Captive portal settings

Portals › Captive Portal › Configuration holds the settings that apply to every zone and every journey of your captive portal at once: what happens when someone signs in on one device too many, whether accounts are tied to their devices, how returning guests are recognised, the floating Continue Login button, and four lists of rules — firewall, profile, third-party and scheduled account rules. This page walks through each card in the order it appears.

The page is a row of cards. Each card shows a short summary (for example which auto-login kinds are on); click a card to open its panel, change what you need and press Save. Settings take effect at once, for the next guest who signs in — nobody already online is affected.

Password rules are not here. The password rules for guest accounts (length, symbols, reuse, lockout, change on first login) are on Admin › System › Settings, in the Password Policy card, because they apply to every account in your tenant. See Settings, card by card.

Main

Session

Setting	What it does
Auto-disconnect	Every profile has a limit on how many devices can be online at once with the same account (see Simultaneous logins). With this off, a guest who is already at the limit is refused with "You have reached the maximum number of simultaneous connections." With it on, the new sign-in is let through and Kiwire disconnects another of that account's sessions instead.
Disconnect which user?	Shown when Auto-disconnect is on. Which of the account's other sessions to end: All connected user (every other device, the default), 1st connected user (the oldest session), Last connected user (the newest before this one), Random user, Low usage user or High usage user. The device that is signing in is never the one disconnected.

Security Setting

Setting	What it does
Delete unverified accounts	Deletes accounts that signed up with SMS, WhatsApp or email verification but never verified, 24 hours after their last sign-up attempt. Kiwire checks every hour; a guest who is still online is left alone until they disconnect. Verified accounts are never touched.
Block high severity	Shown greyed out: it is not available. It relied on a firewall threat feed that Kiwire 4 does not receive. For security and login alerts use Insight › Monitoring › Alerts — see Alerts.

Language — Default Language is the language guests see on the portal. A journey can set its own language, which wins over this one; System default uses English.

Post-Login — Post-Login Redirect decides where a guest lands after a successful sign-in:

• Continue Journey (the default) — the guest carries on to whatever the journey shows after sign-in.
• Specific URL — the guest is sent to the Redirect URL you type, for example your hotel's website.

A journey can set its own post-login destination; when it does, the journey's choice wins over this one. See The portal designer and journeys.

MAC Security

This card holds MAC Registration, which ties each account to the devices it uses. It does not sign anyone in automatically — that is the Autologin card.

Setting	What it does
MAC Auto Register	Off by default. When on, every successful sign-in from a new device adds that device's MAC address to the account's Allowed MAC list, until the list is full. After that, any other device that tries to use the account is refused with "Your device is not authorized to access WiFi. Please contact venue staff."
Maximum number of MAC Address to be registered per account	How many devices each account may register, from 1 to 10. Leave the box empty for 10. The card summary shows the limit in force as Max: N. Used only when MAC Auto Register is on.

To free a full list, edit Allowed MAC on the user under Account › Users, or use Reset MAC on a voucher. See Tying an account to its devices.

Use it when one account must not be shared around — staff accounts, paid plans, room accounts. Do not switch it on for a shared account that many guests use (a one-click or event account): the first devices to sign in would take every slot and everyone after them would be refused.

Autologin

Auto-login lets a returning guest back online without the sign-in form. When a guest opens the portal, Kiwire tries three ways to recognise them, in this order: the cookie their browser kept from last time, their device's MAC address, then their browser's fingerprint. The first one that matches an account that is still active signs them in with that account; if none matches, the guest sees the portal as usual. All three are off until you switch them on.

The account still goes through every normal check — status, expiry, quota, zone, simultaneous logins — so an expired or suspended account is not let back in.

Cookies

Setting	What it does
Cookies Auto Login	After each sign-in, the guest's browser is given a cookie that remembers the account. On the next visit from the same browser they are signed straight back in.
Cookies Auto Login Days	How long a browser is remembered, counted from the guest's last sign-in on the portal. Empty means 30; 0 means no limit.
Cookies Auto Login Only Same Zone	Only recognise the browser in the zone where it signed in.
Cookies Auto Login Reset	On: every automatic sign-in starts the days again. Off: the days count from the guest's last sign-in on the portal.

Phones often open the portal in a small captive-portal window that throws its cookies away when it closes, so cookie auto-login works best for laptops and for guests who reopen the portal in their normal browser. MAC and fingerprint auto-login cover the rest.

MAC Address

Setting	What it does
MAC Auto Login	A device is signed in again with the account it last used. Kiwire remembers the last account for every device that signs in.
MAC Address Auto Login Days	How long a device is remembered, counted from the guest's last sign-in on the portal — including QR Login, sign-up journeys, and cookie or browser-fingerprint auto sign-ins. Empty means 30; 0 means no limit.
MAC Auto Login Only Same Zone	Only recognise the device in the zone where it last signed in.
MAC Auto Login Reset	On: every MAC auto sign-in starts the days again. Off: a MAC auto sign-in does not extend them, and the days count from the guest's last sign-in that wasn't a MAC auto sign-in.

