Wifi Captive Portal Authentication — Complete Documentation & Simulation

Overview & System Context

Wifi Captive Portal Authentication: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9535 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background A captive portal is a web page accessed with a web browser that is displayed to newly connected users of a Wi-Fi or wired network before they are granted broader access to network resources. Captive portals are commonly used to present a landing or log-in page which may require authentication, payment, acceptance of an end-user license agreement/acceptable use policy, or survey completion. Captive portals are used for a broad range of mobile and pedestrian broadband services – including cable and both commercially provided Wi-Fi and home hotspots. A captive portal can also be used to provide access to enterprise or residential wired networks, such as apartment houses, hotel rooms, and business centers. The captive portal is presented to the client and is stored either at the gateway or on a web server hosting the web page. Depending on the feature set of the gateway, websites or TCP ports can be allow-listed so that the user would not have to interact with the captive portal in order to use them. The MAC address of attached clients can also be used to bypass the login process for specified devices. WISPr refers to this web-browser–based authentication method as the Universal Access Method (UAM).

Wi-Fi () is a family of wireless network protocols based on the IEEE 802.11 family of standards, which are commonly used for local area networking of devices and Internet access, allowing nearby digital devices to exchange data by radio waves. These are the most widely used computer networks, used globally in home and small office networks to link devices and to provide Internet access with wireless routers and wireless access points in public places such as coffee shops, restaurants, hotels, libraries, and airports. Wi-Fi is a trademark of the Wi-Fi Alliance, which restricts the use of the term "Wi-Fi Certified" to products that successfully complete interoperability certification testing. Non-compliant hardware is simply referred to as WLAN, and it may or may not work with "Wi-Fi Certified" devices. As of 2017, the Wi-Fi Alliance consisted of more than 800 companies from around the world. As of 2019, over 3.05 billion Wi-Fi-enabled devices are shipped globally each year. Wi-Fi uses multiple parts of the IEEE 802 protocol family and is designed to work well with its wired sibling, Ethernet. Compatible devices can network through wireless access points with each other as well as with wired devices and the Internet. Different versions of Wi-Fi are specified by various IEEE 802.11 protocol standards, with different radio technologies determining radio bands, maximum ranges, and speeds that may be achieved. Wi-Fi most commonly uses the 2.4 gigahertz (120 mm) UHF and 5 gigahertz (60 mm) SHF radio bands, with the 6 gigahertz SHF band used in newer generations of the standard; these bands are subdivided into multiple channels. Channels can be shared between networks, but, within range, only one transmitter can transmit on a channel at a time.

Wi-Fi's radio bands work best for line-of-sight use. Common obstructions, such as walls, pillars, home appliances, etc., may greatly reduce range, but this also helps minimize interference between different networks in crowded environments. The range of an access point is about 20 m (66 ft) indoors, while some access points claim up to a 150 m (490 ft) range outdoors. Hotspot coverage can be as small as a single room with walls that block radio waves or as large as many square kilometers using multiple overlapping access points with roaming permitted between them. Over time, the speed and spectral efficiency of Wi-Fi has increased. As of 2025, some versions of Wi-Fi, running on suitable hardware at close range, can achieve speeds of 23 Gbit/s (gigabit per second).

A 1985 ruling by the U.S. Federal Communications Commission released parts of the ISM bands for unlicensed use for communications in the United States. These frequency bands include the same 2.4 GHz bands used by equipment such as microwave ovens, and are thus subject to interference. In 1989 in Australia, a team of scientists began working on wireless LAN technology. A prototype test bed for a wireless local area network (WLAN) was developed in 1992 by a team of researchers from the Radiophysics Division of the CSIRO (Commonwealth Scientific and Industrial Research Organisation) in Australia, led by John O'Sullivan. A patent for Wi-Fi was lodged by the CSIRO in 1992. In 1991 in the city of Nieuwegein in the Netherlands, the NCR Corporation and AT&T invented the precursor to 802.11, intended for use in cashier systems, under the name WaveLAN. NCR's Vic Hayes, who held the chair of IEEE 802.11 for ten years, along with Bell Labs engineer Bruce Tuch, approached the Institute of Electrical and Electronics Engineers (IEEE) to create a standard and were involved in designing the initial 802.11b and 802.11a specifications within the IEEE. They have both been subsequently inducted into the Wi-Fi NOW Hall of Fame. The first version of the 802.11 protocol was released in 1997, and provided up to 2 Mbit/s link speeds. This was updated in 1999 with 802.11b to permit 11 Mbit/s link speeds. In 1999, the Wi-Fi Alliance formed as a trade association to hold the Wi-Fi trademark under which most IEEE 802.11 products are sold.

Figure 1: Best Captive Portal Software for Business: Complete Guide and ... The major commercial breakthrough came with Apple Inc. adopting Wi-Fi for their iBook series of laptops in 1999. It was the first mass consumer product to offer Wi-Fi network connectivity, which was then branded by Apple as AirPort. This was in collaboration with the same group that helped create the standard: Vic Hayes, Bruce Tuch, Cees Links, Rich McGinn, and others from Lucent. In 2000, Radiata, a group of Australian scientists connected to the CSIRO, were the first to use the 802.11a standard on chips connected to a Wi-Fi network. Wi-Fi uses a large number of patents held by multiple different organizations. Australia, the United States and the Netherlands simultaneously claim the invention of Wi-Fi, and a consensus has not been reached globally. In 2009, the Australian CSIRO was awarded $200 million after a patent settlement with 14 technology companies, with a further $220 million awarded in 2012 after legal proceedings with 23 companies. In 2016, the CSIRO's WLAN prototype test bed was chosen as Australia's contribution to the exhibition A History of the World in 100 Objects held in the National Museum of Australia.

The IEEE does not test equipment for compliance with their standards. The Wi-Fi Alliance was formed in 1999 to establish and enforce standards for interoperability and backward compatibility, and to promote wireless local-area-network technology. The Wi-Fi Alliance enforces the use of the Wi-Fi brand to technologies based on the IEEE 802.11 standards from the IEEE. Manufacturers with membership in the Wi-Fi Alliance, whose products pass the certification process, gain the right to mark those products with the Wi-Fi logo. Specifically, the certification process requires conformance to the IEEE 802.11 radio standards, the WPA and WPA2 security standards, and the EAP authentication standard. Certification may optionally include tests of IEEE 802.11 draft standards, interaction with cellular-phone technology in converged devices, and features relating to security set-up, multimedia, and power-saving. Not every Wi-Fi device is submitted for certification. The lack of Wi-Fi certification does not necessarily imply that a device is incompatible with other Wi-Fi devices. The Wi-Fi Alliance may or may not sanction derivative terms, such as Super Wi-Fi, coined by the US Federal Communications Commission (FCC) to describe proposed networking in the UHF TV band in the US.

