Captivo Portal changelog — 2026 · Page 11 of 12

Fixes

• Security: closed a gap in guest sign-in that allowed bypassing the attempt limit (by changing device/IP info) to brute-force the SMS password — a per-target-number overall attempt limit was added.
• Security: added an attempt rate limit to hotel (PMS) room-number + surname sign-in, preventing room/surname guessing (enumeration) attacks.

Fixes

• The username shown and auto-filled on the sign-in screen for guests who got a password by SMS could be wrong for some numbers (especially Turkish numbers), causing sign-in to fail; it now matches the SMS exactly.
• Phone numbers typed with a leading 0 were processed incorrectly (the SMS might not be sent); they are now handled correctly.
• On hotel (PMS) guest sign-in, the WiFi session expiry time could be computed in the wrong time zone; fixed.
• Security: prevented the same voucher code from being used beyond its usage limit via concurrent requests; the portal background image address is now strictly validated (code-injection protection); SMS/email verification codes are now generated with a cryptographically secure method.

Fixes

• Fixed some text that stayed Turkish when the portal language was English: the "Please wait..." button label, the SMS/email code validity duration ("15 minutes"), and some error messages now follow the selected language.
• On a portal with no redirect address configured, guests no longer end up on a blank screen after a successful sign-in; a clear "You're Connected" screen is now shown.
• Security: Prevented a forged redirect address appended to the captive-portal link from sending a guest to another site after login (phishing risk) — redirects now only go to a server-validated address.

Fixes

• The buttons in the portal settings preview now work: the TR/EN language switch, the tabs (Get Password / Sign In), and the accordion view are fully interactive in the preview.
• When email verification was enabled, the portal's "Get Password" tab showed the SMS form and the email form stacked on top of each other; now each tab shows only its relevant form.

Improvements

• The live portal now shows the new design: the page you open via "View Portal" (and the page guests reaching it via UniFi/redirect see) is now identical to the settings preview and the downloaded file — including bilingual support, the country picker, the confirmation dialog, and all design customizations.
• The settings preview is now fully interactive: the TR/EN language switch, the tabs (Get Password / Sign In), and the confirmation dialog now work in the preview (an issue preventing the preview from working was fixed).

New

• Guest portal is now bilingual: Guests can pick their language with the TR | EN switch at the top of the portal; it auto-selects based on the browser language. For texts like the welcome message and tab labels, you can enter an optional English version in Portal Settings (falls back to Turkish if left empty).
• All countries in the phone field: The mobile phone field now has a dropdown with every country's flag and dialing code (default 🇹🇷 +90). International numbers are supported (delivery depends on your SMS provider).
• Confirm the number before sending SMS: When a guest signs in with their mobile number, a confirmation dialog ("Will be sent to: … is it correct?") appears before the SMS is sent — preventing codes from reaching a wrong number.
• Broad design customization: 9 new controls were added to Portal Settings → Design — corner roundness, density (spacing), card shadow, font size, button style (solid/outline/gradient), input style, header alignment, card width, and animations on/off. All point-and-click, no code.

Improvements

• The settings preview is now exact: it shows the page guests actually see (identical to the downloaded portal HTML), and updates instantly as you change a setting — no save needed.

New

• NetGSM SMS balance: businesses using NetGSM can now view their remaining credit (TL) on Settings → SMS and set up a low-balance alert email — previously available only for İleti Merkezi.
• Bot protection (CAPTCHA) on the sign-up page: platform admins can enable Cloudflare Turnstile from Settings to add a CAPTCHA to the register page. It blocks fake and automated sign-ups; your site doesn't need to be behind Cloudflare — keys are entered from the panel.
• When your SMS provider isn't listed: Settings → SMS now shows a one-click link to the feedback page so you can request it.

Fixes

• Report CSV download: when there are no records in the selected date range, it now shows a "no records found — try the All time range" notice instead of downloading an empty file.
• Activity log (Settings → Logs): CSV export descriptions now appear in English when the language is set to English.
• Notification settings (Settings → Notifications): the "System" notification category now shows a proper title and description instead of a raw/untranslated key.

New

• FortiGate and Cisco Meraki support (Beta): you can now use Captivo with these two as well. Download the login page from Settings → Portal → Templates and add it to your device (FortiGate: Replacement Messages → Login Page; Meraki: Dashboard → SSID → Splash → custom splash). Guest verification runs over your existing RADIUS setup — same logic as pfSense/OPNsense. Step-by-step setup: /docs → FortiGate / Cisco Meraki Setup. Both are Beta: the template and RADIUS flow are ready; hardware verification is in progress (Meraki requires licensed hardware to test).

