One-click industry presets<\/strong><\/p>\n\nSalon\/Spa, Clinic\/Medical, Fitness\/Yoga, Tutoring, Consulting, Home Services \u2014 each applies a tuned design, brand color, and scheduling defaults (slot interval, notice window, booking horizon). Everything stays editable.<\/p>\n\n
Elementor widget<\/strong><\/p>\n\nDrag-and-drop the Bookingistic Form widget with live controls for service, template, and calendar view. (Appears automatically when Elementor is active.)<\/p>\n\n
Real scheduling engine<\/strong><\/p>\n\n\n- Services with duration, buffers, price, category, manual\/auto confirmation<\/li>\n
- Staff with per-day working hours, days off, holidays, daily booking limits<\/li>\n
- Double-booking guard, min-notice, max-advance window, slot interval<\/li>\n
- Timezone-aware: slots render in the visitor's timezone<\/li>\n
- Cancel & reschedule via signed, expiring links \u2014 no account needed<\/li>\n<\/ul>\n\n
Google Calendar<\/strong><\/p>\n\n\n- Free on every site: .ics attachments + one-click \"Add to Google Calendar\" links<\/li>\n
- Two-way sync (bring your own free Google OAuth client): confirmed bookings push to each staff member's calendar, and their external events automatically block booking slots. Refreshed every 15 minutes.<\/li>\n<\/ul>\n\n
Email automation<\/strong><\/p>\n\nBranded HTML confirmations, reminders (hourly cron), cancellation and reschedule notices. Automation rules fire on booking events; every send is logged. Site owners can add their own custom footer text under Settings.<\/p>\n\n
Payments (bring your own gateway)<\/strong><\/p>\n\n\n- Paid services collect payment through a WooCommerce order per booking \u2014 customers pay with any payment method WooCommerce already supports, and payment status flows back to the booking automatically (paid \u2192 booking confirmed).<\/li>\n
- Payment ledger: every attempt (pending, paid, refunded, failed) is logged under Bookingistic \u2192 Payments.<\/li>\n
- Developer gateways: plug additional providers into the
bookingistic_payment_gateways<\/code> filter \u2014 no core billing decision is hard-coded.<\/li>\n<\/ul>\n\nDeveloper-friendly<\/strong><\/p>\n\n\n- REST API at
\/wp-json\/bookingistic\/v1\/<\/code> (services, staff, availability, bookings)<\/li>\n- Actions & filters:
bookingistic_booking_confirmed<\/code>, bookingistic_available_slots<\/code>, bookingistic_external_busy_intervals<\/code>, bookingistic_can_remove_branding<\/code>, and more<\/li>\n- Clean custom tables; opt-in data removal on uninstall (
BOOKINGISTIC_DELETE_DATA<\/code>)<\/li>\n- Backward compatible with the v1
wpistic_booking<\/code> CPT and legacy REST route<\/li>\n<\/ul>\n\nShortcode<\/h4>\n\n[bookingistic service=\"strategy-call\"]\n[bookingistic service_id=\"1\"]\n[bookingistic template=\"split\" calendar_view=\"pills\"]\n<\/code><\/pre>\n\nREST API<\/h4>\n\nGET \/wp-json\/bookingistic\/v1\/services\nGET \/wp-json\/bookingistic\/v1\/availability?service_id=N&date=YYYY-MM-DD\nPOST \/wp-json\/bookingistic\/v1\/bookings\nPOST \/wp-json\/bookingistic\/v1\/bookings\/{id}\/reschedule\nGET \/wp-json\/bookingistic\/v1\/payments\nGET \/wp-json\/bookingistic\/v1\/payments\/gateways\n<\/code><\/pre>\n\nExternal services<\/h3>\n\n
Google Calendar (optional, per staff member)<\/strong><\/p>\n\nThis plugin can connect to Google Calendar so each staff member can two-way sync their bookings. Nothing is sent to Google until a staff member explicitly clicks \"Connect Google Calendar\" in the staff editor and authorizes access with their own free Google OAuth client.<\/p>\n\n
\n- What it is used for: pushing confirmed bookings to the connected Google Calendar, and reading that calendar's free\/busy blocks so external events block booking slots.<\/li>\n
- What data is sent and when: booking details (service name, date\/time, customer name and notes) are sent when a booking is confirmed, rescheduled, or deleted, for staff members who connected their calendar. OAuth tokens are stored in the site's own database.<\/li>\n
- Which services are contacted: Google's OAuth endpoints (accounts.google.com, oauth2.googleapis.com) and the Google Calendar API (www.googleapis.com).<\/li>\n
- Google Terms of Service: https:\/\/policies.google.com\/terms<\/li>\n
- Google Privacy Policy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n\n
\n- Upload the
