Guest Wi-Fi content filtering
Free Wi-Fi is now expected in hotels, cafés, shops, clinics, offices and public buildings. Whoever runs that network carries some responsibility for what happens on it.
Guest Wi-Fi content filtering keeps explicit and harmful sites off the connection, protects guests from scams and malware, and keeps bandwidth for the people it is meant for. This guide covers profiles, network design and the category data behind it.
Example venue networks
Why venues filter guest Wi-Fi
Most venues do not filter to control guests. They filter so the network does what it is for: easy, safe access for everyone in a shared space. Done well, guests never notice the filter at all.
Shared spaces
Children and families use the same network as everyone else. Explicit content on a screen in a lobby is a real complaint risk.
Guest safety
Blocking malware and phishing domains protects guests from fake login pages and infected downloads on your network.
Misuse risk
An open connection can be used to reach illegal content. Category blocks reduce that risk and show the venue took reasonable steps.
Fair bandwidth
A few guests streaming or torrenting can slow the connection for everyone, including card terminals that share the line.
Brand
Guests associate the network with the venue. A clean, reliable connection supports a family-friendly reputation.
Contracts and rules
Franchise agreements, insurers and some funding programmes ask for filtering. Public libraries in the US often must meet CIPA rules.
Libraries have specific obligations. If your guest network is in a library, read the library web filtering page alongside this one.
Three ready-made guest Wi-Fi profiles
Most venues fit one of three profiles. Start from the closest one and adjust. Each uses categories from our web filtering categories list.
Family-friendly
Hotels, cafés, retail, leisure, transportSuits any space where children may be present or screens are visible to others.
Business guest
Offices, coworking, conference centresAllows VPNs, because visiting staff need them to reach their own company networks.
Open but safe
Universities, residences, long-stay housingFor adults who live on the network. Security only, plus any content blocks required by law.
How to adjust a profile
Change one thing at a time and watch the results for a week. If guests keep asking for the same kind of site, revisit the category rule rather than adding one-off exceptions.
| If you see | Consider |
|---|---|
| Complaints about blocked travel or booking sites | Check that Travel and Shopping are allowed and that ad blocks are not breaking checkouts |
| Heavy use of File Sharing/P2P at night | Move from a limit to a block on that profile |
| Many anonymizer lookups from one area | Block the category if it was only logged, and check for a local tutorial being shared |
| Business guests unable to reach company tools | Switch that SSID to the business profile so VPNs work |
Safe search enforcement on search engines and video sites is worth adding to the family-friendly profile. It hides explicit results without blocking useful services.
How guest Wi-Fi filtering is set up
The building blocks are the same in a café with one access point and a hotel chain with thousands. What changes is where each piece runs.
Any phone, laptop or tablet, no software needed
Separate segment with client isolation
Terms, sign-in, policy notice
Category policy for the guest profile
Forces DNS, limits bandwidth, blocks tunnels
Why DNS filtering fits guest networks so well
Guest devices are unmanaged. You cannot install agents or certificates on them. DNS filtering needs neither: the network hands out the filtering resolver, and every lookup is checked. If you are new to the method, see what is DNS filtering.
| Option | Where filtering runs | Best for | Notes |
|---|---|---|---|
| Cloud DNS filter | Hosted resolver, set in the guest DHCP scope | Single sites, small chains, MSP-managed venues | Fast to deploy, policy managed online |
| Wi-Fi controller feature | Built into the access point platform | Venues already on a cloud-managed Wi-Fi system | Depth depends on the platform's category data |
| Gateway or firewall | On-site edge device | Larger venues needing bandwidth and app control | Combine DNS and hostname rules |
| Router with built-in filtering | Consumer or small business router | Small cafés and shops | Check how often its category list updates |
| Provider service | The venue's internet provider | Venues that want no equipment changes | Fewer policy choices |
Static block lists or category filtering?
Static block lists
- A fixed file of domains, often shared online
- Fine for ads and trackers, weak for content policy
- Miss new adult, gambling and scam sites until someone adds them
- No way to choose by type of content
Category filtering
- Every domain carries one or more ranked categories
- Profiles pick categories, not individual sites
- New domains are labelled as they appear, about 300,000 a day
- Sites are rechecked after a week and a month as content grows
Coverage of real traffic matters more than raw size. The 20 million most visited domains cover 99.99% of web traffic and usage, and that is where a guest filter makes nearly all of its decisions. Our database holds 120 million categorized domains, so the long tail is covered too.
