Unbelievable Salon Booking is a comprehensive appointment management plugin designed for service-based businesses. Perfect for barbers, beauty salons, spas, wellness centers, consultants, and any business that needs to manage appointments efficiently.<\/p>\n\n
[unbsb_booking_form]<\/code> \u2013 Display the booking form<\/li>\n[unbsb_services]<\/code> \u2013 Show available services list<\/li>\n[unbsb_staff_list]<\/code> \u2013 Display staff members<\/li>\n[unbsb_manage_booking]<\/code> \u2013 Booking management page for customers<\/li>\n<\/ul>\n\nPerfect For<\/h4>\n\n\n- Barbershops<\/li>\n
- Hair salons<\/li>\n
- Beauty salons<\/li>\n
- Spas & wellness centers<\/li>\n
- Massage therapists<\/li>\n
- Nail salons<\/li>\n
- Tattoo studios<\/li>\n
- Consultants<\/li>\n
- Any appointment-based business<\/li>\n<\/ul>\n\n
Requirements<\/h4>\n\n\n- WordPress 5.8 or higher<\/li>\n
- PHP 8.0 or higher<\/li>\n
- MySQL 5.6 or higher<\/li>\n<\/ul>\n\n
External Services<\/h4>\n\n
This plugin can connect to the external services listed below. None of these services are contacted unless the site administrator explicitly enables the related feature and provides their own credentials\/IDs.<\/strong> By default, all of them are disabled and no data leaves your site.<\/p>\n\nNetGSM SMS API<\/strong> (optional, off by default)\nUsed to deliver SMS notifications (booking confirmations, reminders, cancellations) when the administrator enables SMS notifications and enters their own NetGSM API credentials. Data sent: customer phone number and the SMS message content (booking details such as date, time, service name and staff name), at the moment a notification is triggered.<\/p>\n\n\n- Service: https:\/\/www.netgsm.com.tr\/<\/a> (API endpoint:
https:\/\/api.netgsm.com.tr\/<\/code>)<\/li>\n- Terms of Service: https:\/\/www.netgsm.com.tr\/sozlesme-ve-formlar<\/a><\/li>\n
- Privacy Policy: https:\/\/www.netgsm.com.tr\/gizlilik-ve-guvenlik\/<\/a><\/li>\n<\/ul>\n\n
Google Sign-In (OAuth)<\/strong> (optional, off by default)\nUsed to let customers sign in with their Google account when the administrator enables social login and configures their own Google OAuth client. When a customer chooses \"Sign in with Google\", they are redirected to accounts.google.com<\/code>; the site then exchanges the authorization code at oauth2.googleapis.com<\/code> and retrieves the customer's name and email address from www.googleapis.com<\/code> (or verifies a native app ID token via oauth2.googleapis.com\/tokeninfo<\/code>). Data sent: the OAuth authorization code\/ID token issued by Google for that sign-in.<\/p>\n\n\n- Service: https:\/\/developers.google.com\/identity<\/a><\/li>\n
- Terms of Service: https:\/\/policies.google.com\/terms<\/a><\/li>\n
- Privacy Policy: https:\/\/policies.google.com\/privacy<\/a><\/li>\n<\/ul>\n\n
Sign in with Apple<\/strong> (optional, off by default)\nUsed to let customers sign in with their Apple ID when the administrator enables it and configures their own Apple Services ID. Customers are redirected to appleid.apple.com<\/code>; the plugin also fetches Apple's public signing keys from appleid.apple.com\/auth\/keys<\/code> to cryptographically verify the returned identity token. Data sent: the identity token issued by Apple for that sign-in.<\/p>\n\n\n- Service: https:\/\/developer.apple.com\/sign-in-with-apple\/<\/a><\/li>\n
- Terms of Service: https:\/\/www.apple.com\/legal\/internet-services\/itunes\/<\/a><\/li>\n
- Privacy Policy: https:\/\/www.apple.com\/legal\/privacy\/<\/a><\/li>\n<\/ul>\n\n
Google reCAPTCHA<\/strong> (optional, off by default)\nUsed to protect the public booking form against bots when the administrator enables it and enters their own reCAPTCHA keys. The reCAPTCHA script is loaded from www.google.com<\/code> on pages containing the booking form, and each submitted form's CAPTCHA response is verified server-side against www.google.com\/recaptcha\/api\/siteverify<\/code>. Data sent: the CAPTCHA response token and the visitor's IP address, on form submission.<\/p>\n\n\n- Service: https:\/\/www.google.com\/recaptcha\/about\/<\/a><\/li>\n
- Terms of Service: https:\/\/policies.google.com\/terms<\/a><\/li>\n
- Privacy Policy: https:\/\/policies.google.com\/privacy<\/a><\/li>\n<\/ul>\n\n
hCaptcha<\/strong> (optional, off by default)\nAlternative CAPTCHA provider, used the same way as reCAPTCHA when selected by the administrator. The hCaptcha script is loaded from js.hcaptcha.com<\/code> and responses are verified against hcaptcha.com\/siteverify<\/code>. Data sent: the CAPTCHA response token and the visitor's IP address, on form submission.<\/p>\n\n\n- Service: https:\/\/www.hcaptcha.com\/<\/a><\/li>\n
