Slotnest Booking Forms for Bookly

Changelog

4.0.1

• Admin notices appear only on Slotnest’s own screens, can always be dismissed, and stay dismissed for that user. While an older copy of the plugin is active, the explanation sits in Slotnest’s row on the Plugins screen.
• The embedded form frame’s CSS is loaded with wp_add_inline_style instead of an inline style tag.
• The release ZIP no longer contains test files, developer documentation or dotfiles. The human-readable app and block sources remain in source/.
• The step counter’s “Step N of M” string has a translators comment; the Site URL field no longer shows an example URL.

4.0.0

• Guided setup: type any service length (5 to 480 minutes) or pick a preset; set opening hours per weekday and an optional lunch break (saved as Bookly staff breaks); the new default booking page has three short steps (Service, Date & time, Your details) with no staff step, and times follow the service length.
• Booking forms shown step by step say “Step N of M” and show a progress bar; the notes field is marked optional; visitors no longer see setup hints meant for site owners.
• Renamed to “Slotnest Booking Forms for Bookly”. New folder and main file (slotnest/slotnest.php), text domain slotnest, slotnest_ / Slotnest_ / SLOTNEST_ prefixes, block slotnest/booking-form, shortcode [slotnest_booking], REST namespace slotnest/v1, capability slotnest_api_access, and filters and actions such as slotnest_public_book_allowed and slotnest_booking_created. Integrations that call buklio/v1 or hook buklio_* filters need updating, hence the major version.
• Upgrade path from Buklio 3.x (and, chained, from “Bookly API CRUD”): activation deactivates the older copy, copies settings and the API capability, copies saved forms (old form IDs keep resolving to their copies) and copies the receipts and email queue. [buklio_booking] shortcodes, buklio/booking-form blocks and old embed links keep working. Nothing of the older plugin is changed or deleted, not even by Slotnest’s uninstaller, so you can roll back by reactivating it; forms created or changed meanwhile are copied again when Slotnest is reactivated. Deleting the older plugin later leaves Slotnest’s data alone.
• Rate limits and the per-email cap are now counted atomically in a small database table (slotnest_counters), so parallel requests can no longer get past them. Old rate-limit transients are removed on upgrade.
• The per-email cap is 5 a day per visitor address plus 15 a day overall, so one person cannot lock a customer out (new filter slotnest_public_email_ip_limit). Gmail addresses with dots count as one address.
• Names reject any domain-like text, spaced or look-alike dots (including U+2024, U+2027 and U+06D4) and phone numbers, but accept initials and titles written without a space (“Dr.Smith”, “J.R.R.Tolkien”); notes reject domain names, not only common endings.
• A retried booking from before the upgrade (same Idempotency-Key) gets its original receipt instead of a 409.
• Slot conflicts are recognised by error code (slotnest_slot_taken), so rate limiting treats them the same on translated sites.
• Appointments created through the integration API now get a Bookly order, Bookly’s calendar and online-meeting sync, and the slotnest_booking_created action, like public bookings. Edits through the API re-sync.
• Appointments created through the integration API take the same per-staff locks as public bookings and are refused (409 slotnest_slot_taken) when they overlap an active appointment of that staff member; send "allow_overlap": true to book over it on purpose, as Bookly’s own calendar allows.
• The developer connection panel is no longer included in the WordPress build.

3.1.0

• New “Buklio booking form” block (block.json API version 3): choose a published form from a dropdown, see a live preview, or follow “Create a form” when there is none. Renders on the server from the same code as the shortcode, and a pasted [buklio_booking] shortcode converts to it.
• New guided setup, opened once after activation and always available under Buklio → Get started. It checks for Bookly (with install and activate buttons through WordPress’ own screens), adds the first service and staff member with working hours through Bookly’s data classes, publishes a form and creates a booking page or adds the block to an existing one. Re-running it updates what it created instead of duplicating it.
• Public form: a sole service is selected automatically, and the receipt no longer shows a dangling “with” when staff is hidden.
• An embedded second form no longer shows the WordPress toolbar of a logged-in user inside its frame.
• Security: an outdated Buklio Salon (before 1.7.0) running alongside is neutralised: its anonymous routes, page takeover and homepage changes are switched off and administrators get a notice with a Deactivate button.
• Spam protection: honeypot field, at most 5 bookings a day per email address, IPv6 rate limits per /64 network, length limits and no links in names and notes, and a buklio_public_book_allowed filter for CAPTCHA integrations.
• No site-wide booking lock any more: public bookings and Bookly’s appointment editor only wait for each other when they save for the same staff member, and rate limits are checked before any lock.
• “Pay locally” is a per-form setting and no longer depends on the integration API’s payment switches. Payments read is now off by default for new installs (write stays on). API payment_details needs payments write and records only unpaid local payments.
• Minimum notice now follows Bookly exactly (none on the free plan; Pro’s value per service). Bookings create a Bookly order and run Bookly’s calendar and online-meeting sync afterwards; new buklio_booking_created action.
• The guided setup never gives the booking page the slug “booking”.
• Readme: accurate statements about what is written to Bookly and what is tested.

3.0.0

• Renamed to “Buklio Booking Forms for Bookly”. New folder and main file (buklio/buklio.php), text domain buklio, and buklio_ / Buklio_ / BUKLIO_ prefixes throughout.
• Upgrade path from “Bookly API CRUD”: activation deactivates the older copy, copies its settings and capability once, and deleting the older plugin later keeps forms, tables and settings.
• Online checkout (Stripe, PayPal, Mollie) removed. The plugin no longer contacts any payment provider; pay-locally bookings are unchanged.
• Pay locally is on by default for new installs, so the bundled templates take bookings straight away. Settings flags a form that uses pay locally while it is switched off, and publishing such a form explains how to fix it.
• Fully translatable in PHP and JavaScript; English is the default language.
• The JavaScript bundle is no longer minified and its source ships in source/.
• The site-specific salon theme pages are no longer part of this plugin.
• Requires WordPress 6.5 or newer.
• Database queries use prepared statements with identifier placeholders throughout.

2.4.0

• A published form that offers a staff selector keeps the visitor’s staff choice. First-available still runs for hidden staff and for an explicit “any” request, and prefers the least-booked free person.
• Public rate limits can use a trusted proxy header. Reads are counted per form. Validation failures do not use the same budget as accepted bookings.
• Bookly’s admin lock covers appointment writes only and is released when that request finishes.
• Monthly availability reuses one schedule and booking read and is cached for a minute.
• Setup reports lock support, InnoDB, the limiter and mail failures. Booking emails fall back to a plain receipt when Bookly’s sender is unavailable.
• Receipts and the email queue are pruned. Owners can opt in to matching an existing customer by email and phone.
• Authenticated writes cannot set token, calendar or WordPress user columns. Appointment responses omit cancel tokens.
• The API capability setting rejects capabilities that authors or editors already have (upload_files, edit_others_posts).
• Payments, cart, waitlist, coupons and gift cards are off on a new install.

2.3.0

• Public forms that hide staff or book the first available person assign that person on the server.
• Staff and customer responses omit calendar, OAuth and token columns.
• Local payments stay unpaid until they are collected in Bookly.

2.2.0

• Public bookings follow Bookly’s default appointment status unless a form sets its own.
• Form administration uses WordPress list, editor and settings screens.

2.1.0

• Durable booking emails with delivery retries.
• Idempotent public booking retries and coordination with Bookly’s editor.

2.0.0

• Visual configurator in wp-admin, saved draft and published forms, shortcode embedding.
• Restricted anonymous catalog and booking endpoints with server-side slot checks and rate limits.