# QR code blocked by corporate or guest WiFi

> Corporate and guest WiFi networks block QR destinations through captive portals, category filters, and newly-registered-domain rules: the code and the link are usually fine. Users should switch to mobile data; venue owners should host the destination on their own established domain and test it on the guest network itself.

Source: https://useqr.app/docs/troubleshooting/qr-code-blocked-by-corporate-wifi · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## The code is fine: the network is not

When a QR code works on mobile data but fails on the office or venue WiFi, the code has
already done its job: it decoded and handed the browser a URL. What blocks the page is one
of three network-side mechanisms.

**A captive portal that has not been accepted yet.** Until the user taps through the
terms-of-service page, the network intercepts every request. The QR destination either times
out or gets swallowed by the portal itself. This is routine on hotel and event guest
networks, and it also intercepts the first scan after joining WiFi from a
[WiFi QR code](/docs/troubleshooting/wifi-qr-code-not-connecting), which makes the WiFi code
look broken when it is not.

**A category filter.** Corporate firewalls classify every domain and block whole
categories. Two categories matter for QR codes: *URL shorteners*, which many organisations
block outright because [shortened links](/glossary/short-url) hide their destination, and
*uncategorised* or *newly registered domains*, a campaign microsite registered last week is
commonly blocked for its first ~30 days on default enterprise-firewall policies, exactly the
window in which your posters are up.

**DNS filtering.** The network's resolver returns nothing (or a block page) for domains on
its list. Symptom: the site fails on WiFi even after the portal is accepted, on every
device, but resolves normally on cellular.

## Guest VLANs are stricter than you think

Venue owners usually test on the staff network. The guest VLAN is a different network:
typically more aggressive filtering, client isolation, sometimes an allowlist rather than a
blocklist. A code that works at the front desk can fail at every table. **The only valid
test is a scan from a device on the guest VLAN itself**, with the captive portal freshly
accepted.

## If you are the person scanning

Turn WiFi off and scan again on mobile data. That is the entire diagnosis and, usually, the
fix. If it works on cellular, nothing is wrong with the code, the link, or your phone:
the network is filtering. If it fails on cellular too, the destination itself is down; see
[the dead-domain page](/docs/troubleshooting/qr-code-goes-to-a-dead-domain).

## If you own the venue or the campaign

- **Use your own established domain.** `menu.yourrestaurant.com` sails through category
  filters that block shorteners and week-old microsites. This also removes the
  [Safe Browsing risk](/docs/troubleshooting/qr-code-blocked-by-safe-browsing) that shared
  domains carry.
- **Skip the shortener entirely.** Encode the direct HTTPS URL. Static QR codes have no
  ongoing dependency, so the only reason to shorten is payload length, and a
  [denser code](/docs/troubleshooting/qr-code-too-dense-to-scan) is a better problem to
  solve by trimming the URL than by adding a blockable middleman.
- **Register the domain early.** If a launch involves a new domain, register it well before
  the print deadline so newly-registered-domain filters have expired by launch day.
- **Test on the guest network** before signing off print. Decode the code with our
  [scanner](/scan) to confirm the URL, then load that URL on a device on the guest VLAN.
- **Expect cellular anyway.** In practice many people scanning in [hotels](/qr-codes-for/hotels)
  and venues are on mobile data already, a lightweight destination page serves them better
  than any network fix.

## FAQ

### Why does my QR code work on mobile data but not on work WiFi?
The corporate firewall is filtering the destination: commonly because the domain is a URL shortener, is uncategorised, or was registered recently. The code and link are fine; the network is declining to serve them.

### Do corporate networks really block all URL shorteners?
Many block the entire shortener category by policy, because shortened links conceal their destination and are a common phishing vector. Encoding the direct URL on your own domain avoids the category completely.

### Why is my brand-new campaign domain blocked?
Enterprise firewalls commonly block newly registered domains for around their first 30 days, since fresh domains are heavily used in phishing. Register campaign domains well before printing, or host the destination on your established main domain.

### How should a venue test its QR codes?
On the guest network itself, not the staff one: join the guest VLAN, accept the captive portal, scan the printed code, and confirm the page loads. Guest VLANs run stricter filtering, so a staff-network test proves nothing.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate
- https://useqr.app/url