- Terms of Service: https:\/\/www.hcaptcha.com\/terms<\/a><\/li>\n
- Privacy Policy: https:\/\/www.hcaptcha.com\/privacy<\/a><\/li>\n<\/ul>\n\n
Google Analytics 4<\/strong> (optional, off by default)\nUsed for visitor\/booking analytics when the administrator enables it and enters their own GA4 Measurement ID. The gtag.js script is loaded from www.googletagmanager.com<\/code> on front-end pages and standard Google Analytics data (page views and booking funnel events) is sent to Google.<\/p>\n\n\n- Service: https:\/\/marketingplatform.google.com\/about\/analytics\/<\/a><\/li>\n
- Terms of Service: https:\/\/marketingplatform.google.com\/about\/analytics\/terms\/us\/<\/a><\/li>\n
- Privacy Policy: https:\/\/policies.google.com\/privacy<\/a><\/li>\n<\/ul>\n\n
Meta (Facebook) Pixel & Conversions API<\/strong> (optional, off by default)\nUsed for advertising analytics when the administrator enables it and enters their own Pixel ID (and, for the Conversions API, their own access token). The Pixel script is loaded from connect.facebook.net<\/code> on front-end pages and events are sent to Facebook; when the Conversions API is enabled, booking events (event name, time, and hashed customer identifiers) are also sent server-side to graph.facebook.com<\/code>.<\/p>\n\n\n- Service: https:\/\/www.facebook.com\/business\/tools\/meta-pixel<\/a><\/li>\n
- Terms of Service: https:\/\/www.facebook.com\/legal\/terms<\/a><\/li>\n
- Privacy Policy: https:\/\/www.facebook.com\/privacy\/policy\/<\/a><\/li>\n<\/ul>\n\n
\"Add to calendar\" links<\/strong>\nBooking confirmation pages\/emails can contain optional \"Add to Google Calendar \/ Outlook \/ Yahoo Calendar\" links. These are plain links that open the respective calendar service in the customer's browser with the appointment details pre-filled; the plugin itself sends no data to these services.<\/p>\n\n\n\n- Upload the
unbelievable-salon-booking<\/code> folder to the \/wp-content\/plugins\/<\/code> directory<\/li>\n- Activate the plugin through the 'Plugins' menu in WordPress<\/li>\n
- Go to 'Unbelievable Salon Booking' in the admin menu to configure the plugin<\/li>\n
- Add your service categories and services<\/li>\n
- Add your staff members and set their working hours<\/li>\n
- Use the
[unbsb_booking_form]<\/code> shortcode to display the booking form on any page<\/li>\n<\/ol>\n\n\n\nHow do I display the booking form?<\/h3><\/dt>\nUse the shortcode [unbsb_booking_form]<\/code> on any page or post. You can also specify parameters like [unbsb_booking_form service=\"1\" staff=\"2\"]<\/code>.<\/p><\/dd>\nCan I have multiple staff members?<\/h3><\/dt>\nYes, you can add unlimited staff members, each with their own schedule, services, and custom pricing.<\/p><\/dd>\n
Does it support service categories?<\/h3><\/dt>\nYes, you can organize your services into categories for better presentation.<\/p><\/dd>\n
Can staff members have different prices for the same service?<\/h3><\/dt>\nYes, each staff member can have custom pricing and duration for any service they offer.<\/p><\/dd>\n
Is it mobile friendly?<\/h3><\/dt>\nYes, the booking form is fully responsive and works perfectly on all devices including smartphones and tablets.<\/p><\/dd>\n
Can I customize email notifications?<\/h3><\/dt>\nYes, you can customize email templates for booking confirmations, reminders, and cancellations from the Settings page.<\/p><\/dd>\n
Does it support SMS notifications?<\/h3><\/dt>\nYes, SMS notifications are supported via NetGSM integration. More SMS providers will be added in future updates.<\/p><\/dd>\n
Can customers manage their bookings?<\/h3><\/dt>\nYes, customers receive a unique link to view and cancel their bookings.<\/p><\/dd>\n
Is it translation ready?<\/h3><\/dt>\nYes, the plugin is fully translatable using standard WordPress translation methods. Turkish, English, German, French, Russian, and Bulgarian translations are included.<\/p><\/dd>\n
Does it work with any theme?<\/h3><\/dt>\nYes, Unbelievable Salon Booking is designed to work with any properly coded WordPress theme.<\/p><\/dd>\n
Is there a Pro version?<\/h3><\/dt>\nA Pro version with additional features like payment integration, Google Calendar sync, and more SMS providers is planned for future release.<\/p><\/dd>\n\n<\/dl>\n\n\n
3.23.5<\/h4>\n\n\n- Security: web Google\/Apple sign-in now requires a provider-verified email address before linking or creating an account (prevents account takeover via an unverified provider email).<\/li>\n
- Security: the loyalty-progress REST endpoint now identifies the customer from the WordPress auth cookie and only ever returns the logged-in customer's own progress (no more lookups by arbitrary email).<\/li>\n
