What Is a Captive Portal? Meaning, How It Works and Why It Matters

A captive portal is the web page a person sees after joining a Wi-Fi network and before they can use the internet. It usually asks them to log in, accept terms, enter a code or pay for a plan. Until they do, the network holds them “captive”: they are connected to the Wi-Fi, but their traffic does not reach the internet.

You have used one if you have logged in to Wi-Fi at an airport, hotel, college or café. For the business running the network, the captive portal is the front door. It decides who gets online, for how long, at what speed, and it can carry the venue’s branding, offers and paid plans.

A captive portal is not a separate box. It is a set of rules on the router or gateway, plus a login page and a system that decides whether to let each device through. The flow looks like this:

• The phone or laptop joins the Wi-Fi network (the SSID) and gets an IP address from the router over DHCP.
• Modern phones immediately test the connection by requesting a known web address. Android, iOS, Windows and macOS each have their own test URL.
• The gateway sees that this device is not logged in yet and intercepts the request. Instead of the expected reply, it returns a redirect to the login page.
• The phone notices the unexpected answer and opens the login page automatically, often in a small pop-up browser.
• The guest completes the login. The gateway asks an authentication server whether to allow the device, usually over the RADIUS protocol.
• If the answer is yes, the gateway opens the internet for that device, applying any time, data or speed limits the server sent back.

The walled garden is the list of addresses a guest can reach before logging in. The login page itself must be in it. So must anything the login page depends on, such as fonts, images or, if you sell plans, the payment gateway’s pages. If something is missing from the walled garden, the login page loads half-broken or a payment fails.

RADIUS is the standard protocol most gateways use to ask “should this user be allowed on?” The router sends the username or code; the RADIUS server replies with accept or reject, plus attributes such as session time, data quota and speed.

Accounting is the other half of RADIUS. While a session runs, the router reports how long the device has been online and how much data it has used. That is how data plans are enforced and how usage reports are built. A related feature, Change of Authorization (CoA), lets the server tell the router to disconnect a user or change their session without waiting for it to end.

The right login method depends on who your users are and what you need to know about them. Most venues use one or two of these:

• Mobile OTP: the guest enters a phone number and receives a one-time password. It ties each session to a verified number and is the most common method in India.
• Voucher code: staff hand out a printed or digital code with a fixed time or data allowance. Useful at hotel front desks, events and cafés that include Wi-Fi with a purchase.
• Membership login: an ID and password for regular users, such as students, library members, employees or residents.
• Free access with limits: a set amount of time or data per day under a fair-use policy, often combined with OTP so you still know who is online.
• Paid plans: the guest picks a plan on the portal and pays online, then gets logged in.

Open Wi-Fi with a shared password is easy to set up, but it gives the owner no control and no record of who used the connection. A captive portal changes that.

Accountability is the first reason. With OTP login, each session is linked to a verified mobile number, a device and a time. Many operators need records like these, and the rules on what to keep and for how long depend on your situation. Check the licensing and log-retention requirements that apply to you with your ISP or a qualified advisor.

Control is the second. You can limit each user’s speed, cap daily data, restrict the number of devices per person and cut off a misbehaving user. One heavy downloader no longer slows the whole hotel.

Revenue and marketing are the third. The portal can sell Wi-Fi plans, show the venue’s offers and carry advertisements. A hotel can promote its restaurant; a café can show a daily special. Returning guests can be reached later with messages, if they have agreed to it.

Captive portal software ranges from the basic page built into a router to a full cloud platform. Before choosing, check these points:

• Router support: does it work with the gateways you already own, and how is the router configured? Manual setup is where most problems start.
• Login methods: can you choose different methods for different networks, such as OTP for guests and membership for staff?
• OTP delivery: SMS delivery in India can be slow on some routes. A fallback channel matters.
• Payments: if you want to sell plans, can guests pay with UPI, and does the money go to your own payment gateway account?
• Branding: can you design the page without code, and does it look right on a small phone screen?
• Limits: time, data, speed and device limits per plan, enforced at the router.
• Reports and records: live sessions, usage, revenue and exports you can hand to an accountant or auditor.
• Multiple venues: if you are an ISP or integrator, can you manage many sites, each with its own login and staff?

Most captive portal complaints come from a handful of setup problems. The login page does not pop up because the phone’s connectivity check is blocked or answered wrongly. The page loads without images because a resource is missing from the walled garden. OTPs arrive late and guests give up. Guests are logged out every few minutes because the session or idle timeout is too short.

Another frequent issue is that phones now use randomised MAC addresses per network. A guest who “forgets” the network and reconnects may appear as a new device. Keep device limits realistic.

OKWiFi is a cloud platform for hotspots and captive portals. It works with MikroTik routers today; support for other RADIUS-capable gateways is planned. The console generates the RouterOS script that sets up the hotspot, RADIUS authentication and accounting, CoA disconnect, the walled garden and a heartbeat so you can see whether each router is online.

One router can run several captive portals. Each network, whether a separate SSID or a VLAN, points to its own portal profile with its own login methods, plans and branding. Login methods include mobile OTP (sent over WhatsApp first, with SMS as fallback), membership login, vouchers and free access with daily limits. Pages are built in the portal studio with drag-and-drop blocks, and guests can buy plans and pay by UPI, card or net banking through your own payment gateway.