Title: Joolweb Sessions Pro Author: regeman Published: September 7, 2026 Last modified: September 7, 2026 --- Search plugins ![](https://ps.w.org/joolweb-sessions-pro/assets/banner-772x250.png?rev=3684947) ![](https://ps.w.org/joolweb-sessions-pro/assets/icon-256x256.png?rev=3684947) # Joolweb Sessions Pro By [regeman](https://profiles.wordpress.org/regeman/) [Download](https://downloads.wordpress.org/plugin/joolweb-sessions-pro.1.1.20.zip) * [Details](https://wordpress.org/plugins/joolweb-sessions-pro/#description) * [Reviews](https://wordpress.org/plugins/joolweb-sessions-pro/#reviews) * [Installation](https://wordpress.org/plugins/joolweb-sessions-pro/#installation) * [Development](https://wordpress.org/plugins/joolweb-sessions-pro/#developers) [Support](https://wordpress.org/support/plugin/joolweb-sessions-pro/) ## Description Coaches and wellness professionals need to manage clients, sessions and payments without juggling multiple tools. Many already use WordPress; Sessions Pro brings that workspace onto your site. Compatible with WordPress 5.8 through 7.1 (tested on WordPress 7.1). Ready for PHP 8.5 (tested on staging). **Built for people you already work with** Sessions Pro is a client and session manager for one-to-one coaches: sports, wellness, and similar professions. You keep client files, session history, bundles (packs of sessions), payment status, and emails on your WordPress site. The free version on WordPress.org is fully usable for that daily work, including **CSV client import**. It is **not** a public appointment-booking calendar. Visitors cannot pick a free slot, pay, and confirm without already being your client. If that is your main need, a dedicated booking plugin is a better fit. Sessions Pro starts from the relationship: you add the client, you plan the work, the client gets a private area. **What you can manage** * Clients: create, edit, and import (CSV); each client gets a WordPress account for a private area * Sessions: create, edit, cancel, statuses, location or video * Bundles: reusable models (for example a 10-session pack) and per-client progress * Payments: manual status on each session (paid / pending / refunded) * Emails: confirmation, updates, cancellation, and automatic reminders (for example 24 hours before) * Schedule: admin dashboard (today / this week), session list, and .ics files in client emails * Settings: cancellation delay, email header, appearance Coaches work primarily from the WordPress admin (Joolweb Sessions Pro dashboard). A mobile-friendly coach front (upcoming sessions, quick actions) complements the admin when you are on site. Clients get a dedicated area (sessions, payment status, history). **Premium add-on** (separate install): Stripe online payments, CSV client export, physical measurements, email/login branding, and optional slot requests from existing clients against a remaining bundle. See sessionspro-app.com. French (`fr_FR`) translations are included in the plugin package (`languages/joolweb- sessions-pro-fr_FR.mo`) for the admin and front-end UI when your site or user locale is French. ### Security and Permissions Sessions Pro uses WordPress native APIs and follows standard security practices: * **WordPress native user APIs**: client accounts are managed with `wp_create_user()`,` wp_update_user()`, and `wp_delete_user()`. * **Capability checks**: sensitive operations are restricted to authorized users only (for example `create_clients`, `edit_clients`, `delete_clients`, `manage_options`). * **Nonce verification**: AJAX and form submissions use WordPress nonces (`check_ajax_referer()`/` wp_verify_nonce()`). * **Input validation and sanitization**: request data is sanitized and validated server-side before processing. * **Escaping on output**: values are escaped at render time with context-appropriate` esc_*` / `wp_kses_*` functions. * **No card storage on site**: when online payments are enabled (separate extension), card details are handled by the payment provider and are not stored in WordPress. * **Privacy tools**: personal data export and erasure hooks are registered for WordPress Tools Export Personal Data and Erase Personal Data. ### Privacy and optional telemetry Sessions Pro does **not** send any data to external servers by default. Administrators may **optionally** enable anonymous usage statistics under **Sessions Pro Settings