Equipment frequently supports multiple versions of Wi-Fi. To communicate, devices must use a common Wi-Fi version. The versions differ between the radio wavebands they operate on, the radio bandwidth they occupy, the maximum data rates they can support and other details. Some versions permit the use of multiple antennas, which permits greater speeds as well as reduced interference. Historically, the equipment listed the versions of Wi-Fi supported using the name of the IEEE standards.

In 2018, the Wi-Fi Alliance introduced simplified Wi-Fi generational numbering to indicate equipment that supports Wi-Fi 4 (802.11n), Wi-Fi 5 (802.11ac) and Wi-Fi 6 (802.11ax). These generations have a high degree of backward compatibility with previous versions. The alliance has stated that the generational level 4, 5, or 6 can be indicated in the user interface when connected, along with the signal strength. The most important standards affecting WiIFi are: 802.11a, 802.11b, 802.11g, 802.11n (Wi-Fi 4), 802.11h, 802.11i, 802.11-2007, 802.11–2012, 802.11ac (Wi-Fi 5), 802.11ad, 802.11af, 802.11-2016, 802.11ah, 802.11ai, 802.11aj, 802.11aq, 802.11ax (Wi-Fi 6), 802.11ay.

Wi-Fi technology may be used to provide local network and Internet access to devices that are within Wi-Fi range of one or more routers that are connected to the Internet. The coverage of one or more interconnected access points can extend from an area as small as a few rooms to as large as many square kilometres. Coverage in the larger area may require a group of access points with overlapping coverage. For example, public outdoor Wi-Fi technology has been used successfully in wireless mesh networks in London. An international example is Fon. Wi-Fi provides services in private homes, businesses, as well as in public spaces. Wi-Fi hotspots may be set up either free of charge or commercially, often using a captive portal webpage for access. Organizations, enthusiasts, authorities and businesses, such as airports, hotels, and restaurants, often provide free or paid-use hotspots to attract customers, to provide services to promote business in selected areas. Routers often incorporate a digital subscriber line modem or a cable modem and a Wi-Fi access point, are frequently set up in homes and other buildings, to provide Internet access for the structure. Similarly, battery-powered routers may include a mobile broadband modem and a Wi-Fi access point. When subscribed to a cellular data carrier, they allow nearby Wi-Fi stations to access the Internet. A number of smartphones have a built-in mobile hotspot capability of this sort, though carriers often disable the feature, or charge a separate fee to enable it. Standalone devices such as MiFi- and WiBro-branded devices provide the capability. Some laptops that have a cellular modem card can also act as mobile Internet Wi-Fi access points.

Multiple traditional university campuses in the developed world provide at least partial Wi-Fi coverage. Carnegie Mellon University built the first campus-wide wireless Internet network, called Wireless Andrew, at its Pittsburgh campus in 1993 before Wi-Fi branding existed. A number of universities collaborate in providing Wi-Fi access to students and staff through the Eduroam international authentication infrastructure.

Figure 2: Setup Captive Portal and Voucher Authentication in TP-Link Omada : The ... In the early 2000s, multiple cities around the world announced plans to construct citywide Wi-Fi networks. There are a number of successful examples; in 2004, Mysore (Mysuru) became India's first Wi-Fi-enabled city. A company called WiFiyNet has set up hotspots in Mysore, covering the whole city and a few nearby villages. In 2005, St. Cloud, Florida and Sunnyvale, California, became the first cities in the United States to offer citywide free Wi-Fi (from MetroFi). Minneapolis has generated $1.2 million in profit annually for its provider. In May 2010, the then London mayor Boris Johnson pledged to have London-wide Wi-Fi by 2012. Several boroughs including Westminster and Islington already had extensive outdoor Wi-Fi coverage at that point. New York City announced a city-wide campaign to convert old phone booths into digital kiosks in 2014.

The project, titled LinkNYC, has created a network of kiosks that serve as public Wi-Fi hotspots, high-definition screens and landlines. Installation of the screens began in late 2015. The city government plans to implement more than seven thousand kiosks over time, eventually making LinkNYC the largest and fastest public, government-operated Wi-Fi network in the world. The UK has planned a similar project across major cities of the country, with the project's first implementation in the London Borough of Camden. Officials in South Korea's capital Seoul were moving to provide free Internet access at more than 10,000 locations around the city, including outdoor public spaces, major streets, and densely populated residential areas. Seoul was planning to grant leases to KT, LG Telecom, and SK Telecom. The companies were supposed to invest $44 million in the project, which was to be completed in 2015.

The 802.11 standard provides several distinct radio frequency ranges for use in Wi-Fi communications: 900 MHz, 2.4 GHz, 3.6 GHz, 4.9 GHz, 5 GHz, 6 GHz and 60 GHz bands. Each range is divided into a multitude of channels. In the standards, channels are numbered at 5 MHz spacing within a band (except in the 60 GHz band, where they are 2.16 GHz apart), and the number refers to the centre frequency of the channel. Although channels are numbered at 5 MHz spacing, transmitters generally occupy at least 20 MHz, and standards allow for neighbouring channels to be bonded together to form a wider channel for higher throughput. Countries apply their own regulations to the allowable channels, allowed users and maximum power levels within these frequency ranges. 802.11b/g/n can use the 2.4 GHz band, operating in the United States under FCC Part 15 rules and regulations. In this frequency band, equipment may occasionally suffer interference from microwave ovens, cordless telephones, USB 3.0 hubs, Bluetooth and other devices. Spectrum assignments and operational limitations are not consistent worldwide: Australia and Europe allow for an additional two channels (12, 13) beyond the 11 permitted in the United States for the 2.4 GHz band, while Japan has three more (12–14). 802.11a/h/j/n/ac/ax can use the 5 GHz U-NII band, which, for much of the world, offers at least 23 non-overlapping 20 MHz channels. This is in contrast to the 2.4 GHz frequency band where the channels are only 5 MHz wide. In general, lower frequencies have longer range but have less capacity. The 5 GHz bands are absorbed to a greater degree by common building materials than the 2.4 GHz bands and usually give a shorter range. As 802.11 specifications evolved to support higher throughput, the protocols have become much more efficient in their bandwidth use. Additionally, they have gained the ability to aggregate channels together to gain still more throughput where the bandwidth for additional channels is available. 802.11n allows for double radio spectrum bandwidth (40 MHz) per channel compared to 802.11a or 802.11g (20 MHz). 802.11n can be set to limit itself to 20 MHz bandwidth to prevent interference in dense communities. In the 5 GHz band, 20 MHz, 40 MHz, 80 MHz, and 160 MHz channels are permitted with some restrictions, giving much faster connections.

