Captive portals: what they do, and when you actually need one

If you have joined the WiFi at a hotel, a café or a conference and been shown a page asking you to accept terms or enter a code before anything else worked, you have met a captive portal. It sits between a device joining the network and that device reaching the internet, and it holds traffic until whatever condition it has been set has been met.

The obvious reason to run one is control over who is using the connection. On a guest network without a portal, anyone in range with the password is on, and the password spreads well beyond the people it was meant for. A portal lets access be granted per person and per session, and withdrawn without changing anything for everyone else.

The less obvious reason, and often the more valuable one, is that a portal gives you a boundary to enforce policy at. Session time limits, bandwidth caps per device, and separation of guest traffic from business systems all become straightforward once there is a gate. Without one, a single guest device downloading heavily is competing directly with the systems the business runs on.

Where portals go wrong is usually in the detail of how devices behave. Phones expect the portal to appear promptly and will silently give up on a network that does not answer, which is why a badly configured portal produces the complaint that the WiFi "does not work" rather than that the login failed. Reconnection matters too: a portal that demands a fresh login every time a phone wakes up is one guests quickly stop using.

There is also a data question worth deciding deliberately. A portal that collects email addresses or phone numbers is collecting personal data, and that carries obligations about what you tell people, what you do with it, and how long you keep it. Collecting nothing but acceptance of terms is a perfectly legitimate configuration, and for many venues it is the right one.

The honest answer to whether you need a portal is that it depends on whether guest access is a problem you currently have. A small office where everyone is known does not need one. A venue with public traffic, or any site where guest devices and business systems currently share a network, benefits from one quickly.