Guest WiFi deployment checklist for MSPs: survey to handover

This checklist runs from the pre-sale survey to the end of a venue's first week. It matches CaptiFi's partner deployment guide and per-vendor setup guides, with vendor documentation linked for phones, controllers and email.

The checklist at a glance

The table gives each item its owner and the test that says it's done; the numbered sections below have the detail.

1. Survey the site before you quote

Survey for coverage and for the busiest hour, because a room one access point covers can still fail with a full bar. The guide to how many access points a venue needs covers sizing. On the same visit, note:

• the controller brand, model and firmware version, and whether you have admin access
• whether the controller can be reached from the internet: CaptiFi's API key route for UniFi needs that, while the Remote Tunnel dials out with no inbound ports; an on-site Omada controller needs a port forward, and Omada's free Central Essentials tier (formerly Cloud Essentials) is not supported
• devices that cannot complete a sign-in page, such as card machines, smart TVs and printers
• who runs the venue's domain and DNS, for step 8

A venue with no compatible kit can use the CaptiFi device, which plugs into the existing network by Ethernet with no controller, static IP or firewall change.

2. Give guests their own SSID and VLAN

Put guests on a separate SSID and VLAN with client isolation, so they cannot reach the tills, cameras, office machines or each other. Cisco Meraki describes Wireless Client Isolation as a feature that "prevents wireless clients from communicating with one another"; on an SSID in bridge mode it stays off until you switch it on. Check the equivalent setting on every brand you install.

The portal runs on open, Enhanced Open, WPA2 or WPA3 guest SSIDs (see captive portal vs WiFi password). On Omada, leave the SSID's Guest Network option off, because it stops guests reaching the controller's portal address, and rely on the VLAN instead. Card machines go on the staff network. A TV that guests cast to can stay on the guest network if you pre-authorise its MAC address, which CaptiFi supports on its own access points and on UniFi; see the guide to smart TVs on guest WiFi.

3. Set the external portal and walled garden

Point the guest SSID at CaptiFi as an external portal, add CaptiFi's hosts to the walled garden, and switch off the controller's own sign-in methods so only one portal is active. The values differ by platform:

On UniFi, tick Show Landing Page, HTTPS Redirection Support, Encrypted URL and Secure Portal, and switch off UniFi's own Password, Voucher, Facebook, Payment and RADIUS methods; two active portals cause a redirect loop. On Omada, enter the Controller URL, the 32-character Controller ID and the operator login on my.captifi.io, and an Admin-role Open API app lets CaptiFi set up the portal and pre-authentication list for you. FortiGate, Ruckus, MikroTik and Cisco Catalyst each have a setup guide linked from the hardware page; for MikroTik and DrayTek, CaptiFi support sends the portal details you need.

Add fonts.gstatic.com by name, never as *.gstatic.com, a wildcard that also covers the address Android phones test. Android detects a portal with "cleartext HTTP probes to known destinations (such as connectivitycheck.gstatic.com)", and its documentation warns that such probes "could be mistakenly allowed or blocked (instead of redirected)" (Android Developers), so a probe let through by the walled garden hides the page from Android phones.

4. Build the splash page and the consent question

Build the page in the venue's brand and get the owner's approval before go-live. Ask for the logo as a PNG, JPG or WebP of at least 200 by 200 pixels, on a transparent background if they have one. Before you save in the splash page builder, check that:

• email marketing consent is on, as it is by default: marketing consent is asked separately from getting online, and on the standard sign-in page it is its own question after the guest taps Connect, with Accept and Reject buttons, and guests who reject still get online
• the venue's own privacy policy and terms links are set, with a privacy collection notice on the form where local law asks for one at the point of collection
• Redirect after connect points at the owner's choice of page, such as the menu

5. Test on an iPhone and an Android phone

Test with one iPhone and one Android phone that have never joined the guest network. A phone that has joined before can hide a fault, because CaptiFi lets a returning device straight through, and Apple says that on iOS 18 and later, forgetting a network does not reset the phone's private address if it was last made to forget that network less than 24 hours earlier, two weeks on older versions (Use private Wi-Fi addresses on Apple devices). Then:

1. Switch off mobile data on both phones.
2. Join the guest SSID and wait without opening a browser. Apple's guide to captive Wi-Fi networks says to tap the network name and "wait for a login screen to appear"; Android treats a redirected probe as a portal and prompts the user to sign in.
3. Complete the page on both phones, tapping Accept on one and Reject on the other, and check both get online.
4. Open an ordinary HTTPS site on each.
5. Check both test guests appear in Guest Visits on my.captifi.io.