Wi-Fi is part of the IEEE 802 protocol family. The data is organized into 802.11 frames that are very similar to Ethernet frames at the data link layer, but with extra address fields. MAC addresses are used as network addresses for routing over the LAN. Wi-Fi's MAC and physical layer (PHY) specifications are defined by IEEE 802.11 for modulating and receiving one or more carrier waves to transmit the data in the infrared, and 2.4, 3.6, 5, 6, or 60 GHz frequency bands. They are created and maintained by the IEEE LAN/MAN Standards Committee (IEEE 802). The base version of the standard was released in 1997 and has had many subsequent amendments. The standard and amendments provide the basis for wireless network products using the Wi-Fi brand. While each amendment is officially revoked when incorporated in the latest version of the standard, the corporate world tends to market to the revisions because they concisely denote capabilities of their products. As a result, in the market place, each revision tends to become its own standard. In addition to 802.11, the IEEE 802 protocol family has specific provisions for Wi-Fi. These are required because Ethernet's cable-based media are not usually shared, whereas with wireless all transmissions are received by all stations within the range that employ that radio channel. While Ethernet has essentially negligible error rates, wireless communication media are subject to significant interference. Therefore, the accurate transmission is not guaranteed so delivery is, therefore, a best-effort delivery mechanism. Because of this, for Wi-Fi, the Logical Link Control (LLC) specified by IEEE 802.2 employs Wi-Fi's media access control (MAC) protocols to manage retries without relying on higher levels of the protocol stack. For internetworking purposes, Wi-Fi is usually layered as a link layer below the internet layer of the Internet Protocol. This means that nodes have an associated internet address and, with suitable connectivity, this allows full Internet access.

In infrastructure mode, which is the most common mode used, all communications go through a base station. For communications within the network, this introduces an extra use of the airwaves but has the advantage that any two stations that can communicate with the base station can also communicate through the base station, which limits issues associated with the hidden node problem and simplifies the protocols.

Figure 3: How to set up Cloudi-Fi Captive Portal in FortiOS – Cloudi-Fi Knowledge ... An Extended Service Set may be formed by deploying multiple access points that are configured with the same SSID and security settings. Wi-Fi client devices typically connect to the access point that can provide the strongest signal within that service set. Increasing the number of Wi-Fi access points for a network provides redundancy, better range, support for fast handover, and increased overall network capacity by using more channels or by defining smaller cells. Except for the smallest implementations (such as home or small office networks), Wi-Fi implementations have moved toward thin access points, with more of the network intelligence housed in a centralized network appliance, relegating individual access points to the role of dumb transceivers. Outdoor applications may use mesh topologies.

Wi-Fi operational range depends on factors such as the frequency band, modulation technique, transmitter power output, receiver sensitivity, antenna gain and type, and propagation and interference characteristics in the environment. At longer distances, speed is typically reduced. Wi-Fi 4 and higher standards allow devices to have multiple antennas on transmitters and receivers. Multiple antennas enable the equipment to exploit multipath propagation on the same frequency bands, giving higher speeds and more than doubled range. The Wi-Fi 5 standard uses the 5 GHz band exclusively, and is capable of multi-station WLAN throughput of at least 1 gigabit per second, and a single station throughput of at least 500 Mbit/s. This standard uses several signal processing techniques such as multi-user MIMO and 4 × 4 spatial multiplexing streams, and wide channel bandwidth (160 MHz) to achieve its gigabit throughput.

Wi-Fi connections can be blocked or the network throughput lowered by having other devices in the same area. Wi-Fi protocols are designed to share the radio bandwidth reasonably fairly. To minimize collisions with Wi-Fi and non-Wi-Fi devices, Wi-Fi employs Carrier-sense multiple access with collision avoidance (CSMA/CA), where transmitters listen before transmitting and delay transmission of packets if they detect that other devices are active on the channel, or if noise is detected from adjacent channels or non-Wi-Fi sources. Nevertheless, Wi-Fi networks are still susceptible to the hidden node and exposed node problems. A standard speed Wi-Fi signal occupies five channels in the 2.4 GHz band. Adjacent-channel interference can be caused by overlapping channels. Any two channel numbers that differ by five or more, such as 2 and 7, do not overlap. Channels 1, 6, and 11 are the only group of three non-overlapping channels in North America. However, whether the overlap is significant depends on physical spacing. Channels that differ by four interfere a negligible amount – much less than reusing channels (which causes co-channel interference) – if transmitters are at least a few metres apart. In Europe and Japan where channel 13 is available, using Channels 1, 5, 9, and 13 for 802.11g and 802.11n is viable and recommended.

However, multiple 2.4 GHz 802.11b and 802.11g access points default to the same channel on initial startup, contributing to congestion on certain channels. Wi-Fi pollution, or an excessive number of access points in the area, can prevent access and interfere with other devices' use of other access points, as well as decreasing overall signal-to-noise ratio (SNR). These issues can become a problem in high-density areas, such as large apartment complexes or office buildings with multiple Wi-Fi access points. It is also an issue when municipalities or other large entities (such as universities) seek to provide large area coverage. Other devices use the 2.4 GHz band: microwave ovens, ISM band devices, security cameras, Zigbee devices, Bluetooth devices, video senders, cordless phones, baby monitors, and, in some countries, amateur radio, all of which can cause significant additional interference. On some 5 GHz bands interference from radar systems can occur in some places.

Access points that support those bands employ dynamic frequency selection, which listens for radar, and if detected, will not permit transmission on that band. These bands can be used by low-power transmitters without a licence, and with few restrictions. However, while unintended interference is common, users who have been found to cause deliberate interference (particularly for attempting to locally monopolize these bands for commercial purposes) have been issued large fines.

