Check the attribute values allowlist.
+        // Check the attribute values allowed attributes.
         $attribute_values = preg_split('/\s+/', $attribute->value, -1, PREG_SPLIT_NO_EMPTY);
         $modified_attributes[$name] = [];
         foreach ($attribute_values as $value) {
@@ -247,7 +247,7 @@ public function getHTMLRestrictions() {
       return $this->restrictions;
     }
 
-    // Parse the allowed HTML setting, and gradually make the allowlist more
+    // Parse the allowed HTML setting, and gradually make the allowed tags more
     // specific.
     $restrictions = ['allowed' => []];
 
@@ -283,7 +283,7 @@ public function getHTMLRestrictions() {
           // but one allowed attribute value that some may be tempted to use
           // is specifically nonsensical: the asterisk. A prefix is required for
           // allowed attribute values with a wildcard. A wildcard by itself
-          // would mean allowlisting all possible attribute values. But in that
+          // would mean allow all possible attribute values. But in that
           // case, one would not specify an attribute value at all.
           $allowed_attribute_values = array_filter($allowed_attribute_values, function ($value) use ($star_protector) {
             return $value !== '*';
@@ -311,14 +311,14 @@ public function getHTMLRestrictions() {
     // The 'style' and 'on*' ('onClick' etc.) attributes are always forbidden,
     // and are removed by Xss::filter().
     // The 'lang', and 'dir' attributes apply to all elements and are always
-    // allowed. The value allowlist for the 'dir' attribute is enforced by
+    // allowed. The allowed values for the 'dir' attribute is enforced by
     // self::filterAttributes().  Note that those two attributes are in the
     // short list of globally usable attributes in HTML5. They are always
     // allowed since the correct values of lang and dir may only be known to
     // the content author. Of the other global attributes, they are not usually
     // added by hand to content, and especially the class attribute can have
     // undesired visual effects by allowing content authors to apply any
-    // available style, so specific values should be explicitly allowlisted.
+    // available style, so specific values should be explicitly allowed.
     // @see http://www.w3.org/TR/html5/dom.html#global-attributes
     $restrictions['allowed']['*'] = [
       'style' => FALSE,
diff --git a/core/modules/filter/tests/src/Kernel/FilterKernelTest.php b/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
index 40494d7f14..ada3ebb4e2 100644
--- a/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
+++ b/core/modules/filter/tests/src/Kernel/FilterKernelTest.php
@@ -400,7 +400,7 @@ public function testLineBreakFilter() {
    *   makes HTML filter completely ineffective.
    *
    * @todo Class, id, name and xmlns should be added to disallowed attributes,
-   *   or better a allowlist approach should be used for that too.
+   *   or better an allowed attributes approach should be used for that too.
    */
   public function testHtmlFilter() {
     // Get FilterHtml object.
@@ -455,11 +455,11 @@ public function testHtmlFilter() {
     $f = (string) $filter->process('<br />', Language::LANGCODE_NOT_SPECIFIED);
     $this->assertNormalized($f, '<br />', 'HTML filter should allow self-closing line breaks.');
 
-    // All attributes of allowlisted tags are stripped by default.
+    // All attributes of allowed tags are stripped by default.
     $f = (string) $filter->process('<a kitten="cute" llama="awesome">link</a>', Language::LANGCODE_NOT_SPECIFIED);
     $this->assertNormalized($f, '<a>link</a>', 'HTML filter should remove attributes that are not explicitly allowed.');
 
-    // Now allowlist the "llama" attribute on <a>.
+    // Now allow the "llama" attribute on <a>.
     $filter->setConfiguration([
       'settings' => [
         'allowed_html' => '<a href llama> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd> <br>',
@@ -470,7 +470,7 @@ public function testHtmlFilter() {
     $f = (string) $filter->process('<a kitten="cute" llama="awesome">link</a>', Language::LANGCODE_NOT_SPECIFIED);
     $this->assertNormalized($f, '<a llama="awesome">link</a>', 'HTML filter keeps explicitly allowed attributes, and removes attributes that are not explicitly allowed.');
 
