How to Hide Wi-Fi Network in Windows with WLAN Filters (Blacklist and Whitelist)

By default, Windows displays the names (SSIDs) of all available Wi-Fi networks within range of the wireless adapter. Windows administrators can hide specific SSIDs from the list of available wireless networks or, conversely, allow connections only to approved Wi‑Fi networks while blocking all others. In this article, we’ll show you how to configure Wi-Fi allowlists and blocklists in Windows using the built-in WLAN filtering feature.

The built-in netsh console command is used to manage wireless network filters. Open a command prompt or PowerShell as an administrator (elevated permissions are required to modify WLAN filters).

To view the Wi-Fi networks currently discovered by the wireless adapter, run:

netsh wlan show networks

Interface name: Wi-Fi
Network shell commands need location permission to access WLAN information. Turn on Location services on the Location page in Privacy & security settings.
Here is the URI for the Location page in the Settings app:ms-settings:privacy-location
To open the Location page in the Settings app, hold down the Ctrl key and select the link, or run the following command:start ms-settings:privacy-location
Or, to open the Location page from the Run dialog box, press Windows logo key + R, and then copy and paste the URI above.
Access is denied.

To show additional information about available Wi-Fi networks, such as signal strength, supported protocols, authentication type, and encryption, run the command:

netsh wlan show networks mode=bssid

The WLAN AutoConfig service (wlansvc) is responsible for discovering and listing the available wireless networks in Windows. This service also allows filtering which wireless networks are available for users to connect to.

Windows supports two WLAN filtering modes:

• Blocklist (blacklist) – the administrator defines which Wi-Fi network SSIDs should be hidden from the list of available networks. All other WLANs remain available.
• Allowlist (whitelist) – the administrator explicitly specifies the Wi-Fi networks that users are allowed to connect to. Access to all other wireless networks is denied.

To hide a single wireless network from the list of available networks, add its SSID to the blocklist using the following command:

netsh wlan add filter permission=block ssid="Netgear_7259" networktype=infrastructure

The wireless network with this SSID will not be visible in the list of available networks in Windows.

To allow connections only to certain Wi‑Fi network SSIDs, add them to a whitelist and deny connections to all other wireless networks

netsh wlan add filter permission=allow ssid="Xiaomi1234" networktype=infrastructure
netsh wlan add filter permission=denyall networktype=infrastructure

The list of available Wi-Fi networks will now contain only the networks that have been explicitly allowed.

By default, Windows users cannot see hidden Wi-Fi networks. You can change this behavior using the following command:
netsh wlan set blockednetworks display=show

Showing blocked networks in visible network list has been set to: show.

Windows will now display all detected Wi-Fi networks. Blocked networks will be marked with a cross (X) to indicate that connections to them are not permitted.

To hide blocked networks, change the value of the display option to hide (this is the default behavior).

List applied WLAN filters:

netsh wlan show filters

Remove a specific rule from the WLAN filters:

netsh wlan delete filter permission=allow ssid="Netgear_7259" networktype=infrastructure

To remove a blocking rule from the WLAN filters:

netsh wlan delete filter permission=denyall networktype=infrastructure

The built-in WLAN filtering feature in Windows should not be considered a reliable security mechanism for preventing users from connecting to untrusted wireless networks. The filter is based on the network’s SSID, so it can be easily bypassed if a user (or an attacker) renames an access point’s SSID to match an allowed network.