A wireless access point (WAP) connects a group of wireless devices to an adjacent wired LAN. An access point functions as a network hub, relaying data between connected wireless devices in addition to a wired network, allowing wireless devices to communicate with other wired devices, typically also providing access to devices on the Internet. Wireless adapters allow devices to connect to a wireless network. These adapters connect to devices using various external or internal interconnects such as mini PCIe, USB, ExpressCard and earlier, PCI, Cardbus, and PC Card. Computers now routinely come equipped with built-in wireless adapters.

Wireless routers integrate a Wireless Access Point, Ethernet switch, and internal router firmware application that provides IP routing, NAT, and DNS forwarding through an integrated WAN-interface. A wireless router allows wired and wireless Ethernet LAN devices to connect to a (usually) single WAN device such as a cable modem, DSL modem, or optical modem. A wireless router allows all three devices, mainly the access point and router, to be configured through one central utility. This utility is usually an integrated web server that is accessible to wired and wireless LAN clients and often optionally to WAN clients. This utility may also be an application that is run on a computer, as is the case with as Apple's AirPort, which is managed with the AirPort Utility on macOS and iOS.

The security standard, Wi-Fi Protected Setup, allows embedded devices with a limited graphical user interface to connect to the Internet with ease. Wi-Fi Protected Setup has 2 configurations: The Push Button configuration and the PIN configuration. These embedded devices are also called The Internet of things and are low-power, battery-operated embedded systems. Several Wi-Fi manufacturers design chips and modules for embedded Wi-Fi, such as GainSpan. Increasingly in the last few years (particularly as of 2007), embedded Wi-Fi modules have become available that incorporate a real-time operating system and provide a simple means of wirelessly enabling any device that can communicate via a serial port. This allows the design of simple monitoring devices. An example is a portable ECG device monitoring a patient at home. This Wi-Fi-enabled device can communicate via the Internet. These Wi-Fi modules are designed by OEMs so that implementers need only minimal Wi-Fi knowledge to provide Wi-Fi connectivity for their products. In June 2014, Texas Instruments introduced the first ARM Cortex-M4 microcontroller with an onboard dedicated Wi-Fi MCU, the SimpleLink CC3200. It makes embedded systems with Wi-Fi connectivity possible to build as single-chip devices, which reduces their cost and minimum size, making it more practical to build wireless-networked controllers into inexpensive ordinary objects.

The main issue with wireless network security is its simplified access to the network compared to traditional wired networks such as Ethernet. With wired networking, one must either gain access to a building (physically connecting into the internal network), or break through an external firewall. To access Wi-Fi, one must merely be within the range of the Wi-Fi network. Most business networks protect sensitive data and systems by attempting to disallow external access. Enabling wireless connectivity reduces security if the network uses inadequate or no encryption. An attacker who has gained access to a Wi-Fi network router can initiate a DNS spoofing attack against any other user of the network by forging a response before the queried DNS server has a chance to reply.

A flaw in a feature added to Wi-Fi in 2007, called Wi-Fi Protected Setup (WPS), let WPA and WPA2 security be bypassed. The only remedy as of 2011 was to turn off Wi-Fi Protected Setup, which is not always possible. Virtual private networks can be used to improve the confidentiality of data carried through Wi-Fi networks, especially public Wi-Fi networks. A URI using the Wi-Fi scheme can specify the SSID, encryption type, password/passphrase, and if the SSID is hidden or not, so users can follow links from QR codes, for instance, to join networks without having to manually enter the data. A MeCard-like format is supported by Android and iOS 11+.

Common format: WIFI:S:;T:;P:;H:; Sample WIFI:S:MySSID;T:WPA;P:MyPassW0rd;; Piggybacking refers to access to a wireless Internet connection by bringing one's computer within the range of another's wireless connection, and using that service without the subscriber's explicit permission or knowledge. During the early popular adoption of 802.11, providing open access points for anyone within range to use was encouraged to cultivate wireless community networks, particularly since people on average use only a fraction of their downstream bandwidth at any given time. Recreational logging and mapping of other people's access points have become known as wardriving. Indeed, many access points are intentionally installed without security turned on so that they can be used as a free service. Providing access to one's Internet connection in this fashion may breach the Terms of Service or contract with the Internet service provider (ISP). These activities do not result in sanctions in most jurisdictions; however, legislation and case law differ considerably across the world. A proposal to leave graffiti describing available services was called warchalking. Piggybacking often occurs unintentionally – a technically unfamiliar user might not change the default unsecured settings to their access point and operating systems can be configured to connect automatically to any available wireless network. A user who happens to start up a laptop in the vicinity of an access point may find the computer has joined the network without any visible indication. Moreover, a user intending to join one network may instead end up on another one if the latter has a stronger signal. In combination with automatic discovery of other network resources (see DHCP and Zeroconf) this could lead wireless users to send sensitive data to the wrong middle-man when seeking a destination (see man-in-the-middle attack). For example, a user could inadvertently use an unsecured network to log into a website, thereby making the login credentials available to anyone listening, if the website uses an insecure protocol such as plain HTTP without TLS. On an unsecured access point, an unauthorized user can obtain security information (factory preset passphrase or Wi-Fi Protected Setup PIN) from a label on a wireless access point and use this information (or connect by the Wi-Fi Protected Setup pushbutton method) to commit unauthorized or unlawful activities.

Wireless Internet access has become much more embedded in society. It has thus changed how the society functions in a number of ways. As of 2017 over half the world did not have access to the Internet, prominently rural areas in developing nations. Technology that has been implemented in more developed nations is often costly and energy inefficient. This has led to developing nations using more low-tech networks, frequently implementing renewable power sources that can solely be maintained through solar power, creating a network that is resistant to disruptions such as power outages. For instance, in 2007, a 450-kilometre (280 mi) network between Cabo Pantoja and Iquitos in Peru was erected in which all equipment is powered only by solar panels. These long-range Wi-Fi networks have two main uses: offer Internet access to populations in isolated villages, and to provide healthcare to isolated communities. In the case of the latter example, it connects the central hospital in Iquitos to 15 medical outposts which are intended for remote diagnosis.