-    // Restrict the allowlisted "llama" attribute on <a> to only allow the value
+    // Restrict the "llama" attribute on <a> to only allow the value
     // "majestical", or "epic".
     $filter->setConfiguration([
       'settings' => [
diff --git a/core/modules/language/tests/src/Unit/process/LanguageDomainsTest.php b/core/modules/language/tests/src/Unit/process/LanguageDomainsTest.php
index 6c583aeb7b..022fc4e6cd 100644
--- a/core/modules/language/tests/src/Unit/process/LanguageDomainsTest.php
+++ b/core/modules/language/tests/src/Unit/process/LanguageDomainsTest.php
@@ -14,7 +14,7 @@ class LanguageDomainsTest extends MigrateProcessTestCase {
   /**
    * {@inheritdoc}
    */
-  protected $backupGlobalsDenylist = ['base_url'];
+  protected $backupGlobalsBlacklist = ['base_url'];
 
   /**
    * {@inheritdoc}
diff --git a/core/modules/locale/locale.compare.inc b/core/modules/locale/locale.compare.inc
index 97f2b7c6ee..0d7d27e6cc 100644
--- a/core/modules/locale/locale.compare.inc
+++ b/core/modules/locale/locale.compare.inc
@@ -99,15 +99,15 @@ function locale_translation_project_list() {
   if (empty($projects)) {
     $projects = [];
 
-    $additional_allowlist = [
+    $additional_info_keys = [
       'interface translation project',
       'interface translation server pattern',
     ];
     $module_data = _locale_translation_prepare_project_list(system_rebuild_module_data(), 'module');
     $theme_data = _locale_translation_prepare_project_list(\Drupal::service('theme_handler')->rebuildThemeData(), 'theme');
     $project_info = new ProjectInfo();
-    $project_info->processInfoList($projects, $module_data, 'module', TRUE, $additional_allowlist);
-    $project_info->processInfoList($projects, $theme_data, 'theme', TRUE, $additional_allowlist);
+    $project_info->processInfoList($projects, $module_data, 'module', TRUE, $additional_info_keys);
+    $project_info->processInfoList($projects, $theme_data, 'theme', TRUE, $additional_info_keys);
 
     // Allow other modules to alter projects before fetching and comparing.
     \Drupal::moduleHandler()->alter('locale_translation_projects', $projects);
diff --git a/core/tests/Drupal/KernelTests/Core/Path/AliasTest.php b/core/tests/Drupal/KernelTests/Core/Path/AliasTest.php
index 4c7f3e13f3..63caefc250 100644
--- a/core/tests/Drupal/KernelTests/Core/Path/AliasTest.php
+++ b/core/tests/Drupal/KernelTests/Core/Path/AliasTest.php
@@ -6,7 +6,7 @@
 use Drupal\Core\Path\AliasStorage;
 use Drupal\Core\Database\Database;
 use Drupal\Core\Path\AliasManager;
-use Drupal\Core\Path\AliasAllowlist;
+use Drupal\Core\Path\AliasPrefixLookup;
 
 /**
  * Tests path alias CRUD and lookup functionality.
@@ -164,7 +164,7 @@ public function testAllowlist() {
 
     // Create AliasManager and Path object.
     $aliasStorage = new AliasStorage($connection, $this->container->get('module_handler'));
-    $allowlist = new AliasAllowlist('path_alias_allowlist', $memoryCounterBackend, $this->container->get('lock'), $this->container->get('state'), $aliasStorage);
+    $allowlist = new AliasPrefixLookup('path_alias_allowlist', $memoryCounterBackend, $this->container->get('lock'), $this->container->get('state'), $aliasStorage);
     $aliasManager = new AliasManager($aliasStorage, $allowlist, $this->container->get('language_manager'), $memoryCounterBackend);
 
     // No alias for user and admin yet, so should be NULL.
@@ -203,7 +203,7 @@ public function testAllowlist() {
 
     // Re-initialize the allowlist using the same cache backend, should load
     // from cache.
-    $allowlist = new AliasAllowlist('path_alias_allowlist', $memoryCounterBackend, $this->container->get('lock'), $this->container->get('state'), $aliasStorage);
+    $allowlist = new AliasPrefixLookup('path_alias_allowlist', $memoryCounterBackend, $this->container->get('lock'), $this->container->get('state'), $aliasStorage);
     $this->assertNull($allowlist->get('user'));
     $this->assertTrue($allowlist->get('admin'));
     $this->assertNull($allowlist->get($this->randomMachineName()));
@@ -228,7 +228,7 @@ public function testAllowlistCacheDeletionMidRequest() {
 