A device you Revoke on the Auto Login tab of Insight › Reporting › Login is no longer signed in by its MAC address until the guest signs in by hand again.

Many phones now use a different, random MAC address for each Wi-Fi network, and some change it over time. A phone that changes its MAC is not recognised and simply sees the portal again.

Browser Fingerprint

Setting	What it does
Browser Fingerprint Auto Login	After a sign-in the portal records a fingerprint of the browser (built from details of the device and browser, not from cookies alone) and recognises it next time.
Browser Fingerprint Auto Login Days	How long a browser is remembered, counted from the guest's last sign-in on the portal. Empty or 0 means no limit.
Browser Fingerprint Auto Login Only Same Zone	Only recognise the browser in the zone where it last signed in.
Also recognise browsers that keep no cookies	Off by default. For the captive-portal windows on iPhones and Android phones, which forget cookies: the device is recognised from its fingerprint alone, but only in the zone where it last signed in and only within the days above.
Browser Fingerprint Reset	On: every automatic sign-in starts the days again. Off: the days count from the guest's last sign-in on the portal.

Identical phones of the same model can produce the same fingerprint. When two different accounts ever sign in with the same fingerprint, Kiwire stops using that fingerprint for auto-login, so one guest is never signed in as another. More detail is in Login methods.

TV pairing (QR code) — Let guests connect a TV by scanning a QR code also lives on this card. It shows smart TVs a QR code instead of the sign-in form, so a guest can connect the room TV from their phone. It needs Approved devices switched on as well; see Guests connecting a TV themselves.

Continue Login Button

Some journeys go on after the guest is known — a survey or an advert after sign-up, or a page shown when a returning device is recognised. On those pages the portal shows a floating Continue Login button; tapping it finishes connecting the guest. This card sets how that button looks. A Preview at the top of the panel updates as you change the fields.

Setting	What it does
Button Text	The words on the button, up to 50 characters. Default Continue Login.
Background Color, Text Color	The button's colours. Default green with white text.
Starting Position	Where the button first appears: Bottom Right (default), Bottom Left, Top Right, Top Left or Bottom Center.
Edge Margin (px)	Distance from the edge of the screen, 8 to 200 pixels. Default 24.
Draggable	On by default. Guests can drag the button out of the way if it covers something on the page; a short tap still presses it. Switch it off to keep it fixed in place.

Firewall Policy

Blocks a device from the portal altogether. A blocked device sees "Your device has been blocked from accessing this network. Please contact your administrator." instead of the sign-in page.

1. Click the Firewall Policy card, then Add Firewall Policy.
2. NAS — pick one controller, or All to block the device everywhere.
3. Host / MAC Address — the device's MAC address or its IP address. Type the MAC with any separator (aa:bb:cc:dd:ee:ff, AA-BB-CC-DD-EE-FF or aabb.ccdd.eeff); capital letters do not matter.
4. Policy — Block this MAC Address or Block this IP Address, to match what you typed.
5. Remark — optional, for example why the device is blocked.
6. Press Save.

The block stops the device reaching the portal. It does not disconnect a device that is already online; disconnect it as described in Disconnecting a guest. A new or changed rule applies straight away. IP blocks are only useful where guests keep the same address — on most guest networks addresses change, so block by MAC.

Profile Policy

A Profile Policy limits the hours at which accounts on one profile can sign in — for example, a staff profile that only works during office hours.

1. Click the Profile Policy card, then Add Profile Policy.
2. Switch it Active and give it a Name.
3. Policy Type — Time Restriction.
4. Time Start and Time End — the window in which sign-in is allowed, in your tenant's time zone. A window that crosses midnight (22:00 to 06:00) works too.
5. Profiles — the profile the rule applies to. It is checked against the profile the account is using at that moment.
6. Message Alert — what a guest sees when they try outside the window. Left empty, they see "Access is restricted at this time."
7. Press Save. The rule applies straight away.

The rule is checked when a guest signs in; it does not disconnect someone already online when the window closes. To switch a whole site's Wi-Fi off outside opening hours instead, see Switching Wi-Fi off and opening hours.

3rd Party Policy

A 3rd Party Policy asks one of your own systems whether a guest may get online. During every sign-in it sends the guest's details to a web address you control; your system answers yes or no, and a "no" refuses the sign-in with the message your system returns. Use it, for example, to check a membership list or a ticketing system.

You need a Webhook connector first (under Connectors), holding your system's web address and any headers it needs.