The World Health Organization (WHO) says, "no health effects are expected from exposure to RF fields from base stations and wireless networks", but notes that they promote research into effects from other RF sources. Although the WHO's International Agency for Research on Cancer (IARC) later classified radio-frequency electromagnetic fields (EMFs) as "possibly carcinogenic to humans (Group 2B)" (a category used when "a causal association is considered credible, but when chance, bias or confounding cannot be ruled out with reasonable confidence"), this classification was based on risks associated with wireless phone use rather than Wi-Fi networks. The United Kingdom's Health Protection Agency reported in 2007 that exposure to Wi-Fi for a year results in the "same amount of radiation from a 20-minute mobile phone call". A review of studies involving 725 people who claimed electromagnetic hypersensitivity, "...suggests that 'electromagnetic hypersensitivity' is unrelated to the presence of an EMF, although more research into this phenomenon is required." 2. System Architecture & Core Working Principles Bluetooth Low Energy, a low-power variant of Bluetooth Bluetooth, a short-distance network Cellular networks, used by smartphones LoRa, for long-range wireless with low data rate NearLink, a short-range wireless technology standard WiMAX, for providing long-range wireless internet connectivity Zigbee, a low-power, low data rate, short-distance communication protocol Several wired technologies for computer networking, which provide viable alternatives to Wi-Fi: WiFiDog was an open source embeddable captive portal solution used to build wireless hotspots. It is no longer an active project after not being updated for several years. WiFiDog consists of two components: the gateway and the authentication server. It was written by the technical team of Île Sans Fil and is included in the software package repository of OpenWrt.

Learn how captive portals work, how OTP WiFi login is implemented, and how businesses, hotels, hostels, ISPs and public WiFi providers use captive portals for secure internet access. Captive portals help collect user information, display terms of service, perform OTP verification and manage internet access securely.

I User Device ↓ I WiFi Access Point ↓ I Captive Portal Page ↓ II Authentication Server ↓ I Internet Access Technofi provides enterprise-grade captive portal software for ISPs, hostels, libraries, hotels and public WiFi operators. Deploy OTP authentication, RADIUS integration, PM-WANI compliance and advanced user analytics from a single platform. This authoritative guide details the architecture, implementation, and optimisation of WiFi guest portals. It provides actionable strategies for IT leaders to increase login completion rates, ensure GDPR compliance, and capture high-quality first-party data.

Model enterprise hardware redirection policies, calculate DHCP scope sizing across guest concurrency peaks, whitelist walled garden FQDNs for social authentication, and generate vendor CLI deployment templates. Our senior wireless solutions architects will review your network topology, configure your RADIUS AAA endpoints, set up walled gardens, and integrate captive portal leads directly into your CRM.

Speak with a Purple WiFi network specialist to review your controller configuration, validate RADIUS AAA endpoints, and unlock verified visitor analytics for your venues. The WiFi guest portal - frequently referred to as a captive portal or splash page - is the critical intersection between network access control , user experience, and enterprise data strategy. For IT managers, network architects, and venue operations directors, deploying a guest portal is no longer simply about providing internet access. It is about architecting a secure, compliant gateway that captures high-quality first-party data while minimising user friction.

This guide provides a comprehensive technical reference on what a guest portal is, how the underlying authentication protocols function, and the precise levers available to optimise the login journey. Whether you are deploying across a retail chain, a stadium, or a global hospitality brand, the principles remain consistent: secure the network, reduce form fatigue, and integrate the captured data into downstream business systems. By moving beyond basic click-through access, organisations can transform their Guest WiFi infrastructure from a cost centre into a measurable driver of customer engagement and revenue.

Understanding the mechanics of a guest WiFi portal requires examining the sequence of events that occur from the moment a device associates with an SSID to the point full internet access is granted. This process relies on a combination of network protocols and web redirection mechanisms. When a client device connects to the guest network, it first negotiates an IP address, subnet mask, and default gateway via DHCP . At this stage, the device is placed in a " walled garden " state by the access controller. The walled garden is a restricted network environment where all outbound HTTP and HTTPS traffic is intercepted. The controller permits access only to explicitly whitelisted domains - such as the portal's hosting servers, authentication providers, and necessary CDN resources.

Upon the user opening a browser or the device's native Captive Network Assistant (CNA) detecting the walled garden, the controller issues an HTTP 302 redirect. This redirect points the client to the splash page URL. This interception is governed by the Wireless Internet Service Provider roaming (WISPr) protocol or the Universal Access Method (UAM). Once the user successfully authenticates, the portal communicates with the access controller, typically via RADIUS (Remote Authentication Dial-In User Service) or a proprietary API. The controller then updates its NAT policies or firewall rules, transitioning the client's MAC address from the walled garden to an authorised state, granting full internet access.

Our team works with venue operators, IT managers, and network engineers across 80,000 venues. Book a 20-minute call and we will show you how others like you solved it. Deploying a robust guest portal requires a systematic approach that prioritises security, user experience, and data integration. The following steps outline a vendor-neutral deployment methodology.

First, establish network segmentation. The guest SSID must be isolated from the corporate network using dedicated VLANs. This prevents guest devices from accessing internal resources, point-of-sale systems, or management interfaces. Implement client isolation within the guest VLAN to prevent devices from communicating with one another, mitigating the risk of lateral movement by malicious actors.

Second, configure the walled garden precisely. The most common cause of portal failure is an incomplete walled garden whitelist . Ensure that all resources required to render the splash page - including CSS files, fonts, and authentication provider endpoints (e.g., accounts.google.com ) - are accessible before authentication. Failure to do so will result in broken page rendering or failed social logins.

Third, design the data model and authentication flow. Determine the minimum viable data required from the user. For most commercial deployments, an email address and explicit marketing consent are sufficient for the initial login. Implement social login options to reduce friction and improve data accuracy. When integrating with WiFi Analytics platforms, ensure that the data model aligns with your CRM's schema.

Fourth, integrate downstream systems. The value of a guest portal is fully realised when the captured data flows seamlessly into marketing automation platforms or CRM systems. Configure webhooks or API integrations to transfer profile data in real-time, enabling automated post-login engagement, such as welcome emails or loyalty programme invitations. Optimising the guest portal experience is an ongoing process. Industry-standard best practices dictate a focus on speed, mobile responsiveness, and progressive profiling.

