---
title: "captive.apple.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/captive-apple-com"
description: "captive.apple.com is how Apple devices detect Wi-Fi sign-in pages on hotel and café networks. What it checks, and what breaks if you block it."
---

Core networking

# captive.apple.com

`captive.apple.com` lets Apple devices find out whether a network needs a sign-in page first. Apple lists it for “Internet connectivity validation for networks that use captive portals”.

Run by Apple · Ports: 443 and 80 TCP · Checked: 1 November 2026

## Short answer

Apple's internet connectivity check for networks with sign-in pages (captive portals). Kilobat uses it too.

Don’t block

Don't block it. The Mac can't tell that a hotel or café network wants a sign-in, so the sign-in window may never appear.

Matches

`captive.apple.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names `captive.apple.com` in its Device setup section, on ports 443 and 80, for every platform.

A network with a sign-in page answers the check with its own page instead. That is how the Mac knows to show the sign-in window.

Kilobat makes the same plain HTTP request to `captive.apple.com` and expects “Success”. It also tries Google's check page if Apple's doesn't answer.

## What breaks if you block it

Don’t block

Don't block it. The Mac can't tell that a hotel or café network wants a sign-in, so the sign-in window may never appear.

What breaks if you block it

- The sign-in window for hotel, café and airport Wi-Fi may not appear.
- The Mac may treat a working network as having no internet, or the other way round.
- Kilobat's Wi-Fi sign-in detection can't tell a sign-in page from an outage.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

If the sign-in window doesn't appear on a public network, see [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing).

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- [Apple Developer News: How to modernize your captive network](https://developer.apple.com/news/?id=q78sq5rv)
- [Kilobat: Hotel Wi-Fi login on Mac](https://kilobat.app/hotel-wifi-login-mac)

Checked on 1 November 2026.

## Related

- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing)
- [/hotel-wifi-login-mac](https://kilobat.app/hotel-wifi-login-mac)