Privacy** (or at the end of the setup wizard). Nothing is sent without an explicit opt-in; declining or turning this off does not affect plugin features. When enabled, the plugin sends aggregated, non-personal data to the editor API at sessionspro-app.com (HTTPS), typically once per week and when you first opt in: * Pseudonymous installation ID (UUID) * Plugin, WordPress and PHP versions, site locale * Free or premium edition * Usage ranges (client, session and program counts by bucket) * Feature flags (e.g. setup wizard completed, reminders enabled) Never sent: client or coach names, emails, phone numbers, session or note content, exact payment amounts, or your site URL in plain text. You can disable telemetry at any time in the same settings screen; an opt-out signal is sent and associated reports are removed on the editor side. Data is used to measure versions in production, estimate active installations and improve the product. Editor privacy policy (telemetry, contact form, purchases): https://sessionspro- app.com/privacy Client account creation is a core feature of the plugin: coaches need authenticated client accounts to provide private dashboards (sessions, history, documents, profile updates) and role-based access. ## Screenshots [⌊Admin dashboard (today’s sessions and overview)⌉⌊Admin dashboard (today’s sessions and overview)⌉[ Admin dashboard (today’s sessions and overview) [⌊Client file in wp-admin (upcoming and past sessions)⌉⌊Client file in wp-admin ( upcoming and past sessions)⌉[ Client file in wp-admin (upcoming and past sessions) [⌊Client area (sessions and history)⌉⌊Client area (sessions and history)⌉[ Client area (sessions and history) [⌊Settings (general, emails, appearance)⌉⌊Settings (general, emails, appearance)⌉[ Settings (general, emails, appearance) ## Installation 1. Download the plugin 2. Upload the folder to `/wp-content/plugins/` 3. Activate the plugin in the Plugins menu 4. Follow the **Setup wizard** (Joolweb Sessions Pro Setup wizard): check your environment, set the site timezone, confirm coach and client pages, then configure reminders and email. You can reopen the wizard anytime from the admin menu. 5. Fine-tune options under **Joolweb Sessions Pro Settings** (emails, appearance, coach permissions). Documentation: sessionspro-app.com ## FAQ ### Is there a client limit on the WP.org version? No limits on the WP.org version. ### Can anyone on my website book an appointment? No. Sessions Pro is built for coaches who manage existing clients, not for public self-service booking. You create clients and sessions from the WordPress admin. Clients sign in to a private area to see their sessions and payment status. A separate premium add-on can let those clients request a remaining bundle slot; you still approve the request. ### How do I get premium features? Premium add-on features are available separately (see sessionspro-app.com). ### Why does the plugin create WordPress users? Because the plugin provides a private client area with authenticated access. Each client needs a WordPress account to access personal sessions, files, and profile data with role-based permissions. ### Who can create, edit, or delete client accounts? Only authorized users with the required capabilities (or administrators). All related requests are protected by nonce checks and server-side capability checks. ### Does the plugin bypass WordPress authentication? No. The plugin relies on WordPress native authentication and user APIs, and does not bypass standard authentication flows. ### Is Sessions Pro compatible with WordPress 7? Yes. The plugin is tested with WordPress 7.1. Keep WordPress and PHP updated for security. ### Does Sessions Pro work on PHP 8.5? Yes. PHP 7.4+ is required; the plugin is ready for PHP 8.5 (verified on staging). Older PHP versions remain supported down to 7.4. ### Does the plugin send data to external servers? Not by default. Optional anonymous usage telemetry is available for site administrators only, with explicit opt-in under Settings Privacy. See the “Privacy and optional telemetry” section above and https://sessionspro-app.com/privacy ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Joolweb Sessions Pro” is open source software. The following people have contributed to this plugin. Contributors * [ regeman ](https://profiles.wordpress.org/regeman/) [Translate “Joolweb