1. Mobile-First Design The vast majority of guest portal interactions occur on mobile devices. Ensure the splash page is fully responsive, with touch targets sized appropriately (minimum 44x44 pixels) and form fields that trigger the correct virtual keyboard (e.g., the email keyboard for email fields). 2. Progressive Profiling Avoid form fatigue by collecting only essential data during the first connection. On subsequent visits, use MAC address recognition or persistent session tokens to identify returning users and prompt them for additional information, such as date of birth or preferences. This approach significantly increases the overall completion rate.

3. Clear Value Exchange The copy on the splash page must clearly articulate the benefit to the user. Replace generic phrasing like "Register to access the network" with compelling value propositions such as "Enjoy high-speed WiFi - connect in seconds." 3. Software Implementation, Frameworks & Protocols Even well-architected deployments can encounter issues. Understanding common failure modes is essential for maintaining uptime and user satisfaction.

Captive Network Assistant (CNA) Failures Modern operating systems use CNAs to detect captive portals automatically. If the access controller does not respond correctly to the OS's initial probe (e.g., Apple's captive.apple.com ), the CNA may fail to launch, leaving the user confused. Ensure controller firmware is up-to-date and correctly handles these probes. Session Timeout Misconfiguration Setting the session timeout too short forces users to re-authenticate frequently, degrading the experience. Conversely, setting it too long can inflate concurrent user metrics and exhaust IP address pools. A typical commercial venue should configure a session timeout of 8 to 24 hours, with returning users seamlessly authenticated via MAC caching.

The ultimate measure of a guest portal's success is its contribution to business objectives. By transitioning from a simple access mechanism to an intelligent data capture platform, organisations can drive measurable ROI. In Retail environments, capturing email addresses allows for targeted re-marketing campaigns, driving footfall and increasing customer lifetime value. In Hospitality , integrating the portal with property management systems enables personalised guest experiences and automated TripAdvisor review requests.

The impact is quantified through metrics such as the Login Completion Rate (the percentage of users who see the portal and successfully authenticate), the Opt-In Rate (the percentage of users granting marketing consent), and the Data Quality Score (the percentage of valid, deliverable email addresses). Platforms like Purple provide the necessary analytics to track these KPIs, demonstrating the tangible value of the WiFi infrastructure.

A web page that the user of a public-access network is obliged to view and interact with before access is granted. A restricted network environment that allows access only to explicitly permitted IP addresses or domains prior to authentication. Critical for allowing the splash page and authentication providers to load before the user has full internet access.

Wireless Internet Service Provider roaming. A protocol that allows users to roam between different wireless providers. Remote Authentication Dial-In User Service. A networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management. The backend system that verifies credentials and tells the controller to grant access.

The process of storing a device's Media Access Control address after initial authentication to automatically recognize and authorize it on subsequent visits. Essential for providing a seamless experience for returning visitors without requiring re-login. A method of gradually gathering information about a user across multiple interactions rather than asking for all data upfront.

Used to balance the need for detailed marketing data with the necessity of high login completion rates. A feature in modern operating systems (like iOS and Android) that automatically detects a captive portal and opens a pseudo-browser for login. IT teams must ensure their controllers respond correctly to CNA probes to trigger the automatic popup.

The practice of dividing a physical network into multiple logical networks. Guest traffic is placed on a separate VLAN from corporate traffic. A non-negotiable security requirement to protect internal enterprise systems from guest devices. A 200-room hotel is experiencing a 60% drop-off rate on their guest WiFi portal. The current portal requires guests to input their First Name, Last Name, Room Number, Email Address, and Date of Birth on a single screen before granting access.

How should the IT Director redesign this flow to improve completion rates? The IT Director should implement a progressive profiling strategy. The initial login screen should be reduced to two options: 'Connect with Google/Apple' (Social Login) or a simple form requiring only 'Email Address' and an unchecked GDPR consent box. The Room Number requirement should be removed unless PMS integration is actively used for tiered bandwidth billing.

The Date of Birth field should be moved to a post-login email campaign ('Tell us your birthday for a free drink at the bar'). Finally, MAC address caching should be enabled so returning guests bypass the form entirely for the duration of their stay. A large stadium IT team is deploying a new guest portal for 50,000 concurrent users. During testing, users report that the splash page takes over 8 seconds to load, and many abandon the process. The portal features a 3MB high-resolution background image and loads three external tracking scripts. What immediate technical remediations are required? The IT team must immediately optimize the portal payload. First, the 3MB background image must be compressed and resized, ideally replaced with a CSS-based gradient or an optimized WebP image under 200KB. Second, all non-essential third-party tracking scripts must be removed from the critical rendering path; only essential scripts should load asynchronously. Third, the team must verify the Walled Garden configuration on the access controllers to ensure the CDN hosting the portal assets is explicitly whitelisted, preventing the controller from throttling or blocking the asset delivery.

Q 1 . You are designing the portal for a busy transport hub. The marketing team wants to collect Name, Email, Phone Number, and Destination. The network team is concerned about throughput and user complaints. What is the optimal approach? Hint: Consider the impact of form length on completion rates and the principle of progressive profiling.

Push back on the marketing team's request for all four fields upfront. Implement a portal requiring only Email Address and marketing consent, or offer Social Login. Use post-login email automation to ask for the Destination data once the user is connected and settled. This satisfies marketing's need for data over time while addressing the network team's concern about immediate throughput and user friction.

4. Practical Deployment, Analysis & Case Studies Q 2 . After deploying a new guest portal, users report that the splash page appears, but when they click 'Login with Facebook', the page times out and fails to authenticate. What is the most likely technical cause? Hint: Think about the network state the device is in before authentication is complete.

The Walled Garden whitelist is incomplete. The access controller is blocking the device from reaching Facebook's OAuth servers (e.g., graph.facebook.com ) because the device is not yet authenticated. The IT team must add the necessary Facebook domains to the Walled Garden whitelist so the authentication handshake can complete. Q 3 . Your organisation is updating its guest WiFi to comply with GDPR. The current portal has a single checkbox that says 'I agree to the Terms of Service and to receive marketing emails'. Why is this problematic, and how must it be fixed? This is non-compliant because it relies on 'bundled consent'. Under GDPR, consent for marketing must be freely given, specific, informed, and unambiguous. You cannot make access to the service (WiFi) conditional on accepting marketing. The fix is to separate this into two actions: a mandatory acceptance of the Terms of Service, and an optional, unticked checkbox for marketing consent.

