37

Captive Wi-Fi portals suck.

Often when I open a HTTP site in a browser (desktop Chrome or mobile Chrome), I get the captive portal, but with auto-completion and so quickly I connect again to Wi-Fi.

The problem is that after the captive portal redirects, I'll have also a HTTPS redirect and Chrome remembers the certificate and to use only HTTPS. So I cannot use the same site twice (in a session).

A well-known public HTTP only site will resolve this. Well-known sites usually work, causing less debugging of the Wi-Fi connection.

2
  • 1
    This question doesn’t only apply to Chrome. It applies to any browser respecting HTTP Strict Transport Security and affects many users in the modern world full of public portaled WiFi APs.
    – binki
    Aug 27, 2018 at 18:48
  • 1
    Try using neverssl.com
    – Worthwelle
    Jul 2, 2019 at 20:12

7 Answers 7

54

A well-known public HTTP only site will resolve this

You can use http://neverssl.com:

What?

This website is for when you try to open Facebook, Google, Amazon, etc on a wifi network, and nothing happens. Type "http://neverssl.com" into your browser's url bar, and you'll be able to log on.

How?

neverssl.com will never use SSL (also known as TLS). No encryption, no strong authentication, no HSTS, no HTTP/2.0, just plain old unencrypted HTTP and forever stuck in the dark ages of internet security.

Why?

Normally, that's a bad idea. You should always use SSL and secure encryption when possible. In fact, it's such a bad idea that most websites are now using https by default.

And that's great, but it also means that if you're relying on poorly-behaved wifi networks, it can be hard to get online. Secure browsers and websites using https make it impossible for those wifi networks to send you to a login or payment page. Basically, those networks can't tap into your connection just like attackers can't. Modern browsers are so good that they can remember when a website supports encryption and even if you type in the website name, they'll use https.

And if the network never redirects you to this page, well as you can see, you're not missing much.

5
  • 10
    Also: google.com/generate_204. It's recognized by chrome and is actually used to detect the captive portal in the first place. Works great.
    – GiantTree
    May 26, 2017 at 14:20
  • 1
    …except in networks which spoof replies to known captive-portal detection mechanisms. Yes, apparently people do that. :( May 27, 2017 at 18:09
  • 5
    A lot of times I use "captive.apple.com", which is what iOS looks for when it tries to detect a captive portal. I do this on my Linux-based laptop to get the captive portal login. Jan 23, 2018 at 17:19
  • 5
    neverssl.com now redirects to innermajesticgrandyawn.neverssl.com/online ...so I guess they should change their name?
    – Matt
    Dec 2, 2021 at 17:46
  • @Matt Neverssl now redirects to too many of such combinations to work around different set of issues. Updates here - neverssl.com/changes or here - web.archive.org/web/20211021035030/http://neverssl.com/changes for someone from future. This redirection is detailed under sub heading "Enhanced Cache-busting" Dec 10, 2021 at 10:20
8

These answers came from the comments and I believe they need a separate entry in the answers so they can be easily found.

http://google.com/generate_204

(from @GiantTree)

http://captive.apple.com/

(from Virtually Nick)

http://detectportal.firefox.com/success.txt

(added here because similarly used by a browser)

NeverSSL did not work in my ISP's captive portal but the one from Google did.

5

This website is for testing ssl: https://badssl.com/

It includes several subdomains that intentionally will never have ssl enabled, such as:

For some reason, when I tried http://neverssl.com, I was forwarded to a different website with SSL enabled: https://wholesilveryoungsecret.neverssl.com/online/. So it seems that it currently can't serve its one intended purpose.

badssl.com seems more reliable now.

2
3

Old thread, but here's another one: http://httpforever.com/

0

I use http://example.com (for manual occasional usage, nothing automated).

0

Well, why not this one:

I use this URL for all cases related to raw http protocol.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Oct 28, 2023 at 8:38
0

The World Famous A-List Celebrity website http://www.josephwcarrillo.com/ is proudly against the "s", as part of an Anti-Privacy campaign.

There is even a News Article about this http://www.josephwcarrillo.com/news/2023/12/24/alistcelebrityjosephcarrilloendorseshttp.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .