UniFi installers: turn the guest hotspot into monthly revenue

Plenty of UniFi installs in pubs, cafes and hotels already have a guest SSID on its own VLAN, and some run the Hotspot Portal with a password or vouchers. That gets guests online, and a hosted platform on the same controller adds the guest list and the marketing, so you gain a recurring line on an account that otherwise bills for kit and call-outs.

UniFi facts below come from Ubiquiti's help centre, checked on 22 October 2026. The click-by-click settings are in the UniFi setup guide.

What the UniFi hotspot portal does on its own

The Hotspot Portal puts a sign-in page in front of a WiFi network. In Ubiquiti's article on UniFi hotspots and captive portals, you switch it on per SSID under UniFi Network, Settings, WiFi, by enabling Hotspot Portal and then Captive Portal. A whole VLAN goes in the Hotspot zone instead, which needs zone-based firewalling on Network 9.0 or later. Branding sits under Insights, Hotspot, Landing Page: welcome text, a logo and a colour scheme.

Ubiquiti lists six ways a guest can get through, and a venue can offer more than one:

• Facebook, where the guest signs in with a Facebook account
• a shared password
• payment, which Ubiquiti says is currently supported through Stripe
• vouchers, with their own expiry times, bandwidth limits or data quotas
• RADIUS, marked as advanced
• an External Portal Server, also marked as advanced, for a third-party portal

Ubiquiti's guest WiFi best practices add Network Isolation on the guest VLAN, Client Device Isolation on the SSID and Device Isolation (ACL) at the switch. For a hotel that hands out voucher codes and wants nothing more, the built-in portal may be all it needs.

Where it stops for a venue that wants marketing

Ubiquiti's hotspot article takes the guest as far as getting online. The owner's next questions are who those guests were, whether they can be emailed and whether any of them came back. The article covers sign-in methods and landing-page branding, and doesn't describe a guest list, a consent question or anything sent to guests afterwards. Its External Hotspot API article lists newsletter sign-up among the jobs an external portal server can take on, next to payment systems and hotel-style room number and surname checks.

For a venue that wants marketing, four things are missing:

• A consented guest list, with marketing agreed separately from the WiFi terms (the guide to guest WiFi marketing laws by country covers each market).
• Campaigns, such as a welcome email or an offer to regulars who haven't been in for two months.
• Review requests sent the morning after a visit.
• Reports the owner can read, and for you, every client site's health on one screen.

For the network itself, Ubiquiti offers an MSP Account in Site Manager: customers grant it delegated access, you add technicians once with scoped permissions, and each customer keeps control of its own sites. The guest list and marketing still come from the portal platform on top.

UniFi hotspot portal on its own vs with CaptiFi

Left column from Ubiquiti's help centre, right column from CaptiFi's feature and partner pages, October 2026.

How CaptiFi connects to a UniFi controller

CaptiFi takes UniFi's External Portal Server slot and leaves the radios and VLANs with the controller. It serves the sign-in page, keeps the guest data and lets each guest online through the UniFi Controller API, so there's no RADIUS server to stand up. The set-up wizard on my.captifi.io offers three ways to connect a console:

• An API key, for a console CaptiFi can reach over the internet (a public IP, a firewall rule or a port forward). CaptiFi connects from one address, 46.62.168.7, and you can revoke the key from UniFi at any time; Ubiquiti puts key generation under Network, Control Plane, Integrations.
• The Remote Tunnel, for a console behind another router, CGNAT or an ISP router you don't control. The console dials out, so there are no inbound ports, and Cloud Key Gen2 and Gen2 Plus are included.
• Controller sign-in with a local username and password, for UniFi Network versions too old for API keys.

Over an API key or the Remote Tunnel, CaptiFi writes the hotspot settings for you. By hand, or as a check afterwards, they are:

1. An open guest SSID on its own VLAN.
2. Hotspot Portal on, authentication set to External Portal Server, with IPv4 address 46.62.168.7 and domain site.app.captifi.io.
3. Pre-Authorization Access for site.app.captifi.io, app.captifi.io, fonts.googleapis.com and fonts.gstatic.com, plus *.captifi.io if the firmware accepts wildcards.
4. Show Landing Page, HTTPS Redirection Support, Encrypted URL and Secure Portal ticked.
5. UniFi's own password, voucher, Facebook, payment and RADIUS methods switched off, so CaptiFi is the only thing authorising guests.