A guest WiFi captive portal is a network access control mechanism that intercepts initial HTTP web requests or triggers the operating system Captive Network Assistant (CNA) before granting internet connectivity. When a visitor connects to the guest SSID, the wireless access point or controller intercepts traffic using DNS spoofing, HTTP 302 redirects, or the RFC 8908 Capport API, directing the client to an authentication splash page. Once the visitor completes authentication (such as email registration, social login, or terms acceptance), the captive portal server signals the wireless controller or RADIUS server via RFC 3576 Dynamic Authorization (CoA) to unblock internet access.

Captive portal login failures are primarily caused by DNS resolution failures, aggressive SSL interception, or incomplete walled gardens. To ensure reliable CNA popups, configure your wireless controller to allow unauthenticated access to operating system probe domains, including captive.apple.com, connectivitycheck.gstatic.com, and msftconnecttest.com. Additionally, avoid performing HTTPS interception on initial DNS lookups, ensure your external captive portal uses a valid, globally trusted TLS certificate, and support the RFC 8908 Captive Portal API to eliminate browser security warnings.

What is the difference between an external captive portal and an on-controller splash page? An on-controller splash page runs locally on the physical wireless LAN controller (WLC) or cloud access point, offering basic click-through terms with limited branding, minimal authentication methods, and no CRM data synchronization. An external captive portal (such as Purple) is hosted on a secure cloud platform that integrates via RADIUS AAA and REST APIs.

External portals support rich multi-language branding, social login, SMS verification, PMS integration, real-time marketing automation sync, and enterprise footfall analytics. How do guest WiFi captive portals integrate with CRM and marketing automation platforms? Modern external captive portals use real-time webhooks, Kafka streaming, and REST APIs to synchronize visitor data instantly with CRMs like HubSpot, Salesforce, Klaviyo, and customer data platforms (CDPs). When a guest verifies their identity on the splash portal, their profile, visit frequency, dwell time, and marketing consent status are pushed to the CRM, enabling automated welcome emails, loyalty rewards, and customer journey tracking.

This guide isolates a UniFi guest portal redirect failure by following the guest state, redirect, pre-authorization route and controller authorization in sequence. It gives venue IT teams a sourced method to address guest-network versus Hotspot confusion, external portal hand-offs, current UniFi OS account requirements and DNS isolation testing. This practical day-two guide isolates where a Cisco Meraki splash flow has failed: client authorization, HTTP redirect initiation, walled-garden reachability or RADIUS sign-on. It gives venue IT teams a controlled evidence path, so they can restore Guest WiFi without making broad changes to a live estate.

This technical guide shows IT teams how to set up Guest WiFi as a controlled internet-access service, using VLAN segmentation, firewall policy, and a captive portal. It also explains how Purple's registration forms and onboarding controls support a proportionate visitor experience without weakening the boundary around staff, payment, and operational systems. Our team works with venue operators, IT managers, and network engineers across 80,000 venues. Book a 20-minute call and we will show you how others like you solved it.

Captive portal software is a network access control tool that intercepts WiFi connections and presents users with a login or splash page before granting internet access. It is used for guest WiFi onboarding, collecting user data, displaying terms of service, and enforcing compliance. Businesses use captive portals to control who accesses their network and capture marketing consent.

Every business with a WiFi network faces the same question: what happens when someone connects? Without a captive portal, the answer is"nothing" - guests get access, you get nothing back. No data, no consent record, no way to know who's on your network. With the right captive portal software, that connection becomes a handshake: you provide internet access, and in return you capture contact information, collect marketing consent, enforce compliance, and control exactly who gets on your network and what they can do.

This guide covers two things. First, a straightforward comparison of the best captive portal software platforms available in 2026 - what each does well, where each falls short, and which is right for your business. Second, a practical step-by-step walkthrough of how to set up a guest WiFi portal from scratch, regardless of which platform you choose. A captive portal is the login page that appears when you connect to a WiFi network at a hotel, coffee shop, airport, or office.

Technically, it intercepts a device's first HTTP request and redirects it to a splash page where the user must take some action - agree to terms, enter an email, log in with social media - before gaining internet access. The underlying mechanism is defined in RFC 8952 (Captive Portal API) , which standardizes how networks signal to devices that they're behind a captive portal. In practice, captive portal software sits between the access point and the internet, managing the authentication flow, collecting user data, and enforcing access policies.

For businesses, captive portal software transforms guest WiFi from a cost center into a marketing channel and a compliance safeguard. The software runs either as a cloud service, an on-premises appliance, or integrated into your access point controller. The captive portal market serves very different use cases - a vacation rental host and a multi-site enterprise have almost nothing in common beyond needing a splash page. Here's how the major platforms compare across the criteria that actually matter.

IronWiFi combines captive portal functionality with enterprise-grade cloud RADIUS authentication, making it uniquely suited for organizations that need both guest WiFi management and employee network security under one platform. The captive portal supports social login, email/SMS capture, voucher codes, and click-through authentication, with a drag-and-drop splash page editor. Where IronWiFi stands apart is in its compliance posture (SOC 2, GDPR, HIPAA-ready) and its ability to handle WPA-Enterprise (802.1X) authentication on the same infrastructure - so you get guest portals and corporate network security from a single provider. Compatible with 200+ access point vendors across Cisco, Aruba, Meraki, UniFi, Ruckus, Cambium, and more.

StayFi is built specifically for the hospitality and vacation rental market. It replaces the default router captive portal with a branded splash page focused on capturing guest emails for post-stay marketing. StayFi's strength is its deep integration with property management tools and the simplicity of its hardware (a plug-and-play device). It's excellent for short-term rental operators who want to build a direct marketing list, but it's not designed for enterprise network security, multi-VLAN environments, or compliance-heavy industries.

Cloudi-Fi targets multi-site enterprises with advanced analytics and centralized management. It offers detailed visitor analytics, heatmaps, and integrations with enterprise marketing platforms. Cloudi-Fi works well for large organizations with many locations that need consistent branding and centralized reporting across all sites. Its analytics depth is a genuine differentiator, though it comes at a higher price point than most alternatives.

Purple specializes in visitor analytics for large venues - stadiums, shopping centers, airports, and conference facilities. Its captive portal feeds data into a robust analytics engine that tracks footfall patterns, dwell times, repeat visits, and visitor demographics. Purple is the right choice when analytics and venue intelligence are your primary goals. It's less focused on network security features and more oriented toward the marketing and operational intelligence side.