Bandwidth and fair use
Content filtering and bandwidth control work best together. Categories tell the firewall which traffic is heavy and low priority, so limits can be targeted instead of slowing everyone.
| Category | Typical guest rule | Reason |
|---|---|---|
| Streaming Media | Allow, cap per device at busy times | Guests expect video, but a few streams can fill a small line |
| File Sharing/P2P | Block or heavy limit | High volume, plus copyright complaints sent to the venue |
| Gaming | Allow, low priority | Large updates can saturate the link |
| Cloud Storage / File Hosting | Allow, cap uploads | Photo backups run in the background on every phone |
| Email and Messaging, video calls | Allow, high priority | What most guests actually need the network for |
The HTTPS block page problem
Almost every site guests visit uses HTTPS. When a DNS filter sends a blocked site to a block page, the guest's browser expects a certificate for that site. Your block page cannot provide one that the guest device trusts.
What happens
- The guest sees a security warning, not your explanation
- Some guests think the network is unsafe
- Apps simply fail to load content
- Installing your certificate on guest devices is not realistic
What venues do instead
- Use silent blocks for guest networks
- State the filtering policy on the captive portal
- Add a short line to the terms of use
- Offer a staff contact or help page for wrong blocks
What to say on the captive portal
Guests accept a filter more easily when they know it is there. Keep the notice short and plain. These are example lines you can adapt in your own words.
The policy
"This network blocks adult content, gambling and known harmful sites to keep it safe for all guests."
The reason
"Our Wi-Fi is shared by families and children, so some sites are not available here."
The way out
"If a site you need is blocked, please ask at reception and we will check it."
The full story of decryption and certificates is in SSL inspection and URL categories. For guest networks, the short answer is: do not decrypt guest traffic.
Stopping guests from bypassing the filter
Most guests never try. A few will, usually with a VPN app or an encrypted DNS setting. These controls cover the common routes without hurting normal use.
Be realistic about the goal. A guest with mobile data can always leave your network. The aim is a network that is safe by default and hard to misuse, not one that is impossible to avoid. Guests on mobile data are outside the venue's responsibility.
- Redirect or drop outbound DNS that does not go to your resolver
- Block outbound port 853 used by DNS over TLS
- Answer the browser canary domain so default encrypted DNS stays off
- Block well-known public DNS over HTTPS hostnames
- Block the VPN / Proxy / Anonymizers category on family profiles
- Block URL Shorteners only if abuse appears, since many are harmless
- Rate-limit or block File Sharing/P2P protocols
- Block known Tor entry points where policy requires
Each route is covered in detail in DNS over HTTPS and web filtering, how to block VPN apps and how to block torrent sites.
Guest Wi-Fi filtering by venue type
Every venue has its own balance between openness and control. These notes come from common deployments and are a starting point, not a rule book.
| Venue | Profile | Specific concerns | Extra controls |
|---|---|---|---|
| Hotel | Family-friendly in public areas, lighter in rooms | Long stays, streaming in rooms, business guests | Separate SSIDs for lobby and rooms, per-room bandwidth |
| Café and restaurant | Family-friendly | Short visits, shared line with card terminals | Session time limits, card terminals on their own network |
| Retail and malls | Family-friendly | Large crowds, brand image | Bandwidth caps per device, analytics on the portal only |
| Clinic and hospital waiting areas | Family-friendly | Vulnerable users, clinical networks nearby | Strict segmentation from clinical systems |
| Coworking and offices | Business guest | Visitors need VPNs and video calls | Allow VPNs, block threats, keep guest and staff apart |
| Public library | Depends on law and funding | Children's areas, adult patrons' rights | Follow CIPA where it applies, unblock process for adults |
| Student housing | Open but safe | Residents' privacy, heavy use | Security blocks, bandwidth fairness |
Privacy and logging on guest networks
Guest networks collect less data than staff networks, and that is usually the right choice. Keep what you need for security and nothing more. Aggregated counts answer most questions a venue manager will ask.
