Say you've just opened a cafe. You put a nice sign on the wall with the network name and password printed on it. A customer walks in, types the password by hand, gets a character wrong, sighs, and waves you over. You'd like to change the password once a month for good measure but then the sign has to change too. And who's actually using that network? You have no idea.
A captive portal solves all of that with a single page. When a guest tries to join your Wi-Fi, they don't land straight on the internet. First they see a welcome screen that you control. What happens on that screen is entirely up to you.
In plain terms: how does it work?
Let's walk through it step by step. Someone spots your network name on their phone and taps it:
- The phone connects to the network, but internet access is still locked.
- Your sign-in page opens automatically on their screen your logo, your colors, your "Welcome" message.
- The guest does whatever you've asked: taps a button, enters a phone number, or types in a code they've received.
- Only then does the internet open up, and the guest is free to browse.
The whole thing takes a few seconds. For the guest it's just one tap they never see the technical work happening in the background.
Login methods which one should you pick?
There's no single right answer here; it depends on your venue. These are the four options people reach for most:
One-tap access
The guest simply accepts the terms and is online instantly. Perfect for cafes, waiting rooms, and barbershops nothing to type, zero friction.
SMS verification
The guest enters a phone number, receives a code by SMS, and types it in. This method also identifies the user which is the approach widely used for public Wi-Fi in Azerbaijan. More on that below.
Voucher (code) system
You generate time-limited codes in advance say, "2 hours of access." A hotel front desk hands one to a guest, or a co-working space sells them. You keep full control over who gets online and for how long.
Social or account login
Sign in with Facebook, Google, or a named account you create. Handy for staff and regulars.
A practical tip: Plenty of venues set up "one-tap" or "SMS" for guests and a "named account" for staff. Each audience gets its own rules different speeds, different time limits. You configure it once, and it runs on its own after that.
So what's in it for you?
A captive portal isn't just a "nice-looking login page." There are real business upsides:
- Control. You decide who connects, for how long, and at what speed. No single guest can hog the whole pipe on YouTube and slow everyone else down.
- Branding. The sign-in screen opens with your logo. A small detail, sure but it leaves a professional impression.
- Security. Your guest network is kept separate from the business network you actually run on the POS, the accounting system, the cameras. No one can reach your critical systems through the guest Wi-Fi. It's one of the core practices CERT.gov.az recommends, too.
- Compliance. Identifying users and keeping access logs it's the simplest way to meet the legal expectations.
Why is a captive portal a bigger deal in Azerbaijan?
Here, it's become standard practice for venues offering public Wi-Fi to establish who the user is. And the most common method is exactly the one above: the guest enters a phone number, gets a code by SMS, and signs in. In other words, whoever uses the network doesn't stay anonymous.
You can handle this manually or with a cheap "social Wi-Fi" service but there's a catch worth noting. With those services, your guests' data often sits in some foreign company's cloud, and you pay a monthly fee per location. A captive portal that runs on your own device, by contrast, keeps the data on your premises and there's no recurring per-location charge.
- Public Wi-Fi and the law: what cafes and hotels need to know
- How to set up a guest Wi-Fi solution for hotels and cafes
- Onyx Firewall plug it in, and leave the rest to us
So where do you start?
If you offer Wi-Fi to guests at your venue, you already need a captive portal whether it's to meet a legal expectation today or simply to get your network in order. The good news: you don't have to swap out your access points or hire an in-house IT engineer to make it happen.
Onyx Firewall was built for exactly this job. You keep your existing routers and access points as they are, we add the device to your network entry point, we build the sign-in page in your branding and we manage it all remotely. You just get on with running your business.
Frequently asked questions
Do I need to replace my Wi-Fi equipment for a captive portal?
No. The portal works with your existing routers or access points. One device is added at the network entry point, and your current Wi-Fi stays exactly as it is.
Where is guest data stored?
With a solution that runs on your own device, the data stays on your premises and isn't sent to an external cloud. The retention period is set to match local practice, too.
Do I need technical skills to manage this?
Not with Onyx Firewall. We handle setup, changes, and updates remotely. You just choose how the sign-in page looks.
Does the guest network put my main business network at risk?
Set up properly, it's the opposite guests are isolated on a separate network with no access to critical systems like your POS or servers.