Captivo Portal changelog — 2026 · Page 10 of 12

New

• Connect to the 802.1X network with a corporate (AD/LDAP) account (on-premise): your employees can now join the corporate wired/wireless 802.1X network directly with their domain username and password — no separate 802.1X password to define. Devices use the EAP-TTLS (PAP) method, supported on Windows, macOS, iOS, Android and Linux. Turn on 'Directory (AD/LDAP) login' under Settings → 802.1X; optionally route directory users to a dedicated VLAN. Local 802.1X users and existing EAP-PEAP connections keep working as before. Passwords are never stored in Captivo; verification happens directly against your directory server, and access is denied if the directory server is unreachable.

New

• Active Directory / LDAP employee login (on-premise): your employees can now sign in to the guest wifi portal with their corporate (domain) username and password — no separate wifi password needed. Enter your server details under Settings → Directory (AD/LDAP), try 'Connection test' and enable it. Optionally restrict login to a single group (e.g. Staff). Passwords are never stored in Captivo; verification happens directly against your directory server. Note: for downloaded portals (pfSense/OPNsense/MikroTik), re-download and re-upload the portal after enabling the feature.

New

• 802.1X Enterprise Network Access (on-premise): username/password, port-based network access control for your corporate wired and wireless network (WPA2/WPA3-Enterprise, EAP-PEAP-MSCHAPv2). Define 802.1X users and groups from the panel and register your switches/access points; users connect with the built-in 802.1X client on Windows, macOS, iOS and Android. Includes group-based automatic VLAN assignment (a user lands on the VLAN of their group), a 15-minute account lockout after 5 failed attempts, and a log of every login attempt. MAC-Bypass lets you admit devices that don't support 802.1X (e.g. printers, IP cameras) by MAC address. To set it up, follow Settings → 802.1X and the CA certificate download step.

Fixes

• Fixed the downloadable portal (accordion view) where, after requesting a code via SMS/email, other sections (e.g. Voucher) opened empty. Sections now show their form when expanded. Re-download the portal from the panel and re-upload it to get the fix.

Fixes

• Fixed the downloadable portal on MikroTik where menus wouldn't expand and the SMS code step didn't work (entering a number and tapping 'Get Code' reset to the start). Re-download the portal from the panel and re-upload it to MikroTik to get the fix.

New

• Webhook session events: the 'session.started' and 'session.ended' events are now delivered from real RADIUS accounting data. If you have a webhook endpoint subscribed to these events (e.g. Slack, automation), you'll be notified when a guest connects and disconnects — the end event also includes session duration and data usage. (RADIUS Accounting must be enabled on the NAS.)

New

• UniFi direct connection (on-premise): you can now connect to your Ubiquiti UniFi controller directly, without a separate connector agent. Once a guest verifies on the portal, Captivo authorizes the device on the controller. Enter the URL, username and password under Settings → UniFi Controller and try it with 'Test connection'.

New

• SIEM Forwarding (on-premise): send your audit logs — login attempts, setting changes, MFA resets, deletions, etc. — to security systems like Splunk, IBM QRadar, Microsoft Sentinel or Wazuh as CEF or RFC 5424 syslog (UDP/TCP). Configure under Settings → Log Server → SIEM and try it with 'Send test'.

Improvements

• You can now set an Idle Timeout on guest profiles (Settings → Profiles). Sessions that exchange no data for the chosen period are dropped automatically; options are Off, Default (5 min), 15 min, 30 min and 1 hour.
• The Mobile Preview on the portal settings page now renders the portal at true phone size — elements that previously looked oversized or overflowed the frame are fixed.

Fixes

• Fixed some icons on the documentation page becoming invisible on hover in light theme.

New

• VPN MFA (Beta): add a second factor (SMS or authenticator app / TOTP) to your FortiGate SSL-VPN logins. Set up your gateway and users under Settings → VPN MFA; end users need no extra app — the code is prompted right in the FortiClient login screen.

New

• The 5651 Log Server now auto-detects and parses firewall logs from FortiGate, Cisco Meraki, UniFi and Ruijie (in addition to pfSense/OPNsense and MikroTik).
• Added a Reports page to the 5651 Log Server: summary stats, top source/destination IPs, a daily events chart, allow/deny breakdown, and CSV export.
• Log search is more powerful: filters for source, destination IP, protocol, port, action and guest (phone/MAC), plus pagination and CSV export.
• Log sources can now be disabled/enabled or permanently deleted from the interface.

Improvements

• When started before setup is finished, the on-premise log collector now waits for setup to complete instead of restart-looping.

Fixes

• The 5651 Log Server showed an empty signature row on the Archive page right after installation; only days that actually contain logs are signed now.
• Some steps of the on-premise setup wizard (notably Sign-in Methods) didn't render correctly in dark mode; fixed.