Reasonable to keep
- Counts of blocks by category
- Threat blocks with device identifiers, for a short time
- Bandwidth per session for capacity planning
- Portal acceptance of terms
Think twice about
- Full lookup histories tied to names or room numbers
- Long retention without a clear reason
- Sharing logs with marketing tools
- Rules that differ from what the portal says
Data protection and data retention rules vary by country and change over time. Check current local requirements, especially if your venue is required to keep connection records.
Mistakes we see on guest networks
One flat network for guests, staff and tills
A single network lets guest devices reach staff laptops and card terminals. Segment first, then filter.
Filtering set on the router but DNS left open
Guests who type in a public resolver skip the policy entirely. Force DNS at the firewall.
Block pages that trigger security warnings
Guests read the warning as "this Wi-Fi is unsafe". Silent blocks plus a portal notice avoid that.
Filter lists that never update
Some low-cost devices ship a category list and rarely refresh it. New adult and scam sites then pass freely.
Blocking VPNs in a business venue
Conference guests need their company VPN. Use the business profile where visitors work.
For Wi-Fi platform makers and MSPs
Cloud-managed Wi-Fi platforms, hotspot operators and MSPs increasingly ship content filtering as a built-in feature. Venues expect a profile they can switch on in one click.
Category data inside
120 million categorized domains in 59 categories, loaded into your controller or resolver as CSV, Parquet or JSON files.
Daily updates
About 300,000 newly registered domains categorized each day as delta files, with a monthly refresh of everything else.
Ready profiles
Map the family, business and open profiles above to categories once, and every venue starts from a sensible default.
Resolver formats
Licensed customers can export DNS RPZ, hosts and list formats. See blocklist formats.
AI tools set
16,000+ AI-tool domains in 18 categories, useful for business guest profiles and venue reports.
Running filtering across a chain of venues
Central control
- One profile library, applied to every site by venue type
- Local managers can request exceptions, central IT approves
- Same block categories everywhere, so brand standards hold
- New sites inherit the profile on day one
Reporting that helps
- Block counts by category per site, not per guest
- Threat blocks that hint at an infected device on a staff network
- Bandwidth peaks to plan line upgrades
- Complaint trends after policy changes
Router and mesh makers have a related set of needs, covered in router content filtering for OEMs. MSPs can also see the MSP web filtering page.
Guest Wi-Fi filtering checklist
Run through this list before launch, and again whenever you change equipment or providers. It takes under an hour for a single site and catches most of the problems guests would otherwise find for you.
- Guest network on its own VLAN, with client isolation on
- Payment and staff systems on separate networks
- Guest DHCP hands out only the filtering resolver
- Outbound DNS forced to that resolver at the firewall
- Profile chosen and documented for each guest SSID
- Silent blocks for guests, explained on the portal
- Safe search enforced where the profile needs it
- Anonymizer and VPN rules set per profile
- Bandwidth limits per device or session
- Log retention set and written down
- A test list of domains per blocked category
- Monthly look at block counts and complaints
To test a category, check how a domain is labelled with the domain lookup tool, then try it from a guest device.
Frequently asked questions
Why filter guest Wi-Fi?
To keep explicit and illegal content off a network the venue is responsible for, protect guests from scams and malware, keep bandwidth fair and support a family-friendly brand.
What is the best way to filter guest Wi-Fi?
For most venues, DNS-based category filtering on the guest network. It works for any device without software or certificates. Larger sites add a gateway for bandwidth and app control.
What should be blocked on public Wi-Fi?
A baseline of threats, Adult, Illegal Drugs, Hate/Discrimination, Violence and anonymizers. Family venues add Gambling, Dating and Weapons.
Can guests see a block page on HTTPS sites?
Not cleanly, because guest devices do not trust your certificate. Use silent blocks and explain the policy on the captive portal.
Does guest Wi-Fi filtering stop VPNs?
Blocking the anonymizer category and common VPN protocols stops most consumer VPN apps. Business profiles often allow VPNs on purpose.
Should guest Wi-Fi be separate from the staff network?
Yes. Use a separate segment with client isolation and its own filtering policy.
How do Wi-Fi vendors license your data?
Under internal or OEM licences, with a lookup API included. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Build filtering into your guest Wi-Fi product
License 120 million categorized domains in 59 categories, with daily new-domain updates, for controllers, hotspots and managed resolvers.
License the database