The Wi-Fi Login Page — Captive Portals in Hotels, Airports and Cafés
The splash screen that asks you to agree to terms before getting Wi-Fi access is usually harmless — but a fake one is a powerful tool for credential theft.
What Is a Captive Portal?
When you connect to Wi-Fi at a hotel, airport, café, or hospital, you often see a web page asking you to accept terms of service, enter a room number, or log in before you can access the internet. This is a captive portal.
The network intercepts your initial HTTP request and redirects it to this page. Once you complete the action required, the network grants your device internet access.
Captive portals are technically legitimate — they're used to manage bandwidth, record consent to terms, and provide a branded experience.
The Legitimate Version Is Generally Fine
A real captive portal at a Marriott, an airport lounge, or a Starbucks is not itself a significant threat. The risk from legitimate captive portals is primarily:
These are real concerns, but they're addressed by using HTTPS (which your browser does by default) and a VPN.
The Dangerous Version: Evil Twin Captive Portals
This is where the real threat is. An attacker in any high-traffic area can set up a Wi-Fi access point with a name like "Marriott_Guest" or "Airport_Free_WiFi."
When you connect, they present a fake captive portal that looks exactly like the hotel's or airport's real one. The page might:
How to Tell a Real Portal from a Fake One
Check the domain carefully. Legitimate captive portals use the venue's own domain or a well-known portal provider. A hotel portal at "marriott-wifi-login.com" is suspicious. A real Marriott portal uses a Marriott domain or their authorized network provider.
Look at what it's asking. A captive portal needs only your acceptance of terms or a simple access code — it should not need your email password, payment card details, or a government ID.
Check your device's security warning. If your phone shows a warning that the network's security certificate is invalid, leave immediately.
Verify the network name with staff. Before connecting to any hotel or airport Wi-Fi, ask at reception what the exact network name is.
Best Practice: VPN Before You Connect Anything
The gold standard is to connect to VPN before doing anything else on a new Wi-Fi network. Once your VPN is active, even a rogue portal can see nothing more than encrypted traffic to your VPN server.
Bottom Line
Legitimate captive portals are mostly harmless. Fake ones can steal your credentials and redirect your traffic. Always verify the network name with venue staff, be skeptical of any portal asking for sensitive information, and use a VPN on any public Wi-Fi.
Protect Yourself Today
The #1-rated antivirus covers all the threats mentioned in this article.
Get TotalAV — $1.99/month →