- Security: the mobile-app promo validation endpoint is now per-IP throttled against code enumeration.<\/li>\n
- Fix: rate-limiter transients can no longer be stored with a zero\/negative expiration.<\/li>\n<\/ul>\n\n
3.23.4<\/h4>\n\n\n- Security: the web Sign in with Apple flow now cryptographically verifies the Apple ID token (RS256 signature against Apple's JWKS) before signing the user in \u2014 previously only iss\/aud\/exp claims were checked.<\/li>\n
- Security: public loyalty-progress REST lookups are now IP rate-limited.<\/li>\n
- Review feedback: every inline \/ is now delivered through wp_add_inline_script()\/wp_add_inline_style()\/wp_print_inline_script_tag(); JSON-LD output no longer uses JSON_UNESCAPED_SLASHES; transient keys are consistently unbsb_-prefixed; the placeholder image URL uses UNBSB_PLUGIN_URL instead of a hardcoded wp-content path.<\/li>\n
- The \"Powered by\" credit under the booking form is now opt-in (Settings toggle, off by default).<\/li>\n
- Updated bundled libraries: Chart.js 4.5.1, intl-tel-input 29.2.3 (bundled utils, webp flag sprites).<\/li>\n
- readme: documented every external service (Google\/Apple sign-in, reCAPTCHA, hCaptcha, GA4, Meta Pixel\/CAPI, NetGSM) with data-flow details and working terms\/privacy links.<\/li>\n
- Removed bundled .po\/.mo translation files (translate.wordpress.org handles translations) and the load_plugin_textdomain() call.<\/li>\n<\/ul>\n\n
3.23.3<\/h4>\n\n\n- Security: public booking and promo-code AJAX endpoints are now IP rate-limited (5\/min for booking creation) \u2014 they are deliberately nonce-free for cache compatibility and previously relied on the honeypot\/CAPTCHA only.<\/li>\n
- Hardening: remaining unsanitized\/unslashed inputs fixed, OAuth redirects use wp_safe_redirect with an allowed-hosts filter, debug logging gated behind WP_DEBUG.<\/li>\n<\/ul>\n\n
3.23.2<\/h4>\n\n\n- WordPress.org readiness: removed the self-hosted update checker (WordPress.org is now the update channel), FullCalendar is bundled locally instead of loaded from a CDN, the optional GA4 loader is enqueued through the WordPress script API, and every Plugin Check error was resolved (SQL prepare, output escaping, translator comments).<\/li>\n
- Fix: Customer View \"Wallet\" payment badge queried the wrong table name and never showed.<\/li>\n<\/ul>\n\n
3.23.1<\/h4>\n\n\n- New: Conditional email-template blocks {if_cancel}, {if_reschedule}, {if_manage} \u2014 cancel\/reschedule wording is dropped automatically when the feature is disabled.<\/li>\n<\/ul>\n\n
3.23.0<\/h4>\n\n\n- New: Soft delete for services, staff and categories with a \"Deleted items\" list and Restore.<\/li>\n
- New: Edit Booking supports full multi-service editing (Bookings list + Calendar).<\/li>\n
- Fix: Conflict check now runs against the new end time when a booking's services change.<\/li>\n<\/ul>\n\n
3.22.x<\/h4>\n\n\n- New: Whole admin installable as a PWA (role-aware manifest, install prompt, offline page).<\/li>\n
- Fix: Service Worker no longer cache-firsts third-party wp-admin assets.<\/li>\n
- Fix: Mobile modal overflow, missing app-bar spacing, pinch-zoom on plugin screens, missing Card payment icon.<\/li>\n<\/ul>\n\n
3.21.0<\/h4>\n\n\n- New: Mobile app shell (top bar, drawer, bottom tabs, bottom-sheet modals) on every plugin admin screen.<\/li>\n<\/ul>\n\n
3.20.0<\/h4>\n\n\n- New: Reports page \u2014 P&L over any date range with a month-by-month breakdown.<\/li>\n<\/ul>\n\n
3.19.x<\/h4>\n\n\n- New: Inventory module \u2014 items, per-location stock, movement ledger, stock counts, staff order requests, low-stock alerts.<\/li>\n
- New: Staff portal read-only colleague calendars; customer birthday list\/filters; dashboard Net Profit section.<\/li>\n
- Fix: Staff could complete another staff member's booking via AJAX.<\/li>\n<\/ul>\n\n
Older releases: see changelog.txt in the plugin folder.<\/p>","raw_excerpt":"Professional appointment booking system for barbers, beauty salons, spas and service providers.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/356029","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=356029"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/zgrkaralar"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=356029"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=356029"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=356029"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=356029"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=356029"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=356029"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}