WordPress.org
Get WordPress
WordPress.org

Plugin Directory

Unbelievable Salon Booking

Unbelievable Salon Booking

By Özgür KARALAR
Download

Description

Unbelievable Salon Booking is a comprehensive appointment management plugin designed for service-based businesses. Perfect for barbers, beauty salons, spas, wellness centers, consultants, and any business that needs to manage appointments efficiently.

Key Features

  • Service Management – Create unlimited services with custom duration and pricing
  • Category Organization – Group services into categories for better organization
  • Staff Management – Add team members with individual schedules and services
  • Working Hours – Set flexible working hours for each staff member
  • Breaks & Holidays – Define lunch breaks and days off
  • Customer Database – Track customer history and contact information
  • Email Notifications – Automatic booking confirmations and reminders
  • SMS Notifications – Optional SMS alerts via NetGSM integration
  • Calendar View – Visual calendar for easy appointment management
  • Booking Form – Clean, responsive booking form via shortcode
  • Booking Management – Customers can view and cancel their bookings
  • Multi-language – Translation ready with 6 languages included

Included Languages

  • English
  • Turkish (Türkçe)
  • German (Deutsch)
  • French (Français)
  • Russian (Русский)
  • Bulgarian (Български)

Shortcodes

  • [unbsb_booking_form] – Display the booking form
  • [unbsb_services] – Show available services list
  • [unbsb_staff_list] – Display staff members
  • [unbsb_manage_booking] – Booking management page for customers

Perfect For

  • Barbershops
  • Hair salons
  • Beauty salons
  • Spas & wellness centers
  • Massage therapists
  • Nail salons
  • Tattoo studios
  • Consultants
  • Any appointment-based business

Requirements

  • WordPress 5.8 or higher
  • PHP 8.0 or higher
  • MySQL 5.6 or higher

External Services

This plugin can connect to the external services listed below. None of these services are contacted unless the site administrator explicitly enables the related feature and provides their own credentials/IDs. By default, all of them are disabled and no data leaves your site.

NetGSM SMS API (optional, off by default)
Used to deliver SMS notifications (booking confirmations, reminders, cancellations) when the administrator enables SMS notifications and enters their own NetGSM API credentials. Data sent: customer phone number and the SMS message content (booking details such as date, time, service name and staff name), at the moment a notification is triggered.

Google Sign-In (OAuth) (optional, off by default)
Used to let customers sign in with their Google account when the administrator enables social login and configures their own Google OAuth client. When a customer chooses “Sign in with Google”, they are redirected to accounts.google.com; the site then exchanges the authorization code at oauth2.googleapis.com and retrieves the customer’s name and email address from www.googleapis.com (or verifies a native app ID token via oauth2.googleapis.com/tokeninfo). Data sent: the OAuth authorization code/ID token issued by Google for that sign-in.

Sign in with Apple (optional, off by default)
Used to let customers sign in with their Apple ID when the administrator enables it and configures their own Apple Services ID. Customers are redirected to appleid.apple.com; the plugin also fetches Apple’s public signing keys from appleid.apple.com/auth/keys to cryptographically verify the returned identity token. Data sent: the identity token issued by Apple for that sign-in.

Google reCAPTCHA (optional, off by default)
Used to protect the public booking form against bots when the administrator enables it and enters their own reCAPTCHA keys. The reCAPTCHA script is loaded from www.google.com on pages containing the booking form, and each submitted form’s CAPTCHA response is verified server-side against www.google.com/recaptcha/api/siteverify. Data sent: the CAPTCHA response token and the visitor’s IP address, on form submission.

hCaptcha (optional, off by default)
Alternative CAPTCHA provider, used the same way as reCAPTCHA when selected by the administrator. The hCaptcha script is loaded from js.hcaptcha.com and responses are verified against hcaptcha.com/siteverify. Data sent: the CAPTCHA response token and the visitor’s IP address, on form submission.

Google Analytics 4 (optional, off by default)
Used for visitor/booking analytics when the administrator enables it and enters their own GA4 Measurement ID. The gtag.js script is loaded from www.googletagmanager.com on front-end pages and standard Google Analytics data (page views and booking funnel events) is sent to Google.

Meta (Facebook) Pixel & Conversions API (optional, off by default)
Used for advertising analytics when the administrator enables it and enters their own Pixel ID (and, for the Conversions API, their own access token). The Pixel script is loaded from connect.facebook.net on front-end pages and events are sent to Facebook; when the Conversions API is enabled, booking events (event name, time, and hashed customer identifiers) are also sent server-side to graph.facebook.com.

“Add to calendar” links
Booking confirmation pages/emails can contain optional “Add to Google Calendar / Outlook / Yahoo Calendar” links. These are plain links that open the respective calendar service in the customer’s browser with the appointment details pre-filled; the plugin itself sends no data to these services.

Installation

  1. Upload the unbelievable-salon-booking folder to the /wp-content/plugins/ directory
  2. Activate the plugin through the ‘Plugins’ menu in WordPress
  3. Go to ‘Unbelievable Salon Booking’ in the admin menu to configure the plugin
  4. Add your service categories and services
  5. Add your staff members and set their working hours
  6. Use the [unbsb_booking_form] shortcode to display the booking form on any page

FAQ

How do I display the booking form?

