Does anyone know how the hotspot portal works if the Guest connects via an AP and not directly to the router? I have my guest network on LAN 2 and tried using that alone in the portal config but I was able to connect directly to the router via wifi with no "portal intervention". To get the latter I have to put in the router wifi SSIDs. That's all very well but what happens if someone tries to connect via an AP?

Also, what is one supposed to do about security on the guest SSID? Just disable it or what?

The guides are not very helpful on these points/

It should - the Hotspot Web Portal is designed to work with LAN clients and access points, but you need to make sure that the Hotspot Portal's profile is applied to that LAN/VLAN.

I've been experimenting with various options and in the first instance connected via the router only. I was hoping to use the "PIN via SMS" option but in marked contrast to the impression given in this guide - https://www.draytek.co.uk/information/our-technology/hotspot-portal - where the "login" page appears to fill the full screen of a phone, when I try this with an iPhone X the text on the portal screen is so ridiculously small that it is effectively unusable. Even my normal reading glasses will not resolve it, I had to resort to a magnifying glass - not very "guest friendly"!

I don't think I'll bother, it's not worth the hassle. (Using a 2926ac by the way).