1. Click the 3rd Party Policy card, then Add 3rd Party Policy.
2. Enable the policy and give it a Name.
3. Webhook Connector — pick the connector.
4. User Details to Send — choose what Kiwire sends: Username, Full Name, Email Address, Phone Number, IP Address, MAC Address, Zone.
5. Under Response Mapping, tell Kiwire how to read the answer:
   • Status Field — the name of the field in your system's reply that says yes or no (default status). Use a top-level field, or a dot path such as data.status for a field inside another one.
   • Success Value — the exact value of that field that means "let them in" (default success). If your system answers with JSON true, a Success Value of true or 1 matches it. Anything else is a no.
   • Message Field — the field holding the message to show the guest when the answer is no (default message).
   • Default Message — shown when the reply has no message (default Authentication failed.).
6. Press Save. Open the policy again and press Test Connection to call your system once, exactly as a real sign-in would, using the connector's own method (POST unless the connector says otherwise). It sends the details you ticked with sample values — username test.guest, name Test Guest, email test.guest@example.com, phone 60123456789, IP 10.0.0.10, MAC aa:bb:cc:dd:ee:ff, zone test-zone. You see the HTTP Status, the value of the status field compared with the expected value, and the start of the reply. Your system may answer "no" to the sample guest — what matters is that it answers and the field is where you said. If the connector is switched off or is not a Webhook connector, the test tells you that sign-in skips this policy.

Every enabled policy applies to every sign-in in every zone. If your system cannot be reached, or answers in a way Kiwire cannot read, the guest is refused with the Default Message — so keep the service reliable, or switch the policy off while it is down. A policy whose connector is switched off, or is not a Webhook connector, is skipped. Changes to a policy apply straight away.

Account Policy

Account Policies are rules that run on a schedule and change many guest accounts at once: suspend old accounts every night, give a shared account a new password every week, clear out vouchers at the end of the month.

Delete Account is permanent. A policy with Action = Delete Account permanently deletes every account that matches its filters each time it runs, and deleted accounts cannot be recovered. A policy with no filters matches every account in your tenant. Always set filters, and try the same filters first with Update Status › Suspended, then look at Account › Users to see which accounts it caught.

1. Click the Account Policy card, then Add Account Policy.
2. Switch it Active and give it a Name.
3. Frequency — Daily, Weekly, Monthly (runs on the last day of the month) or Yearly (runs on 31 December).
4. Action:
   • Delete Account — removes the matching accounts.
   • Update Status — sets Set Status To Active, Suspended or Expired on them.
   • Update Password — type a new password in Set Password and every matching account gets it; leave it empty (or type [random]) and each account gets its own random 8-character password.
5. Account Type — All Types, Account or Voucher.
6. Open Filters to narrow it down. All the filters you set must match:
   • Account Status Filter — only accounts that are Active, Suspended or Expired.
   • Integration Filter — Internal for accounts made in Kiwire, PMS for hotel room accounts, Active Directory or LDAP for accounts checked against a directory (including accounts created when someone signs in with the Active Directory or LDAP login method). Internal leaves directory accounts out.
   • Profile Filter — one profile, with Apply To Subscribed Profile (the plan the account was given) or Current Profile (the one it is using now).
   • Username Filter, Email Filter, Phone Filter — type a value and press Enter; add as many as you need (an account matching any one of them counts). A value on its own matches anywhere in the field, so @gmail.com catches every Gmail address and 012 every number containing 012. Wrap it in dashes, like -lobby-, to match that exact value only.
7. Press Save. Click a policy in the list to see a summary of its schedule and filters.

When it runs. The time of day for each frequency, and the day of the week for weekly policies, are set on Admin › System › Settings in the Cron Timing card, under Account Policy Schedule (in your tenant's time zone; midnight unless you change it). See Cron timing. A policy runs once at that time on each matching day.

Changing an account's status or password does not disconnect a guest who is online at that moment; it applies from their next sign-in. Policies run quietly — nothing is sent to guests.

Who can do what

Task	Permission
Open the page	view-portal-templates (or view-portal-config)
Change any card and edit existing rules	edit-portal-templates (or edit-portal-config)
Add or delete firewall, profile, 3rd party or account policies	edit-portal-templates (or create-portal-config / delete-portal-config)
Set when account policies run	manage-settings-cron (on Admin › System › Settings)

If something goes wrong

What you see	Likely cause
A guest is told "Your device is not authorized to access WiFi."	MAC Auto Register is on and the account's device list is full. Clear Allowed MAC on the account, or raise the maximum.
A guest is told they have reached the maximum number of simultaneous connections	The profile's simultaneous-login limit is reached and Auto-disconnect is off.
Returning phones always see the sign-in form	Their MAC address changes (random MAC) and their portal window drops cookies. Switch on Browser Fingerprint Auto Login and Also recognise browsers that keep no cookies.
Every sign-in is refused with the same message	An enabled 3rd Party Policy cannot reach your system, or its Success Value does not match what the system returns. Use Test Connection, or switch the policy off.
A blocked device still reaches the portal	The rule is switched to the wrong NAS, or the device changed its MAC (random MAC).
Accounts disappeared overnight	An Account Policy with Delete Account ran. Check the list for policies with that action and their filters.

Related

• Login methods — the ways guests sign in, and more about auto-login
• The portal designer and journeys
• Accounts and vouchers
• Profiles, bandwidth and quotas
• Settings, card by card
• Configuration in the menu tour