Fixes

• The theme switcher (Light / Dark / System) showed Turkish labels even when the interface was in English. Fixed — it now follows the selected language.
• In branding settings, uploading a logo from your computer left the Save button blocked with a "please enter a URL" warning. Fixed; the uploaded logo now saves correctly.
• In RADIUS settings, turning off NAS-Identifier verification with "Disable" didn't persist — reloading the page showed it active again. Fixed; it now stays disabled.

Fixes

• On the portal sign-in page you couldn't type into the phone number field — digits were erased as you typed. Fixed. The same bug also blocked SMS sign-in, which now works again.
• On portals using the accordion layout, sections wouldn't expand when their headers were clicked (the terms/consent box was affected too). Fixed.

New

• Captive portal support for Ruijie / Reyee EG gateways (Beta). Point the EG gateway's external portal at your Captivo portal address; guests connect via SMS/email/voucher and are authenticated through Captivo RADIUS — no HTML upload to the device needed. See Docs → Ruijie Setup for the steps.

Improvements

• On the Sessions page, manually-created local user (WiFi account) rows are now shown unmasked — these are accounts you created, not personal data collected from a guest. Guest (SMS/email/sponsor) and hotel/PMS rows remain subject to your privacy setting (Open Data Display), as they are personal data.

Fixes

• On setups where the downloaded templates (pfSense/OPNsense/MikroTik/FortiGate/Meraki) run on your own device, local-user sign-ins from a phone could not record device/OS info on iOS (the info sent at sign-in time was cancelled when the captive-portal window closed). It is now sent as soon as the username is entered (before sign-in completes), and includes browser info too, so iOS sign-ins show correctly in analytics.

Fixes

• When signing in from a phone with a local user (WiFi account), the device/OS info was sometimes not recorded at all (especially when iOS captive-portal requests send an empty User-Agent header); the browser-computed device type is now used as a fallback, so iOS/Android sign-ins show correctly in analytics. (SMS/email sign-ins already worked.)

Improvements

• The local-user/sponsor import template now downloads in your interface language (English column headers in English UI). Import still accepts headers in either language.

Fixes

• When the portal was in English, the sign-in note ("…you can get one from the Şifre Al tab") kept the tab name in Turkish; it now uses the English label (across preview, live page, and downloaded templates).
• On the Logs page, the pagination looked dark in light theme and its button labels stayed Turkish on the English page; fixed.
• Some audit-log rows appeared in Turkish on the English page (admin "log in as" entries, voucher batch "1 adet"); the English translation is now complete.

Improvements

• Simplified the portal appearance settings: controls are now split into three clear tiers — "Structural Style", "Visual Effects", and (collapsed by default) "Advanced: Custom CSS".
• In Branding settings, the logo, dark-mode logo, and favicon can now be uploaded directly from your computer (no need to paste a URL). Added a note clarifying these images brand only your own dashboard.

New

• Added import/export to the Local Users and Sponsors pages: download a template, bulk-add from CSV, and export the current list as CSV.

Improvements

• On local-user import, each row gets an auto-generated WiFi username (if left blank) and password, and a RADIUS account is created; export includes the username + password (for distribution).

Improvements

• Enriched the local user (WiFi account) detail page: added daily-usage and hourly-distribution charts, matching the guest detail page.
• Simplified guest import: replaced two near-identical import buttons with a single (server-validated, plan-limited, preview-based) Bulk CSV flow.

Fixes

• On the local user detail page, sessions not properly closed by the network device (zombie sessions) were wrongly shown as "Active"; they now show as "Disconnected", consistent with the Sessions page.

Improvements

• The mobile preview in portal settings is now a bit wider — the form is easier to read.
• Simplified the "Visual Effects" section: removed toggles that duplicated separate settings (Rounded Buttons, Card Shadow, Compact Form). The remaining Gradient Background, Blur, and Large Logo effects now work as proper structured settings without cluttering the Custom CSS box (your existing choices migrate automatically).

Fixes

• Security (platform admin): closed a hole where invalid values in the Analytics ID fields (GA/GTM/Facebook Pixel/Clarity) could inject scripts into the public site (the fields are now strictly validated and safely emitted). Also added server-side range validation to the security-policy numeric settings.

Fixes

• Security (platform admin): hardened the admin "log in as" (impersonation) feature — a de-privileged admin can no longer start a new impersonation with an old session, and you can no longer impersonate a deactivated account/tenant. Also closed a point where admin-only system health data could be accessed without authorization.

Fixes

• Guests who entered their phone number in different formats (with a leading 00, +90, or 0) could be recorded as multiple separate people; they are now treated as a single record. Sponsor sign-in now also accepts international numbers (previously rejected).
• A hotel (PMS) room's simultaneous-device limit could be exceeded under concurrent connections; fixed.
• Security: added a daily limit to sending passwords by email and a per-device limit to sends, preventing abuse and unnecessary cost.