Sessions Pro” into your language.](https://translate.wordpress.org/projects/wp-plugins/joolweb-sessions-pro) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/joolweb-sessions-pro/), check out the [SVN repository](https://plugins.svn.wordpress.org/joolweb-sessions-pro/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/joolweb-sessions-pro/) by [RSS](https://plugins.trac.wordpress.org/log/joolweb-sessions-pro/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.20 * Fix: `is_coach_or_admin()` now checks the given user (Google Calendar can fetch the Premium iCal feed for WordPress admins). * Fix: forfait session confirmation emails send/resend from the bundle table; batch no longer dates unscheduled sessions. * Fix: bundle installment (versement) save accepts European dates. * Feature: completed bundles stay visible in the client area with a Terminé badge; remaining balance still shows in Payments. * Feature: admin sessions list can be filtered by client. * i18n: French overlay for recent settings and client-area strings. #### 1.1.19 * Plugin Check: `Tested up to` set to WordPress 7.1. * Plugin Check: pagination links copy query args from the base URL (no raw `$_GET` scan). * Plugin Check: CSV upload `tmp_name` sanitized before `is_uploaded_file()`. * Plugin Check: bundle session-date helper re-checks the AJAX nonce before reading` $_POST`. * Security (WordPress.org review): session notes AJAX uses a single `check_ajax_referer()`( no `$stop = false`). * Security: output buffering removed from client/notes modals; `wp_editor()` is echoed directly in the footer. * Security: tighter sanitization for settings arrays, CSV uploads, session-date JSON, query args, and meta box fields. * Security: public client registration handler no longer creates users (coach-created accounts only). #### 1.1.18 * Feature: client emails (confirmation, reminder, reschedule) now include an .ics calendar attachment and an “Add to Google Calendar” button so clients can save the session in their personal agenda. * Removed: front-end calendar page (`[joolwebsp_calendar]` / FullCalendar) — planning is handled via admin (future) or iCal sync (Premium). ~285 KB of vendor JS removed from the package. * Removed: Stats tab from the coach dashboard front (data available in admin dashboard only). * Removed: “Add to my calendar” subscribe button from the coach dashboard (Premium iCal subscription available in Settings Calendar). * Fix (Premium): “sessions left to book” badge no longer clips the bottom border. #### 1.1.17 * Security (WordPress.org review): admin client form verifies nonce before reading POST; coach client ownership validated via `assert_editable_client_target()` before `wp_update_user()`. * Security: AJAX handlers call core `check_ajax_referer()` at the start of each method (before reading `$_POST`). #### 1.1.16 * Fix: load plugin bootstrap and role checks on `init` (WordPress 6.7+ `_load_textdomain_just_in_time` notice for domain `joolweb-sessions-pro`). * Fix: role display names and activation page titles no longer call translation functions before `init`. #### 1.1.15 * Security (WordPress.org review): dashboard HTML output uses core `wp_kses()` with a documented allowlist (`joolwebsp_get_dashboard_allowed_html()`). * Security: Select2 vendor assets updated to 4.1.0; pagination nonce fail-early; bundle/program email sends require `edit_programs` plus client ownership. * UX: past-session pagination keeps the Past panel active; client email log layout clarified (type, session, meta, status). #### 1.1.14 * Security (WordPress.org review): AJAX handlers use explicit `check_ajax_referer()`; admin forms and CSV import verify nonces before processing. * Security: client welcome email sends a password-set link instead of a plaintext password. * Security: client session booking AJAX is registered only when the booking feature is enabled. * Privacy: suggested privacy policy content registered via `wp_add_privacy_policy_content()`. * Data: user phone meta migrated to prefixed key `joolwebsp_phone` (legacy `phone` read on upgrade). * i18n: French (`fr_FR`) `.mo` included in the distribution package. * Packaging: development-only premium helpers and CLI tools excluded from the WordPress. org archive. * Code quality: Plugin Check annotations for `joolwebsp_esc_dashboard_html()` output in admin list columns and client