New

• Revamped notification preferences: Settings → Notifications is now a table — turn In-app (🔔), Mobile push (📱) and Email (✉️) on or off per notification type. The previous options were saved but never applied; now they're actually respected.
• Broader notifications: sponsor requests (created, approved, rejected), feedback replies, security events (enabling/disabling two-factor authentication, password reset) and low SMS balance now reach you on the channels you chose. Sponsor notifications also arrive as instant push on the mobile app.

Improvements

• The mobile app's notification settings now use the same channel table (with the app's new version).
• Settings → Portal → Templates: real product logos on the pfSense, OPNsense and MikroTik cards; UniFi now shows an info card linking to the Connector instead of a download.

Fixes

• The activity log (Settings → Logs) now shows descriptions in English when the language is set to English.
• The sidebar keeps its scroll position when you navigate to a page from a long menu.

New

• UniFi (Ubiquiti) support — Beta: you can now use Captivo with UniFi controllers too. From Settings → Connector, install a small bridge agent on your network and verify guests on your UniFi WiFi with a branded portal and SMS. The agent only connects outbound; your UniFi admin credentials stay on your network and are never sent to the cloud. (Initial release — Beta.)

Improvements

• Added CHAP (more secure password verification) support to MikroTik Hotspot login, verified on real hardware. The MikroTik integration is now fully supported — like pfSense and OPNsense. Existing PAP login keeps working unchanged.

New

• MikroTik Hotspot support (initial release): download a branded MikroTik login page package (ZIP) from Settings → Portal. Step-by-step setup — RADIUS, Walled Garden, uploading the template and NAS-Identifier — is in /docs → MikroTik Setup. This first release uses the PAP method and should be tested on your own device.

Improvements

• Speed limits now cover MikroTik too: alongside pfSense's WISPr value, each session also carries MikroTik's own rate-limit attribute (each device reads the one it understands).
• The NAS-Identifier (extra isolation) note on the RADIUS settings page now covers all supported devices (pfSense, OPNsense, MikroTik) and clarifies that it's optional.

Fixes

• Leading/trailing spaces in the company name are now trimmed automatically during sign-up.

New

• iOS management app is live: with Captivo Admin you can manage your guests, sessions, vouchers and reports right from your iPhone. It's on the App Store as "Captivo Admin", and we've added a download link and QR code to the footer of our website.

Improvements

• Clicking a notification in the panel now takes you straight to the relevant page (e.g. a new sponsor-request notification → the requests page). The inline icon on notifications was removed for a cleaner look.
• Added a sample CSV download link to the bulk guest import page.

Fixes

• Fixed Turkish text remaining in the English interface: the Activity Log (Settings → Logs), Sponsor Requests, the dashboard RADIUS monitoring activity, bulk guest import and notifications are now fully shown in the selected language.

Improvements

• Branding settings now work fully: font choices are applied, buttons use your chosen primary brand color, and the favicon is reflected in the panel.
• Dark/light theme support added to the login, register and legal (privacy/terms) pages, with a theme switch button on the sign-in screens.
• All fields of the feedback form are now shown in English too.
• Added explanatory notes about the API key and Portal URL on the RADIUS settings page.
• On the dark sidebar theme, the business name and email at the bottom-left are now clearly readable.

Fixes

• Visitor analytics (Google Analytics) data is being collected again — it had stopped after a security update.

Improvements

• The Documentation page is now fully available in English: the pfSense/OPNsense setup guides and the RADIUS, SMS and Webhook sections follow your language preference (Turkish or English).
• The email verification screen now reminds you that the code may take a few minutes to arrive and to check your Spam/Junk folder if you don't see it.

New

• Setup guide for new businesses: a progress checklist on the dashboard showing the steps to launch your portal (portal appearance, SMS, firewall connection, first guest). It disappears automatically once setup is complete.

Fixes

• SMS settings: balance lookup and test SMS sending now work (they previously failed due to incorrect authentication).
• SMS settings: prevented the browser from accidentally autofilling your login credentials (email/password) into the API key and secret fields.

New

• Scheduled reports can now be sent in PDF and Excel formats in addition to CSV. Choose your preferred format when creating or editing a report.

Improvements

• Security: Authorization checks were tightened — guest, session, voucher, sponsor, webhook, template, reporting and user-management actions are now also verified server-side according to your role (unauthorized calls are rejected even when hidden in the interface).

Improvements

• Security: Brute-force protection was added to two-factor authentication (2FA) code entry — after 5 consecutive wrong codes the account is temporarily locked for 15 minutes, then unlocks automatically. There is no permanent lock; the counter resets önce a correct code is entered.

Improvements

• Güvenlik: SMS sağlayıcı bilgileriniz (API anahtarı ve gizli anahtar) artık veritabanında şifreli olarak saklanıyor.
• Güvenlik: SMS, RADIUS, SMTP ve marka/görünüm ayarları yalnızca yönetici yetkisine sahip kullanıcılar tarafından değiştirilebiliyor (sunucu tarafı kontrol eklendi).

