What is Walled Garden?

Definition

A walled garden is the list of domains and addresses a captive portal permits an unauthenticated device to reach before login. It exists so the portal page, its assets, and any login or payment services it depends on can load, while everything else stays blocked until the guest completes authentication.

Why an allow-list is unavoidable

A pre-login device is in a deny-all state, but the login page itself has to load from somewhere. If the portal is hosted externally, its domain must be reachable, and so must every third party the page calls: fonts, scripts, images, analytics, an identity provider used for social login, and a payment processor if access is paid. Each of those is a separate hostname, and missing even one produces a page that half renders and never completes. The walled garden is the mechanism that carves out those specific exceptions.

Keeping it tight

Every entry in the walled garden is free internet access for anyone who knows how to use it, so the list should be as small as the portal genuinely requires. Two habits keep it manageable: self-host portal assets where practical so there are fewer external hostnames to allow, and defer analytics and non-essential scripts until after authorisation rather than allow-listing them. Avoid broad wildcards for large hosting providers, which effectively opens a very large slice of the internet. Review the list whenever the portal changes, because a new integration usually means a new hostname.

Debugging a portal that will not load

When a splash page hangs or renders without styling, the walled garden is the first suspect. Load the portal URL from an unauthenticated device and watch which requests fail; each failed hostname is a missing entry. Certificate-pinned services and identity providers that redirect across several domains are frequent culprits, because allowing the first domain is not enough. Keep a documented list of required hostnames alongside the portal configuration so a hardware swap or new site does not turn into a rediscovery exercise.

More in Networking