QR code blocked by corporate or guest WiFi

The code is fine: the network is not

When a QR code works on mobile data but fails on the office or venue WiFi, the code has already done its job: it decoded and handed the browser a URL. What blocks the page is one of three network-side mechanisms.

A captive portal that has not been accepted yet. Until the user taps through the terms-of-service page, the network intercepts every request. The QR destination either times out or gets swallowed by the portal itself. This is routine on hotel and event guest networks, and it also intercepts the first scan after joining WiFi from a WiFi QR code, which makes the WiFi code look broken when it is not.

A category filter. Corporate firewalls classify every domain and block whole categories. Two categories matter for QR codes: URL shorteners, which many organisations block outright because shortened links hide their destination, and uncategorised or newly registered domains, a campaign microsite registered last week is commonly blocked for its first ~30 days on default enterprise-firewall policies, exactly the window in which your posters are up.

DNS filtering. The network's resolver returns nothing (or a block page) for domains on its list. Symptom: the site fails on WiFi even after the portal is accepted, on every device, but resolves normally on cellular.

Guest VLANs are stricter than you think

Venue owners usually test on the staff network. The guest VLAN is a different network: typically more aggressive filtering, client isolation, sometimes an allowlist rather than a blocklist. A code that works at the front desk can fail at every table. The only valid test is a scan from a device on the guest VLAN itself, with the captive portal freshly accepted.

If you are the person scanning

Turn WiFi off and scan again on mobile data. That is the entire diagnosis and, usually, the fix. If it works on cellular, nothing is wrong with the code, the link, or your phone: the network is filtering. If it fails on cellular too, the destination itself is down; see the dead-domain page.

If you own the venue or the campaign

• Use your own established domain. menu.yourrestaurant.com sails through category filters that block shorteners and week-old microsites. This also removes the Safe Browsing risk that shared domains carry.
• Skip the shortener entirely. Encode the direct HTTPS URL. Static QR codes have no ongoing dependency, so the only reason to shorten is payload length, and a denser code is a better problem to solve by trimming the URL than by adding a blockable middleman.
• Register the domain early. If a launch involves a new domain, register it well before the print deadline so newly-registered-domain filters have expired by launch day.
• Test on the guest network before signing off print. Decode the code with our scanner to confirm the URL, then load that URL on a device on the guest VLAN.
• Expect cellular anyway. In practice many people scanning in hotels and venues are on mobile data already, a lightweight destination page serves them better than any network fix.

FAQ

Why does my QR code work on mobile data but not on work WiFi?

The corporate firewall is filtering the destination: commonly because the domain is a URL shortener, is uncategorised, or was registered recently. The code and link are fine; the network is declining to serve them.

Do corporate networks really block all URL shorteners?

Many block the entire shortener category by policy, because shortened links conceal their destination and are a common phishing vector. Encoding the direct URL on your own domain avoids the category completely.

Why is my brand-new campaign domain blocked?

Enterprise firewalls commonly block newly registered domains for around their first 30 days, since fresh domains are heavily used in phishing. Register campaign domains well before printing, or host the destination on your established main domain.

How should a venue test its QR codes?

On the guest network itself, not the staff one: join the guest VLAN, accept the captive portal, scan the printed code, and confirm the page loads. Guest VLANs run stricter filtering, so a staff-network test proves nothing.