Don't close the iPhone's window with Without Internet, which Apple says "dismisses the Welcome screen and turns off Auto-Login for the network". If the page never shows, the guide to a captive portal that is not showing works through the causes in order.

6. Read the setup pill before you leave

Stay on site until the client's setup pill reads Ready. On the Clients page of CaptiFi's partner dashboard, each reseller and white-label client has a pill tracking venue created, device online, splash page live and first guest connected, and an amber count such as 2/4 has a tooltip listing what is left. If the tooltip still lists the first guest after your step 5 tests, those sign-ins did not reach CaptiFi, so go back to step 3.

7. Hand over the client login

Give the owner a login and tell them who to call. A login is optional (some partners run venues fully managed), but an owner who wants to see their guests needs one:

1. Use Send invite on the client's row or detail page to email a set-password link; you can resend it at any time.
2. Walk the owner through my.captifi.io. A client sees only their own venues and no CaptiFi pricing; where billing would be, a note says their service provider handles it.
3. Explain what the page collects, how consent works and how support runs. Client support tickets go to your support email and your Tickets page, not to CaptiFi.

White-label clients see your logo and colours once signed in, but the dashboard sign-in page at my.captifi.io is CaptiFi's, so tell the owner what they'll see the first time they log in.

8. Verify the sender domain for guest email

Verify the venue's sending domain in the first week, because CaptiFi sends campaigns only from a verified domain. Until then, review requests and other automated guest emails go out under the venue's name from a CaptiFi venue address.

1. On the client's account, open Marketing, Settings, Sender & domain, and save a From name and an address on the venue's domain.
2. Add the DNS records CaptiFi generates, including a TXT record at _captifi. followed by the domain. Email these instructions sends them to whoever runs the DNS, with no CaptiFi login needed.
3. When the records have propagated (usually minutes, up to 48 hours), click Verify now. Each record shows Pass and the domain shows Verified.

A domain can be verified on one CaptiFi account, so use the client's account and not your own. Inbox providers check sending domains: Gmail's email sender guidelines require everyone sending to Gmail accounts to set up SPF or DKIM and keep the spam rate reported in Postmaster Tools below 0.3%. Anyone sending more than 5,000 messages a day to Gmail accounts also needs both SPF and DKIM, DMARC, a From domain aligned with SPF or DKIM, and one-click unsubscribe on marketing mail.

9. Check the first week with the health digest

In the first week, check that the venue has guests every day and stays out of the morning health digest. CaptiFi's digest emails your support address only when something needs attention, such as devices offline, open alerts or venues with no guests for a week, and sends a full summary every Monday.

On the fleet overview, the Devices online tile counts CaptiFi devices only, so for a UniFi or Omada venue watch Guests today and Last activity, which shows a venue that has gone quiet while its hardware still reports online.

10. Escalate with the evidence CaptiFi needs

You are first line, and CaptiFi is second line at partners@captifi.io; say if a venue is down so it is treated as urgent. Before escalating, rule out a local network issue, check controller connectivity and test with a clean device that has no cached portal. Then send the venue name, the controller platform and version, which devices fail and what they show, when it started and what changed, with screenshots and logs.

Rehearse the checklist before your first client

Run the controller set-up and the phone tests on a venue of your own before you do them at a client's. Approved CaptiFi partners get a free 6-month licence for one internal test venue, never a live client venue, and its Guest Visits page shows your test sign-ins landing. The Clients page, setup pill and health digest used above come with the reseller and white-label models; the guide to guest WiFi for MSPs and white-label resellers compares the models, and the partner programme page sets out the terms. For the sale that comes before the install, see how to sell guest WiFi marketing to hospitality venues. To get the licence, apply to the partner programme.

Sources: Apple Support, Use captive Wi-Fi networks on your iPhone or iPad and Use private Wi-Fi addresses on Apple devices; Android Developers, Captive portal API support; Cisco Meraki Documentation, Wireless Client Isolation; Gmail Help, Email sender guidelines; TP-Link, Omada Central Essentials (press release, 19 May 2025), all checked 22 October 2026; CaptiFi's partner programme pages, setup guides and customer documentation, October 2026. iPhone, UniFi, Omada, Meraki, Aruba Instant On, FortiGate, Ruckus, MikroTik, Cisco Catalyst, DrayTek, Android, Gmail and Omada Central are trade marks of their owners; CaptiFi is not affiliated with or endorsed by them.