Fixes

• Güvenlik: Şifre sıfırlama bağlantısı artık tek kullanımlık — bir kez kullanıldıktan veya şifre değiştirildikten sonra eski bağlantı geçersiz oluyor.
• Güvenlik: Giriş ekranında, yanlış şifreyle bir hesabın varlığının anlaşılmasına ve gereksiz e-posta gönderimine yol açan açık kapatıldı.
• Güvenlik: Misafir verisi dışa aktarma / silme / anonimleştirme işlemlerinde yetki kontrolü sıkılaştırıldı.

Fixes

• Canlı portal: SMS gönderildikten sonra açılan başarı ekranındaki 'Şimdi Giriş Yap' butonu çalışmıyordu, kullanıcı tekrar başarı ekranına dönüyordu; düzeltildi, artık giriş bölümüne geçiyor.
• İndirilen şablon: SMS başarı ekranında 'Geçerlilik 3600 dakika' gibi yanlış değer görünüyordu; doğru dakika değeri gösteriliyor.
• İndirilen şablon: 'Giriş Yap' formunda SMS ile alınan telefon ve şifre ile bağlanmaya çalışıldığında sessizce başarısız oluyordu; misafirin yazdığı bilgi artık doğru biçimde gönderiliyor ve giriş yapılabiliyor.

Improvements

• Portal şablonları (pfSense/OPNsense): 'Görsel Efektler' özelliklerinden Kart Gölgesi, Gradient Arkaplan ve Cam Efekti artık indirilen şablonda da önizleme ile aynı şekilde çalışıyor.
• Portal şablonları: Otel misafir girişi formunda oda numarası alanının ikonu otel binası olarak güncellendi (önceden kilit ikonu görünüyor, şifre alanı izlenimi veriyordu).
• Portal şablonları: Karanlık tema seçildiğinde başarı ekranının onay ikonu uygun arka plan ve renk ile gösteriliyor (önceden açık yeşil sabitti).

Fixes

• Portal şablonları: İndirilen sayfada logo görseli olduğundan çok büyük görünüyordu; misafire artık önizleme ile aynı boyutta gösteriliyor.
• Portal şablonları: Logo yüklenmediğinde misafire gösterilecek tenant baş harfi (yuvarlak rozet) artık doğru görünüyor; önceden hiç çıkmıyordu.
• Portal şablonları: 'Giriş Yap' formunda 'Kullanıcı Adı' yazı kutusunun metni soldaki ikonun üstüne biniyordu; düzeltildi.
• Portal şablonları: Hata uyarı kutusundaki ünlem (!) ikonu çok büyük görünüyordu; uygun boyuta getirildi.
• Portal şablonları: İndirilen sayfada SMS, E-posta, Otel ve Sponsor formları çalışmıyor, 'Failed to fetch' hatası veriyordu; düzeltildi. **Önemli**: Şablon indirebilmek için artık önce RADIUS Ayarları'ndan bir API Anahtarı oluşturmanız gerekiyor; oluşturmadan indirmeye çalışırsanız uyarı çıkar. Ayrıca Sponsor isteği gönderimi indirilen sayfada ilk defa çalışıyor.
• Portal şablonları: Akordiyon görünümde her bölümün başındaki aç/kapa oku ve bölüm ikonları aşırı büyük çıkıyordu; uygun boyuta getirildi.
• Canlı portal (Akordiyon görünüm) — SMS: Telefon numarası girip 'Kabul ediyorum' kutucuğunu işaretlediğinizde numara siliniyordu; düzeltildi.
• Canlı portal (Akordiyon görünüm) — Kullanıcı Girişi: Kullanıcı adı ve giriş kodu yazma kutularında her karaktere bastığınızda odak kaybediyor, tekrar tıklamanız gerekiyordu; düzeltildi.
• Tüm tenant'lar şu an ücretsiz kullanır. Trial süresi dolmuş hesaplara gösterilen 'Aboneliğiniz aktif değil' engellemesi kaldırıldı.

Improvements

• Portal ayarları > Tasarım: Önizleme paneli sayfa aşağı kaydırıldıkça da görünür kalıyor (sticky), değişikliklerin etkisi anında görünüyor.
• Portal ayarları > Tasarım: Masaüstü önizlemesi artık modal pencerede açılıyor — değişiklik sırasında dikkat dağıtmıyor, ihtiyaç olunca tıkla-aç.
• Portal ayarları > Tasarım: Mobil önizleme telefon çerçevesi biraz büyütüldü ve sabit yüksekliğe alındı — kısa içerikte 'küçük telefon' görünmüyor, uzun içerikte ise telefonun kendi içinde kayma çıkıyor.