bookingistic<\/code> folder to \/wp-content\/plugins\/<\/code>, or install via Plugins \u2192 Add New.<\/li>\n- Activate the plugin.<\/li>\n
- Open Bookingistic \u2192 Appearance<\/strong> and pick an industry preset (or your own design).<\/li>\n
- Add your services under Bookingistic \u2192 Services<\/strong>.<\/li>\n
- Drop
[bookingistic service=\"your-service\"]<\/code> on any page \u2014 or use the Elementor widget.<\/li>\n<\/ol>\n\nUpgrading from 1.x? Your existing bookings and the legacy form keep working.<\/p>\n\n\n
\nDoes the free version include payments?<\/h3><\/dt>\nYes \u2014 via WooCommerce. Turn on \"WooCommerce Orders\" under Bookingistic \u2192 Payments and every paid booking creates a WooCommerce order the customer can check out with (cards, PayPal, bank transfer \u2014 whatever your store supports). Payment status syncs back to the booking, and confirmed payment auto-confirms the booking. Direct Stripe\/PayPal gateways without WooCommerce are on the roadmap.<\/p><\/dd>\n
Does Google Calendar sync need a paid service?<\/h3><\/dt>\nNo. The deep-link + .ics features work everywhere. Two-way sync uses your own free Google OAuth client credentials (setup guide under Bookingistic \u2192 Integrations \u2192 Google Calendar).<\/p><\/dd>\n
Can each staff member have their own calendar?<\/h3><\/dt>\nYes \u2014 per-day working hours, days off, daily limits, and individual Google Calendar connections.<\/p><\/dd>\n
Will it slow my site down?<\/h3><\/dt>\nNo external CDN calls, no jQuery dependency, one small CSS + one JS file, loaded only where the form appears.<\/p><\/dd>\n\n<\/dl>\n\n\n
2.6.0<\/h4>\n\n\n- New: premium booking-form design language across all four form designs and all three calendar views \u2014 elevated card, step progress (\"Step 1 of 3\"), service summary card with price pill, day tiles, time pills and a live \"Continue with Tue at 1:30 PM \u2192\" button<\/li>\n
- New: motion \u2014 slide\/fade step transitions, spring-like day\/time selection, skeleton shimmer while availability loads, staggered time pills, crossfading CTA text, animated success checkmark, floating toast cards and hover micro-interactions; pure CSS + vanilla JS, no new libraries or external requests, and fully disabled under prefers-reduced-motion<\/li>\n
- Accessibility: arrow-key \/ Home \/ End navigation for days, times and hosts; full-date labels on day buttons; polite live region for loading and availability; focus moves to each new step; visible focus rings; forced-colors support<\/li>\n
- Changed: Modern Card is the default design and #1b7257 the default accent for sites that have never saved Appearance settings; saved settings, shortcode attributes and the Elementor widget are unchanged<\/li>\n
- Security: every custom-table SQL query now goes through $wpdb->prepare() with placeholders; table and column identifiers are bound with %i (whitelisted columns only), optional filters are value-bound instead of concatenated, and ORDER BY uses a strict column whitelist. No phpcs:ignore remains on any SQL-preparation (PreparedSQL \/ PreparedSQLPlaceholders \/ InterpolatedNotPrepared) sniff.<\/li>\n
- Performance: reads from the plugin's own tables are now object-cached (wp_cache_get\/wp_cache_set, one cache group per table) and invalidated through a per-table last_changed key on every write (create, update, delete, status change, cancel, payment updates, schema install\/upgrade, uninstall, and at the end of every booking transaction). Availability, overlap\/double-booking, daily-limit, slot-lock, slug-uniqueness and reminder checks always read live data. The remaining Plugin Check DirectQuery notices carry narrow line-level ignores with the reason stated. No functional changes.<\/li>\n
- Fixed: PHP 8.1+ \"Passing null to htmlspecialchars()\" deprecation notice when editing a staff member with an empty bio (found while testing on MySQL\/MariaDB).<\/li>\n
- Changed: the booking form uses the system UI font stack; no web font is loaded or referenced<\/li>\n
- Hardening: admin form input (staff hours, days off, phone, integration settings) is sanitized with core functions before validation, admin pagination output is passed through wp_kses_post(), Google Calendar ICS files are written through WP_Filesystem, the cron schedule is registered next to its callback, and uninstall (with BOOKINGISTIC_DELETE_DATA) also removes the plugin's transients. Plugin Check (with experimental checks) and PHPCS (WordPress standard) report no errors or warnings.<\/li>\n<\/ul>\n\n