Use the shortcode [unbsb_booking_form] on any page or post. You can also specify parameters like [unbsb_booking_form service="1" staff="2"].

Can I have multiple staff members?

Yes, you can add unlimited staff members, each with their own schedule, services, and custom pricing.

Does it support service categories?

Yes, you can organize your services into categories for better presentation.

Can staff members have different prices for the same service?

Yes, each staff member can have custom pricing and duration for any service they offer.

Is it mobile friendly?

Yes, the booking form is fully responsive and works perfectly on all devices including smartphones and tablets.

Can I customize email notifications?

Yes, you can customize email templates for booking confirmations, reminders, and cancellations from the Settings page.

Does it support SMS notifications?

Yes, SMS notifications are supported via NetGSM integration. More SMS providers will be added in future updates.

Can customers manage their bookings?

Yes, customers receive a unique link to view and cancel their bookings.

Is it translation ready?

Yes, the plugin is fully translatable using standard WordPress translation methods. Turkish, English, German, French, Russian, and Bulgarian translations are included.

Does it work with any theme?

Yes, Unbelievable Salon Booking is designed to work with any properly coded WordPress theme.

Is there a Pro version?

A Pro version with additional features like payment integration, Google Calendar sync, and more SMS providers is planned for future release.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Unbelievable Salon Booking” is open source software. The following people have contributed to this plugin.

Contributors

Translate “Unbelievable Salon Booking” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

3.23.5

  • Security: web Google/Apple sign-in now requires a provider-verified email address before linking or creating an account (prevents account takeover via an unverified provider email).
  • Security: the loyalty-progress REST endpoint now identifies the customer from the WordPress auth cookie and only ever returns the logged-in customer’s own progress (no more lookups by arbitrary email).
  • Security: the mobile-app promo validation endpoint is now per-IP throttled against code enumeration.
  • Fix: rate-limiter transients can no longer be stored with a zero/negative expiration.

3.23.4

  • Security: the web Sign in with Apple flow now cryptographically verifies the Apple ID token (RS256 signature against Apple’s JWKS) before signing the user in — previously only iss/aud/exp claims were checked.
  • Security: public loyalty-progress REST lookups are now IP rate-limited.
  • Review feedback: every inline / is now delivered through wp_add_inline_script()/wp_add_inline_style()/wp_print_inline_script_tag(); JSON-LD output no longer uses JSON_UNESCAPED_SLASHES; transient keys are consistently unbsb_-prefixed; the placeholder image URL uses UNBSB_PLUGIN_URL instead of a hardcoded wp-content path.
  • The “Powered by” credit under the booking form is now opt-in (Settings toggle, off by default).
  • Updated bundled libraries: Chart.js 4.5.1, intl-tel-input 29.2.3 (bundled utils, webp flag sprites).
  • readme: documented every external service (Google/Apple sign-in, reCAPTCHA, hCaptcha, GA4, Meta Pixel/CAPI, NetGSM) with data-flow details and working terms/privacy links.
  • Removed bundled .po/.mo translation files (translate.wordpress.org handles translations) and the load_plugin_textdomain() call.

3.23.3

  • Security: public booking and promo-code AJAX endpoints are now IP rate-limited (5/min for booking creation) — they are deliberately nonce-free for cache compatibility and previously relied on the honeypot/CAPTCHA only.
  • Hardening: remaining unsanitized/unslashed inputs fixed, OAuth redirects use wp_safe_redirect with an allowed-hosts filter, debug logging gated behind WP_DEBUG.

3.23.2

  • WordPress.org readiness: removed the self-hosted update checker (WordPress.org is now the update channel), FullCalendar is bundled locally instead of loaded from a CDN, the optional GA4 loader is enqueued through the WordPress script API, and every Plugin Check error was resolved (SQL prepare, output escaping, translator comments).
  • Fix: Customer View “Wallet” payment badge queried the wrong table name and never showed.

3.23.1

  • New: Conditional email-template blocks {if_cancel}, {if_reschedule}, {if_manage} — cancel/reschedule wording is dropped automatically when the feature is disabled.

3.23.0

  • New: Soft delete for services, staff and categories with a “Deleted items” list and Restore.
  • New: Edit Booking supports full multi-service editing (Bookings list + Calendar).
  • Fix: Conflict check now runs against the new end time when a booking’s services change.

3.22.x

  • New: Whole admin installable as a PWA (role-aware manifest, install prompt, offline page).
  • Fix: Service Worker no longer cache-firsts third-party wp-admin assets.
  • Fix: Mobile modal overflow, missing app-bar spacing, pinch-zoom on plugin screens, missing Card payment icon.

3.21.0

  • New: Mobile app shell (top bar, drawer, bottom tabs, bottom-sheet modals) on every plugin admin screen.

3.20.0

  • New: Reports page — P&L over any date range with a month-by-month breakdown.

3.19.x

  • New: Inventory module — items, per-location stock, movement ledger, stock counts, staff order requests, low-stock alerts.
  • New: Staff portal read-only colleague calendars; customer birthday list/filters; dashboard Net Profit section.
  • Fix: Staff could complete another staff member’s booking via AJAX.

Older releases: see changelog.txt in the plugin folder.

Meta

Ratings

No reviews have been submitted yet.

Your review

See all reviews

Contributors

Support

Got something to say? Need help?

View support forum