financial/overview sections. #### 1.1.13 * Security hardening: pagination links on coach client pages and coach clients list now include nonce verification. * Security hardening: admin badges and email status labels wrapped with `joolwebsp_esc_dashboard_html()` at output. * Security hardening: boolean HTML data attributes use `esc_attr()` (bundle recap, welcome email buttons). #### 1.1.12 * WordPress.org review compliance: fixed Author URI (`sessionspro-app.com`); wp- cron helper URL now uses `site_url()` instead of `home_url()`. * Security: explicit nonce verification on setup wizard settings save; capability checks on admin customer file (create/edit). * Security: late output escaping on admin customer views, client page template, setup wizard, and session list modals (`joolwebsp_esc_dashboard_html()`). * Fix: session notes modal output moved to `wp_footer` for `wp_editor` compatibility while keeping the client page buffer safely escaped. #### 1.1.11 * Optional anonymous usage telemetry (opt-in only): Settings Privacy and setup wizard; weekly reports to sessionspro-app.com when enabled. * Privacy section added to readme; no external calls unless the site administrator opts in. * Fix: telemetry payload includes all required feature flags (`csv_import_used`); fixes HTTP 400 `invalid_payload`. * Fix: plugin upgrade reports use `heartbeat` (not `upgraded`) to avoid HTTP 401; installation_id kept across updates (new id only after opt-out). #### 1.1.0 * Internal: rename legacy `RGSM_*` PHP classes to `Joolwebsp_*` (pre-release cleanup). * Admin menu slug: `joolwebsp` (redirect from legacy `wp-sport` admin URLs). * Internationalization: updated translation template; French (`fr_FR`) language files included in the plugin package. * Admin: clearer test-email failure hints (SMTP / local mail); client welcome flow without displaying passwords in the UI. #### 1.0.12 * WordPress 7.0 and PHP 8.5 compatibility (tested). * Setup wizard: dedicated timezone step; session and email log times use site timezone(` wp_date`). * Admin: maintenance screen removed; legacy cleanup remains available via WP-CLI on staging. * Admin menu icon: calendar (dashicons-calendar-alt). #### 1.0.10 * WordPress.org compliance update and release packaging refresh. * Premium split: Stripe SDK dependency moved to the premium add-on package. * Dependencies: Select2 switched from `4.1.0-rc.0` to stable `4.0.13`. * Internationalization: fixed `translators:` comments for placeholder strings ( correct placement immediately above `__()` in `sprintf()` contexts). * Translation loading: removed manual `load_plugin_textdomain()` call (WordPress. org language packs are loaded by core). * Code quality: refined PHPCS annotations for AJAX nonce-validated `$_POST` reads and narrowed SlowDBQuery suppressions for program-linked session queries. * Internal cleanup: renamed field map key from `meta_key` to `post_meta_key` to avoid false positives from meta query sniffs. #### 1.0.08 * Security hardening and review readiness improvements: * Added and enforced nonce/capability checks on sensitive operations. * Improved output escaping across admin and frontend rendered content. * Updated packaging rules and distribution archive exclusions for WP.org compliance. * Updated dependencies: * Stripe PHP SDK updated to v20.0.0. * Chart.js updated to v4.5.1. * Frontend build dependencies updated (including webpack-cli, css-loader, style- loader). * Session update notification improvements: * Client email wording changed from “rescheduled” to “updated”. * Client email now includes location/link update context when session details change. ## Meta * Version **1.1.20** * Last updated **9 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [booking](https://wordpress.org/plugins/tags/booking/)[calendar](https://wordpress.org/plugins/tags/calendar/) [clients](https://wordpress.org/plugins/tags/clients/)[coaching](https://wordpress.org/plugins/tags/coaching/) [sessions](https://wordpress.org/plugins/tags/sessions/) * [Advanced View](https://wordpress.org/plugins/joolweb-sessions-pro/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/joolweb-sessions-pro/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/joolweb-sessions-pro/reviews/) ## Contributors * [ regeman ](https://profiles.wordpress.org/regeman/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/joolweb-sessions-pro/)