What is a Captive Portal? How WiFi Login Pages Work
This guide explains the technical architecture behind captive portals — the login pages you encounter on public WiFi. We'll cover how devices detect them, how authentication works, and the common configuration issues that trip up IT teams.
.png)
Heading 1
Heading 2
Heading 3
Heading 4
Heading 5
Heading 6
Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.
Block quote
Ordered list
- Item 1
- Item 2
- Item 3
Unordered list
- Item A
- Item B
- Item C
Bold text
Emphasis
Superscript
Subscript
Our cloud-based platform manages the full authentication flow — from splash page to RADIUS — across any hardware.
Key takeaways
A captive portal is a web page that intercepts a user's connection to a public WiFi network, requiring them to take an action before gaining internet access.
The Captive Network Assistant (CNA) in modern operating systems is what automatically detects the portal and triggers the login window.
A Walled Garden is a critical list of pre-approved websites (like the portal itself and social login providers) that a user can access before they authenticate.
For secure and scalable authentication, especially in corporate environments, captive portals rely on a centralised RADIUS server to validate user credentials.
Common issues like a non-appearing portal on iOS or problems with returning users are often linked to misconfigured walled gardens or the effects of MAC address randomisation.
Professional captive portal solutions are not hosted on the access point but on a separate, dedicated server or cloud platform.
Key terms
A web page that restricts network access until a user completes a required action, such as accepting terms of service or entering credentials. It acts as a gatekeeper between the user and the open internet.
The core mechanism that enforces authentication and acceptable use policies on guest WiFi networks.
A web page that restricts network access until a user completes a required action, such as accepting terms of service or entering credentials. It acts as a gatekeeper between the user and the open internet.
The core mechanism that enforces authentication and acceptable use policies on guest WiFi networks.
A web page that restricts network access until a user completes a required action, such as accepting terms of service or entering credentials. It acts as a gatekeeper between the user and the open internet.
The core mechanism that enforces authentication and acceptable use policies on guest WiFi networks.
A web page that restricts network access until a user completes a required action, such as accepting terms of service or entering credentials. It acts as a gatekeeper between the user and the open internet.
The core mechanism that enforces authentication and acceptable use policies on guest WiFi networks.
A web page that restricts network access until a user completes a required action, such as accepting terms of service or entering credentials. It acts as a gatekeeper between the user and the open internet.
The core mechanism that enforces authentication and acceptable use policies on guest WiFi networks.
A web page that restricts network access until a user completes a required action, such as accepting terms of service or entering credentials. It acts as a gatekeeper between the user and the open internet.
The core mechanism that enforces authentication and acceptable use policies on guest WiFi networks.
A web page that restricts network access until a user completes a required action, such as accepting terms of service or entering credentials. It acts as a gatekeeper between the user and the open internet.
The core mechanism that enforces authentication and acceptable use policies on guest WiFi networks.
A web page that restricts network access until a user completes a required action, such as accepting terms of service or entering credentials. It acts as a gatekeeper between the user and the open internet.
The core mechanism that enforces authentication and acceptable use policies on guest WiFi networks.
Frequently Asked Questions
A captive portal is a web page that restricts your access to a WiFi network until you complete a required action, such as accepting terms of service, logging in, or entering a voucher code. It's commonly used in airports, hotels, coffee shops, and other public venues to control and manage guest WiFi access.
When you connect to a network with a captive portal, your device's operating system automatically sends an HTTP request to a known URL to check for internet connectivity. If the request is blocked or redirected, the OS detects it's behind a captive portal and triggers the login window. The enforcement device then redirects your traffic to the portal's splash page until you authenticate.
A Captive Network Assistant (CNA) is a feature built into operating systems like iOS, Android, and Windows that automatically detects when a device is behind a captive portal. It works by sending HTTP requests to a known URL and checking whether it receives the expected response. If not, the CNA automatically pops up a mini-browser window so you can complete the authentication without manually opening your browser.
Captive portals work on most modern devices with web browsers, including smartphones, tablets, and laptops running iOS, Android, Windows, macOS, and Linux. However, devices without web browsers (like some IoT devices, printers, or smart TVs) may struggle with captive portals. These devices typically need to be placed in a separate VLAN or handled via MAC-based authentication bypass.
A walled garden is a list of network destinations (URLs or IP addresses) that users can access without authentication on a captive portal network. This typically includes the portal server itself, DNS services, and any external services needed for authentication (like social login provider domains). Without a properly configured walled garden, users won't even be able to reach the splash page to log in.
A captive portal is an access control mechanism that restricts network access until a user authenticates, whereas a VPN encrypts and tunnels your internet traffic through a secure server. Captive portals operate at the network level to control who gets access; VPNs operate at the transport level to secure what travels over that access. They serve different purposes and are often used together.
Yes, captive portals can collect user data, depending on how they're configured. Common data points include email addresses, names, phone numbers, and demographic information, especially when social login is used. Under GDPR and similar regulations, this data must be collected with clear consent, stored securely, and used only for its stated purpose. Purple's platform handles compliance requirements including data minimisation and consent capture.
If the captive portal isn't appearing on an iOS device, it's usually because the Captive Network Assistant's connectivity check to captive.apple.com is failing. Common causes include a misconfigured walled garden that doesn't include Apple's CNA domains, an invalid or self-signed SSL certificate on the portal server, a VPN or DNS filter on the device blocking the check, or the network being previously saved with a successful connection state cached.
Captive Portal Architecture: A Technical Deep Dive
Captive Portal Architecture: A Technical Deep Dive
Captive Portal Architecture: A Technical Deep Dive
Captive Portal Architecture: A Technical Deep Dive
Want to see Purple's captive portal in action?