Spotipo focuses on small and medium businesses with an emphasis on broad router compatibility and affordable pricing. It supports social WiFi login, email capture, and basic marketing integrations. Spotipo works with a wide range of consumer and prosumer routers (OpenWrt, MikroTik, pfSense, DD-WRT), making it accessible for businesses with existing hardware they don't want to replace. The trade-off is less depth in enterprise security and compliance features.

5. Performance Evaluation & Extended Technical Observations Nomadix provides hardware-based gateway solutions primarily for the hotel and hospitality industry. Their gateway appliances sit between the network switch and the internet uplink, handling captive portal, bandwidth management, and policy enforcement at the hardware level. Nomadix is a proven choice for hotels with complex PMS (property management system) integrations, but the hardware-first approach means higher upfront costs and less flexibility compared to cloud-based solutions.

PacketFence is an open-source network access control (NAC) solution that includes captive portal functionality alongside VLAN management, 802.1X support, and device fingerprinting. It's free, highly customizable, and backed by an active community. The trade-off is clear: deployment and maintenance require significant technical expertise. PacketFence is ideal for organizations with Linux system administration resources who need NAC capabilities without licensing costs.

MyPlace targets small businesses with a straightforward, easy-to-set-up captive portal. It offers social login, email capture, and basic analytics with a clean, modern interface. MyPlace is designed for venues like cafes, restaurants, and small retail shops that want guest WiFi data capture without the complexity of enterprise platforms. Setup is quick and pricing is accessible, but it lacks the depth needed for multi-site or compliance-intensive deployments.

The"best" captive portal is the one that matches your actual needs. A hotel picking software for vacation rental email capture has different requirements than a university needing NAC with 802.1X. Here's a framework for narrowing the field. This is often the deciding factor. Check whether the software supports your existing access points before evaluating features. Replacing hardware to accommodate software is backwards.

Whether you've picked a platform or you're still evaluating, the setup process follows the same fundamental steps. Here's the complete walkthrough. For most businesses, cloud-based is the right answer. Lower upfront cost, faster deployment, and the vendor handles reliability and updates.

The splash page is what guests see. It needs to accomplish three things in five seconds: establish trust (your branding), explain the deal (free WiFi in exchange for X), and make the action obvious (big, clear login button). Choose login methods based on what you want to collect and how much friction your guests will tolerate. A practical combination for most businesses: Offer social login as the primary option (fastest for users, richest data for you), email as a fallback for users who don't want to use social accounts, and click-through for anyone who refuses to share data (depending on your tolerance). For enterprise environments, add 802.1X RADIUS authentication for employees on the same infrastructure.

The data you collect is only valuable if it flows into systems that can act on it. Configure these integrations during setup, not as an afterthought. This step is not optional. If you collect personal data through your captive portal - and if you're doing email or social login, you are - you have legal obligations.

For a deeper dive into GDPR requirements for guest WiFi, see our GDPR-compliant guest WiFi guide . For broader data privacy considerations, our WiFi data privacy guide covers the full landscape. The authentication method question comes down to a trade-off between data richness and user friction. More friction means fewer people complete the login. Less friction means less data. The art is finding the balance that matches your business goals.

Social login hits the sweet spot for most consumer-facing businesses. Users tap one button, you get their name, email, and profile information without them typing anything. The catch: some users refuse to connect social accounts to a WiFi network, and platform changes can break OAuth integrations. Email capture is the universal fallback. Everyone has an email address. The data quality is lower (people use throwaway emails) but the friction is moderate and the captured addresses feed directly into your marketing stack.

SMS verification provides the strongest identity confirmation for guest networks. Phone numbers are harder to fake than emails, and the two-step verification (enter number, receive code, enter code) confirms the person is real. The downside: it's the highest-friction method and requires an SMS gateway, which adds per-message cost. For enterprise environments , the authentication conversation shifts entirely. Guests use the captive portal methods above, but employees and managed devices should authenticate via 802.1X with RADIUS . This provides individual identity, VLAN assignment based on role, and a full audit trail - none of which captive portal login methods can match. IronWiFi handles both on the same platform, which eliminates the need for separate systems for guest and employee WiFi.

Consider offering Passpoint (Hotspot 2.0) as well. Passpoint allows devices to automatically authenticate to your network without ever seeing a captive portal - useful for return visitors and partner roaming. Our Passpoint vs. captive portals comparison covers when each approach makes sense. Operating guest WiFi means collecting personal data, and collecting personal data means regulatory obligations. Here's what applies, how to comply, and what your captive portal software needs to support.

If any of your users are in the EU - which includes EU tourists connecting to WiFi at your US hotel - GDPR applies. The key requirements for captive portals: CCPA applies if you do business with California residents and meet certain revenue or data volume thresholds. Requirements overlap significantly with GDPR but add specific obligations around the sale of personal information and the right to opt out.

Guest WiFi generates first-party data at a scale that most physical businesses can't match through any other channel. Every guest who connects gives you at minimum an email address and a timestamp. With social login, you also get name, profile photo, and demographic signals. With analytics, you get visit frequency, dwell time, and location patterns. The most common integration. WiFi-captured emails flow to your email platform (Mailchimp, Constant Contact, SendGrid, or whatever you use), where they trigger automated welcome sequences. A typical workflow: For B2B environments, conference centers, and coworking spaces, pushing WiFi data to your CRM (HubSpot, Salesforce, Zoho) creates a physical-visit record on the contact timeline. Sales teams can see when a prospect visited your office or attended your event.

Platforms like Zapier and Make connect your captive portal to virtually any marketing tool. Build workflows that trigger based on WiFi events: new guest connection, return visit, long dwell time, or specific location. The captive portal becomes an input into your broader automation engine. Beyond marketing, captive portal data feeds operational intelligence . Track peak hours to optimize staffing. Measure the effectiveness of promotions by correlating foot traffic with campaign dates. Compare visit patterns across locations. This data becomes more valuable over time as patterns emerge.

Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Captive%20portal • https://en.wikipedia.org/wiki/Wi-Fi • https://en.wikipedia.org/wiki/WiFiDog%20Captive%20Portal • https://imfreewifi.com/captive-portal/ • https://www.purple.ai/en-us/guides/wifi-guest-portal-what-it-is-and-how-to-optimise-it • https://www.ironwifi.com/blogs/captive-portal-software-guide/