2.5.5<\/h4>\n\n\n- Fixed: REST requests from the booking form and the admin calendar now work on sites using plain permalinks (the WordPress default on a fresh install) \u2014 endpoint URLs are built with a proper query-string join instead of plain concatenation, which previously produced \"No route was found matching the URL and request method\" on every booking-form and calendar request<\/li>\n<\/ul>\n\n
2.5.4<\/h4>\n\n\n- Hardening: numeric superglobal reads now go through absint()\/floatval()\/sanitize_key() instead of raw casts, satisfying the stricter WordPress Coding Standards rulesets used by the latest Plugin Check and the WordPress.org review Playground \u2014 the plugin reports 0 errors and 0 warnings under it<\/li>\n<\/ul>\n\n
2.5.3<\/h4>\n\n\n- Hardening: every superglobal read is now unslashed and sanitized (or explicitly cast) \u2014 admin pages, list filters, and the public cancel\/reschedule\/pay links<\/li>\n
- Hardening: all admin templates now use plugin-prefixed variable names; read-only display filters are annotated for the WordPress coding standards<\/li>\n
- Fixed: removed a leftover duplicate \"Footer text\" field on the Settings screen that referenced the removed 2.5.1 branding gate<\/li>\n
- Dev: plugin now reports 0 errors and 0 warnings under the Plugin Check (PCP) static analysis suite<\/li>\n<\/ul>\n\n
2.5.2<\/h4>\n\n\n- Fixed: the Google Calendar sync cron event is now scheduled correctly on a fresh activation \u2014 the custom \"every 15 minutes\" interval is registered before scheduling (previously the interval was only registered after activation, so the event was silently skipped on new installs)<\/li>\n
- Security: every admin save and action handler (settings, services, staff, bookings, email automations, integrations, appearance) now verifies a capability before processing, in addition to the existing nonce checks \u2014 users without the matching Bookingistic capability get a 403<\/li>\n<\/ul>\n\n
2.5.1<\/h4>\n\n\n- Removed the email footer branding and its license gate \u2014 every shipped feature is now free and fully enabled (WordPress.org guidelines)<\/li>\n
- Security: staff email addresses are no longer exposed by the public REST endpoints<\/li>\n
- Security: client IP detection for rate limiting now uses only the direct connection address unless the site explicitly opts in to trusted proxy headers, and all header input is sanitized<\/li>\n
- Security: legacy form nonce is now sanitized before verification; admin error notices sanitize input before escaping<\/li>\n
- Privacy: email .ics attachments are written to the system temp directory with random names and deleted after sending \u2014 no booking data in the public uploads folder<\/li>\n
- Fixed: appearance screen styles load through the standard enqueue system<\/li>\n
- Fixed: removed the redundant translation loader (WordPress.org loads translations automatically)<\/li>\n
- Brand: plugin links now point to bookingistic.com<\/li>\n<\/ul>\n\n
2.5.0<\/h4>\n\n\n- Fixed:
\/wp-json\/bookingistic\/v1\/payments\/status<\/code> now accepts the signed link's t<\/code> parameter (previously only read token<\/code>, so plugin-issued links always returned 410)<\/li>\n- Security: pay-now links now expire after 90 days \u2014 the token embeds its expiry under an HMAC; previously a leaked pay link stayed valid forever<\/li>\n
- Security: Google Calendar OAuth tokens are now encrypted at rest (authenticated secretbox keyed from the site salt); existing tokens migrate transparently on the next save<\/li>\n
- New: race-safe booking \u2014 concurrent submissions for the same staff member are serialized with a row lock and the availability re-check runs inside the transaction, preventing double-booking under simultaneous submits (InnoDB; silently degrades to check-then-insert on MyISAM)<\/li>\n
- Dev: standalone test suite under
tests\/<\/code> (run php tests\/run-all.php<\/code>) covering payment token expiry, crypto round-trip, and deposit math<\/li>\n<\/ul>\n\n2.4.0<\/h4>\n\n\n- New: premium admin UI \u2014 every Bookingistic screen restyled with a consistent design system (page headers with taglines, card-based panels, refined tables, status pills, sticky save bar)<\/li>\n