     // Create AliasManager and Path object.
     $aliasStorage = new AliasStorage($connection, $this->container->get('module_handler'));
-    $allowlist = new AliasAllowlist('path_alias_allowlist', $memoryCounterBackend, $this->container->get('lock'), $this->container->get('state'), $aliasStorage);
+    $allowlist = new AliasPrefixLookup('path_alias_allowlist', $memoryCounterBackend, $this->container->get('lock'), $this->container->get('state'), $aliasStorage);
     $aliasManager = new AliasManager($aliasStorage, $allowlist, $this->container->get('language_manager'), $memoryCounterBackend);
 
     // Allowlist cache should not exist at all yet.
@@ -257,7 +257,7 @@ public function testAllowlistCacheDeletionMidRequest() {
     // Allowlist should load data from its cache, see that it hasn't done a
     // check for 'user' yet, perform the check, then mark the result to be
     // persisted to cache.
-    $allowlist = new AliasAllowlist('path_alias_allowlist', $memoryCounterBackend, $this->container->get('lock'), $this->container->get('state'), $aliasStorage);
+    $allowlist = new AliasPrefixLookup('path_alias_allowlist', $memoryCounterBackend, $this->container->get('lock'), $this->container->get('state'), $aliasStorage);
     $this->assertTrue($allowlist->get('user'));
 
     // Delete the allowlist cache. This could happen from an outside process,
diff --git a/core/tests/Drupal/Tests/Core/DependencyInjection/Compiler/ProxyServicesPassTest.php b/core/tests/Drupal/Tests/Core/DependencyInjection/Compiler/ProxyServicesPassTest.php
index 660542bfb1..f4545474a4 100644
--- a/core/tests/Drupal/Tests/Core/DependencyInjection/Compiler/ProxyServicesPassTest.php
+++ b/core/tests/Drupal/Tests/Core/DependencyInjection/Compiler/ProxyServicesPassTest.php
@@ -67,7 +67,8 @@ public function testContainerWithLazyServices() {
    */
   public function testContainerWithLazyServicesWithoutProxyClass() {
     $container = new ContainerBuilder();
-    $container->register('alias_allowlist', 'Drupal\Core\Path\AliasAllowlist')
+    $container->register('alias_allowlist',
+      'Drupal\Core\Path\AliasPrefixLookup')
       ->setLazy(TRUE);
 
     $this->setExpectedException(InvalidArgumentException::class);
diff --git a/core/tests/Drupal/Tests/Core/Path/AliasManagerTest.php b/core/tests/Drupal/Tests/Core/Path/AliasManagerTest.php
index 917fbc8a34..241ceabcc4 100644
--- a/core/tests/Drupal/Tests/Core/Path/AliasManagerTest.php
+++ b/core/tests/Drupal/Tests/Core/Path/AliasManagerTest.php
@@ -30,7 +30,7 @@ class AliasManagerTest extends UnitTestCase {
   /**
    * Alias allowlist.
    *
-   * @var \Drupal\Core\Path\AliasAllowlistInterface|\PHPUnit_Framework_MockObject_MockObject
+   * @var \Drupal\Core\Path\AliasPrefixLookupInterface|\PHPUnit_Framework_MockObject_MockObject
    */
   protected $aliasAllowlist;
 
@@ -69,7 +69,7 @@ protected function setUp() {
     parent::setUp();
 
     $this->aliasStorage = $this->getMock('Drupal\Core\Path\AliasStorageInterface');
-    $this->aliasAllowlist = $this->getMock('Drupal\Core\Path\AliasAllowlistInterface');
+    $this->aliasAllowlist = $this->getMock('Drupal\Core\Path\AliasPrefixLookupInterface');
     $this->languageManager = $this->getMock('Drupal\Core\Language\LanguageManagerInterface');
     $this->cache = $this->getMock('Drupal\Core\Cache\CacheBackendInterface');