Wi-Fi says “No internet, secured”: connected to the router but nothing loads

The Wi-Fi icon in the taskbar has a small warning mark, and under the network name Windows says:

Connected, secured
No internet

(Windows 11 wording: "No internet, secured")

The PC has joined the wireless network and the password was accepted, which is what “secured” means. But the internet does not work: browsers time out and apps say they are offline. This article works out which part of the chain is broken and fixes it, from the gentlest step to the most disruptive.

Applies to: Windows 10 and Windows 11 on Wi-Fi (the same steps work for Ethernet with “Ethernet” in place of “Wi-Fi”). From step 4 onward, open Command Prompt as administrator: search for cmd, then Run as administrator.

What is going on

Joining Wi-Fi only gets you as far as the router. After that Windows needs an address and a route (from DHCP, the Dynamic Host Configuration Protocol), and it needs DNS (the Domain Name System, which turns names such as microsoft.com into addresses) to find anything. On top of that, Windows runs its own check on whether the internet is really reachable, called the Network Connectivity Status Indicator (NCSI). The “No internet” label comes from that check, not from the Wi-Fi link.

On Windows 10 and later, NCSI looks up www.msftconnecttest.com, then fetches http://www.msftconnecttest.com/connecttest.txt over plain HTTP and expects to read the text Microsoft Connect Test. It also looks up dns.msftncsi.com. If any of these fails, the warning icon appears. Microsoft is clear that NCSI failing does not always mean the internet is down: a proxy, a firewall or a captive portal can fail the check on a connection that mostly works. So the label is a hint, and you should test the connection yourself.

Diagnosis

1. Is it only this PC?

Try a phone or another laptop on the same Wi-Fi. If they have no internet either, nothing on this PC is wrong. Restart the router (unplug it for 30 seconds) and check the provider’s status. If only this PC is affected, carry on.

2. What address did Windows get?

ipconfig /all

Find the section for Wireless LAN adapter Wi-Fi and read these lines:

• IPv4 Address starting 169.254 (often shown as “Autoconfiguration IPv4 Address”): Windows asked for an address and nobody answered, so it gave itself one from the link-local range reserved for exactly this case (APIPA, Automatic Private IP Addressing). That address only works on the same local segment. Cause: no DHCP. The router’s DHCP service is off or full, the Wi-Fi is a guest network with a restriction, or a security feature is blocking the request.
• A normal address (such as 192.168.1.x or 10.x.x.x) but an empty Default Gateway: the lease is incomplete or damaged, or a static address was set without a gateway. Cause: no route out.
• Address and Default Gateway present, but DNS Servers empty or wrong: cause: DNS.
• All three look fine: the problem is further out: a captive portal, a VPN, a proxy or a firewall.

3. Test each layer, nearest first

ping <your default gateway>
ping 1.1.1.1
nslookup www.msftconnecttest.com

Replace the first line with the Default Gateway address from ipconfig. Some routers and corporate networks refuse ping, so a failed ping is a clue, not proof. Read the three results together:

• The gateway does not answer: the link to the router is bad (weak signal, a bad lease, or the wrong subnet). Go to fixes 1 to 3.
• The gateway answers, and 1.1.1.1 does not: the router is up but has no internet, or a firewall or VPN is blocking traffic. Check the router, then fixes 5 and 6.
• 1.1.1.1 answers, but nslookup fails: traffic flows but names do not resolve. Cause: DNS. Go to fix 4.
• All three work: the internet is fine and NCSI is being fooled by a proxy, a captive portal or a VPN. Carry on to the next check.

4. Captive portal? Ask NCSI directly

Hotels, airports, cafes and some offices make you accept terms or log in before they allow internet access. Until you do, they answer every web request with their own page, so NCSI never gets “Microsoft Connect Test” back and reports “No internet”. Open a browser and go to this plain-HTTP address (it has to be http, not https):

http://www.msftconnecttest.com/connecttest.txt

• You see the text Microsoft Connect Test: the internet is reachable, and the warning is stale or caused by something else, such as a VPN or a proxy.
• You are redirected to a sign-in or terms page: it is a captive portal. Complete the sign-in. Windows normally shows a “Sign in to network” prompt too.
• The page will not load at all: the web layer is blocked. Carry on.

You can also ask Windows what it thinks. In PowerShell, Get-NetConnectionProfile shows IPv4Connectivity: Internet means NCSI is happy, while LocalNetwork or NoTraffic means it is not.

5. VPN software, past or present

A VPN client (current or half-removed) can install a driver that sits on every network adapter and filter its traffic. If it is broken, it can drop packets or DNS queries while the Wi-Fi shows connected. Disconnect any VPN and test again. Then press Win + R, type ncpa.cpl, right-click the Wi-Fi adapter, choose Properties and read the list of items. A filter or miniport entry from VPN or security software that you removed long ago is a suspect. Clear the tick, or reinstall and then properly remove that software. Note it, because you may need it back.