- New: Integrations page rebuilt as an animated card grid \u2014 icon, description, Connected\/Not connected pill, hover lift, and staggered fade-in (pure CSS, respects prefers-reduced-motion)<\/li>\n
- New: dashboard, bookings, services, staff, customers, and customer profiles now show live stat cards (real counts from your data)<\/li>\n
- New: Reports screen with bookings-by-status summary and top services (replaces the Phase 2 placeholder)<\/li>\n
- Tweak: legacy \"Bookings (v1)\" menu removed from the admin sidebar (data and the legacy REST endpoint are untouched; developers can restore it with the
bookingistic_legacy_bookings_show_ui<\/code> filter)<\/li>\n- Tweak: admin stylesheet rebuilt around CSS variables matching the WordPress admin palette; no external fonts or CDNs<\/li>\n<\/ul>\n\n
2.3.0<\/h4>\n\n\n- New: Payments module \u2014 WooCommerce Orders gateway with enable\/disable switch under Bookingistic \u2192 Payments<\/li>\n
- New: payment ledger \u2014 every payment attempt (pending\/paid\/refunded\/failed) recorded per booking, with admin screen and REST endpoints (
\/payments<\/code>, \/payments\/gateways<\/code>, \/payments\/status<\/code>)<\/li>\n- New:
bookingistic_payment_gateways<\/code> (alias bookingistic_gateways<\/code>), bookingistic_payment_recorded<\/code>, bookingistic_payment_currency<\/code> filters \u2014 gateway registry is fully pluggable<\/li>\n- New: deposits \u2014 per-service deposit percentage; only the deposit is charged upfront (
deposit_paid<\/code> status), supported across forms, admin and REST<\/li>\n- New: signed pay-now links (
?bookingistic_action=pay<\/code>, HMAC token, 410 on bad token) + [bookingistic_payment id email]<\/code> shortcode with Pay now button<\/li>\n- New: booking form success screen shows a Pay now button when a gateway is connected, or pay-later instructions otherwise<\/li>\n
- New:
{payment_link}<\/code> email merge tag now carries the booking's signed pay link<\/li>\n- New: admin manual actions \u2014 Mark paid \/ Refund on payment records (nonce + capability checked) for offline payments<\/li>\n
- New: paid bookings that receive payment are confirmed automatically (consistent with the WooCommerce integration flow)<\/li>\n<\/ul>\n\n
2.2.0<\/h4>\n\n\n- New: 4 booking form templates \u2014 Classic, Modern Card, Split Hero, Minimal Inline (Appearance page + shortcode\/Elementor override)<\/li>\n
- New: 3 calendar views \u2014 month grid, 14-day pills, upcoming list<\/li>\n
- New: one-click industry presets with live preview (salon, clinic, fitness, tutoring, consulting, home services)<\/li>\n
- New: brand accent color + corner radius controls<\/li>\n
- New: Elementor widget with live template\/calendar controls<\/li>\n
- New: Google Calendar two-way sync \u2014 per-staff OAuth connect, booking push, freebusy blocking, 15-min refresh<\/li>\n
- New: Appearance admin page with live preview<\/li>\n
- New:
bookingistic_gcal_sync<\/code> 15-minute cron; bookingistic_external_busy_intervals<\/code> filter<\/li>\n- Improved: refreshed readme, i18n strings, POT file<\/li>\n
- Fixed: staff REST responses no longer expose calendar token metadata<\/li>\n<\/ul>\n\n
2.1.0<\/h4>\n\n\n- Version alignment release (matches the distributed 2.1.0 package).<\/li>\n<\/ul>\n\n
2.0.0<\/h4>\n\n\n- Phase 1 rebuild: custom tables, modular OOP architecture, availability engine,\nfrontend booking form with side calendar, full REST namespace, email automations\nwith branding helper, admin UI, signed cancel & reschedule links.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Initial v1 Strategy Call lead-capture plugin.<\/li>\n<\/ul>","raw_excerpt":"Booking, calendar & email automation for WordPress \u2014 form designs, calendar views, Google Sync, staff scheduling, and payments via WooCommerce.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/387280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=387280"}],"author":[{"embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/developershuvo"}],"wp:attachment":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=387280"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=387280"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=387280"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=387280"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=387280"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=387280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}