Guests browsing without signing in? It is often mobile data

You connect a phone to the guest Wi‑Fi, you do not complete the sign-in… and pages open anyway. It looks as if the captive portal blocks nothing. In most cases it does not: the phone is attached to the Wi‑Fi but is browsing on mobile data.

Why it happens

Many Android phones (Samsung, Xiaomi and Redmi, Pixel and others) and iPhones, when the Wi‑Fi gives no Internet access, for example because the guest is not authorized yet or access was revoked, stay connected to the Wi‑Fi with the icon on but send traffic over the 4G/5G mobile network. They do it on their own, through a setting that is usually on:

• Android: “Switch to mobile data”, “Adaptive Wi‑Fi”, “Intelligent Wi‑Fi”; on Xiaomi “Wi‑Fi assistant”. The name varies by brand and version.

• iPhone: “Wi‑Fi Assist”.

It mostly affects smartphones. A laptop or tablet without a 4G/5G modem has no alternative: if it is not authorized, it cannot browse.

Why it matters for your guests

• Guests without data or roaming, such as tourists from abroad, only have the Wi‑Fi: the portal must really work.

• Guests with limited roaming use the Wi‑Fi to save it: if the phone silently switches to mobile data, they spend credit believing they are on Wi‑Fi.

That is why the only realistic test is with mobile data off: it is the real situation of people using guest Wi‑Fi.

The correct test

1. On the phone, turn off mobile data and roaming.

2. Connect to the guest Wi‑Fi without completing the sign-in.

3. In a private tab, open a site you have never visited that does not force HTTPS, for example neverssl.com.

4. The portal’s sign-in page must appear.

5. Complete the sign-in: now the phone browses. If you revoke access from the dashboard, the portal must appear again on the next page.

If the site still opens with mobile data off

Then the network lets unauthorized traffic through, and it is a configuration issue:

• hosts allowed before sign-in are too broad: in UniFi, captive.sostolabs.com in the Pre-Authorization Allowances is enough;

• the guest network does not have the hotspot enabled or is not isolated from the rest of the network;

• another gateway or firewall routes guest traffic without going through the hotspot.

See Set up the UniFi hotspot for Captive Portal.

How Sosto Labs Captive Portal handles it

• No authorization until the guest completes verification or the sponsor approves: until then they see a clear waiting page and know they are not online yet.

• A revocation only counts as done when UniFi confirms it.

• If the phone is away from the Wi‑Fi when you revoke access, the revocation stays pending and is repeated automatically as soon as the device comes back. The same applies when you erase a guest’s data for a privacy request.

Having this doubt with your current portal? Run the test above, then try Sosto Labs.