CaptiFi's full UniFi captive portal guide puts the API key path at about 15 minutes and walks through the firewall rule on a Dream Machine and the port forward for a Cloud Key. Before go-live, move card machines, receipt printers and back-office iPads to a staff network or add their MAC addresses under Pre-authorized devices on the venue card, because they can't complete a sign-in page.

What CaptiFi enforces on a UniFi network

On UniFi, CaptiFi enforces paid WiFi speed tiers, keeps pre-authorised devices online and can run a separate design per WiFi network, and its partner pages name UniFi as the best-supported route for MSPs. A venue on paid WiFi can sell up to eight passes, from 30 minutes to 7 days, paid by card, Apple Pay or Google Pay into its own Stripe account with no CaptiFi commission. Each pass can carry a speed from 1 to 500 Mbps, and those tiers are enforced on UniFi only: at an Omada or Meraki venue the tier is shown to the guest and the network doesn't apply it. Ubiquiti's own API article lists time, data usage and rate limits as options when a portal authorises a guest, which are the controls a per-pass tier needs.

Pre-authorised devices are refreshed nightly so they survive a controller reboot, and each WiFi network can have its own splash design, session length and speed limit (handy for a hotel with a lobby network and a meeting-room network on one controller). If a controller is reset, Re-apply settings on the venue card pushes the portal, the pre-authorisation list and any speed limits again without disconnecting guests already online.

Turning the portal into a monthly line on the contract

Bill it per venue, every month, on the support contract you already invoice, with a one-off set-up fee for the splash design and controller work if you want one. Without a monthly line, an installer's income from a venue tends to arrive in lumps: survey, kit, install, then hourly call-outs.

Essentials ($69 a month) covers the branded splash page, contact capture, a weekly insights card per venue, CSV export, paid WiFi and vouchers. Review requests and email marketing are on Growth, SMS is on Growth, and Growth adds rewards, the integrations and weekly and monthly PDF reports. Pro adds the multi-site dashboard, group analytics and automation workflows for a client with several venues. A venue that collects emails and never sends one has little to show at renewal, so make sure the plan you sell includes the emails and review requests the owner wants. The reseller pricing guide works the margins through in your currency, and proving guest WiFi ROI covers the monthly review that keeps clients renewing.

Refer, resell or white-label as a UniFi installer

Refer if you want no billing or support work, resell if you already invoice the venue monthly, and white-label if your clients buy from you by name; a CaptiFi partner account uses one model at a time.

For an installer who already sells a support contract, reselling usually fits: guest WiFi becomes another line on the monthly invoice, at a price you set. CaptiFi's public price for Growth is $129 a month, reselling at that price leaves you more than a third of it as margin, and you can charge more (the wholesale rate card is on the MSP programme page). If you'd rather not take the first call, a referral on the same venue pays $25.80 a month, 20% of every payment for the client's lifetime. White label is the reseller model under your own brand, with clients still using CaptiFi's dashboard sign-in page at my.captifi.io (the white-label page lists what carries your brand). The MSP guide to reselling and white label compares all three.

Running many UniFi sites

When one controller hosts several UniFi sites, each UniFi site becomes its own CaptiFi location, picked from the Controller site dropdown, and one API key covers every site on that controller, so rotating it changes the connection for all of them at once. Resellers and white-label partners then see every client venue on the fleet overview at my.captifi.io, where a UniFi venue reads as online once its controller is connected.

For clients on TP-Link kit, see the guide for Omada MSPs. The MSP deployment checklist runs from survey to handover, and the partner deployment page has the UniFi checklist in short form.

Getting started as a UniFi partner

Start by rehearsing on your own kit. Approved partners get a 6-month demo licence for one internal test venue, so connect a lab or office UniFi controller to it, put the splash page on a test network and run a phone through it before you quote a client; on a UniFi venue you can switch which network carries the splash page from the venue card. For prospects, the Demo Maker builds a branded splash page demo from a venue's website in about 10 to 30 seconds, with a link you can send before anyone touches the controller. When you're ready, apply online or email partners@captifi.io.

Sources: Ubiquiti Help Center, UniFi Hotspots and Captive Portals, External Hotspot API for Authorization Clients, Best Practices: Guest WiFi and Multi-Tenant Customer Management With an MSP Account, checked 22 October 2026; CaptiFi's partner programme pages and customer documentation, October 2026. UniFi, Site Manager, Omada, Meraki, Stripe, Facebook and the other product names here are trade marks of their owners; CaptiFi is not affiliated with or endorsed by them.