Root cause

One of five things, and the checks above tell you which: no DHCP address (169.254), no default gateway, DNS not working, a captive portal that has not been signed into, or a VPN or filter driver interfering with traffic. Rarely, the TCP/IP or Winsock settings in Windows are damaged, and a reset is needed. That is why it is the last step.

The fix

Go in this order. Each step is more disruptive than the one before. Stop when the internet works.

Fix 1: toggle, restart, rejoin

Turn Wi-Fi off and on (or use Airplane mode for ten seconds), then restart the PC. If that does not help: Settings > Network & internet > Wi-Fi > Manage known networks, choose Forget on the network, then join it again and re-enter the password. This clears a bad saved profile and costs nothing.

Fix 2: renew the DHCP lease

Ask the router for a fresh address. Use the adapter name that ipconfig shows (usually Wi-Fi):

ipconfig /release "Wi-Fi"
ipconfig /renew "Wi-Fi"

/release drops your address, so the connection goes down for a moment. If you are connected to this PC remotely, do not run it. Without an adapter name, it applies to all adapters. If /renew comes back with an error that the DHCP server cannot be contacted, the problem is the router or network, not this PC. Check that DHCP is on in the router, and that the network is not full.

Fix 3: restart the adapter

In Settings > Network & internet > Advanced network settings, disable the Wi-Fi adapter and enable it again. If it started after a Windows or driver update, install the latest Wi-Fi driver from the PC maker’s support page rather than a generic one from Windows Update. Roll back the driver in Device Manager if the problem began with a driver update.

Fix 4: DNS

ipconfig /flushdns

This clears the DNS cache and is harmless. If name lookups still fail while pinging 1.1.1.1 works, set DNS by hand for a test. In Settings > Network & internet > Wi-Fi > your network > DNS server assignment > Edit, choose Manual, and enter your router’s address or a public DNS server. If that fixes it, the router’s DNS is at fault. On a work network, ask IT before you change it: your organisation may require its own DNS servers.

Fix 5: remove the VPN or filter in the way

Disconnect the VPN. If the internet comes back, update the VPN client or remove it properly using its own uninstaller, then restart. Removing a leftover filter item in the adapter properties (see Diagnosis step 5) is the manual version.

Fix 6: reset Winsock and the TCP/IP stack (last resort)

This is the heavy one. It needs a restart. netsh int ip reset rewrites the TCP/IP and DHCP settings in the registry, which Microsoft says has the same effect as removing and reinstalling TCP/IP. It also wipes any static IP address, gateway and DNS you set by hand, and the PC goes back to automatic. If this is a server, a printer-attached PC or anything with a fixed address, save the settings first, and do not run it over a remote session you cannot afford to lose.

netsh -c interface dump > %USERPROFILE%\netconfig.txt
netsh winsock reset
netsh int ip reset

Restart the PC. The first command saves your current network settings to a file; Microsoft’s TCP/IP guidance uses this to restore them afterwards. If you had a static address, put it back after the restart, either by hand or with:

netsh -f %USERPROFILE%\netconfig.txt

The restore works only if the adapter names have not changed. Winsock is the layer that applications use to open network connections, and its reset removes any third-party layers added to it by VPN, proxy or security software. Programs may need reinstalling if they depended on one.

Windows also has a Network reset button under Settings > Network & internet > Advanced network settings. It reinstalls all network adapters and resets networking to defaults, so VPN and virtual adapters will need setting up again. Use it only after everything above has failed.

Verification

• The Wi-Fi icon has no warning mark, and the network no longer says “No internet”.
• ipconfig /all shows a normal address (not 169.254), a Default Gateway and DNS servers.
• http://www.msftconnecttest.com/connecttest.txt in a browser shows Microsoft Connect Test.
• In PowerShell, Get-NetConnectionProfile shows IPv4Connectivity : Internet.
• It still works after a restart and after you reconnect any VPN.

Notes

• Things not to do: do not buy a USB Wi-Fi adapter before you have read ipconfig /all. Do not turn off Windows Defender Firewall to “test”: it does not cause DHCP or gateway failures, and you will forget to turn it back on.
• “No internet” with a working browser usually means NCSI is blocked by a proxy or firewall that lets the browser through. Windows can be told to skip the probe, but that hides real problems, so it is better to make the probe addresses reachable.
• Corporate networks: if the PC uses a proxy, 802.1X sign-in or a company VPN, NCSI failures are often an IT policy matter. Microsoft’s NCSI guidance lists the probe addresses to allow through a proxy or firewall.
• Many devices at once: if every device on a network has the problem, look at the router, its DHCP pool size and the upstream link, not at the clients.

Still showing “No internet, secured”? Post the output of ipconfig /all (with any public addresses removed) and which of the three ping and nslookup tests passed in The Patch Panel. The best answer earns points on Top of the Stack.