BookPoint Booking & Appointments

BookPoint Booking & Appointments is a lightweight and modern appointment booking plugin for WordPress. It helps you manage services, schedules, availability, customers, bookings, and payments through a clean booking workflow. This plugin is fully functional without any license key and includes:

• Services and categories management
• Locations management
• Service extras
• Promo codes
• Holidays and time-off management
• Booking widget with block and shortcode support
• Calendar, schedule, and availability configuration
• Customers and bookings management
• Online payments configuration for Cash, WooCommerce, Stripe, and PayPal
• Lightweight and fast performance
• Mobile responsive booking interface
• No locked or trial-only built-in features in this WordPress.org package

This WordPress.org package does not gate built-in functionality behind licenses, trials, quotas, or time limits. Any paid add-on functionality is distributed separately and is not included in this package.

6.0.0 A complete redesign of the booking wizard and the whole admin, with the same data, settings, shortcodes, block and REST API.

• New booking wizard: guided steps that skip themselves when there is nothing to choose, a live summary (mobile summary bar), an "Any available" staff option, a calendar with Morning / Afternoon / Evening times, clear recovery when a time is taken while booking, promo codes with a live total, and a confirmation page with "Add to calendar" (.ics and Google Calendar). Works inline, as a button dialog, in dark mode, on phones and right-to-left sites.
• New "Manage booking" page and "My bookings" portal, redesigned with cancel and reschedule.
• New admin app: dashboard with KPIs, comparison to the previous period and today by staff; bookings list with filters, bulk actions and a side panel to create, edit and reschedule; a native calendar (day, week, month, staff and list views, drag to move); redesigned services, categories, extras, staff, locations, customers, settings (tabs for payments, schedule, days off, form fields, promo codes, notifications, audit log and tools) and Booking Form Designer. Global search, unsaved-changes protection and dark mode.
• Accessibility and responsive: WCAG 2.1 AA checked on every admin page and wizard step, keyboard support, 44 px touch targets, layouts checked from 360 to 1440 px in Chromium and Firefox.
• Performance: the admin loads in code-split chunks (first load about 77 KB instead of 323 KB), scripts are deferred, and dashboard totals are cached briefly.
• Fix: a single shared availability engine now drives the wizard, the admin slot picker, rescheduling and booking creation, with per-day locking, so two customers can no longer book the same time (including across services for the same staff member).
• Fix: payment amounts are re-computed on the server and checked against Stripe/PayPal before a booking is marked paid; held bookings release their time when a payment is cancelled.
• Fix: saving a schedule from the admin no longer wipes other days; calendar times no longer shift with the time zone; customer details are no longer exposed by public booking endpoints; manage links keep working after cancel or reschedule; portal sign-in works with "+" addresses.
• Security: the legacy promo-code validation route is now rate limited; booking notifications and webhooks fire consistently for every status change.
• Improvement: translation template (languages/pointly-booking.pot), explicit text-domain loading, RTL stylesheets.
• Compatibility: requires WordPress 6.2 or newer (was 6.0). All shortcodes and attributes, the block, AJAX actions, REST routes, hooks, options, tables, roles and email templates from 2.6.x are unchanged; database changes are additive only and run automatically on update.

2.6.23

• Fix: every translatable string in the plugin (44 PHP files plus the booking-form block) used a text domain that didn't match the plugin's actual WordPress.org slug, so none of it could ever be loaded through WordPress.org's translation system. All strings and the plugin header now use the correct text domain.
• Fix: the WordPress.org release package now ships its main file under the same name the live plugin has always used, so this and future updates apply cleanly to existing installs instead of registering as a second, unrelated plugin.

2.6.22

• Fix: the Stripe payment step's Back/Pay buttons used CSS classes that only exist in the admin stylesheet, so they rendered as unstyled browser buttons for customers paying by card.
• Fix: removed a leftover, unused duplicate payment-method-selection component that was never wired into the wizard.
• Fix: the date picker's availability indicator used hardcoded colors instead of the shared design tokens, so it didn't adapt in dark mode.
• Improvement: added keyboard focus trapping to the booking wizard modal so Tab/Shift+Tab no longer escapes to the page behind it, plus an accessible name for screen readers and ARIA state on the date/time picker's calendar days and time slots.

2.6.21

• New design system: a shared set of design tokens (colors, spacing, radius, shadows) now drives the admin dashboard and the front-end booking wizard, replacing two independently-drifting color schemes with one consistent look.
• New: real dark mode for the admin dashboard (toggle in the top bar) and the booking wizard (follows the "Dark mode default" setting in Booking Form Designer, or the visitor's system preference).
• Improvement: unified the two duplicate primary-button styles, deduplicated repeated input/card CSS rules.
• Improvement: replaced the booking wizard's step-dot indicator (which broke past 8 steps) with a progress bar that scales to any number of steps.
• Improvement: Booking Form Designer's live preview now matches the real widget's dark-mode and help-box behavior.

2.6.20

• Security: the public "manage booking" reschedule slot-lookup endpoint (/manage/slots) accepted an exclude_booking_id for any booking with no ownership check, which could leak whether a specific booking exists/its schedule. It now only honors that exclusion when the caller supplies the booking's own manage key.

2.6.19

• Security: server now computes booking totals from the actual service/extras/promo-code prices instead of trusting the amount sent by the browser, and payment confirmation (Stripe, PayPal) now verifies the payment actually belongs to the booking being marked paid.
• Security: narrowed several REST API permission checks (agent schedule, promo codes, tools, calendar bookings, field values) to the specific capability each endpoint actually needs, instead of accepting any of several unrelated capabilities.
• Security: booking-form shortcode/block output is now built through an explicit allow-list instead of returning raw markup.
• Fix: bookings using PayPal, WooCommerce, or Cash could get stuck with no way to complete when online payments were enabled; the wizard now routes each payment method correctly.
• Fix: the Gutenberg block's Service, Default Date, Hide Notes, Require Phone, and Compact Layout settings now actually apply to the booking form.
• Fix: booking form now loads its stylesheet correctly on RTL sites.
• Fix: uninstall cleanup now removes all plugin database tables when that option is enabled.
• Improvement: added a database-level lock around slot booking to prevent double-booking under concurrent requests.
• Improvement: admin sidebar now links to Schedule, Holidays, Promo Codes, Form Fields, Notifications, Audit Log, and Tools; added the ability to delete an Agent from the admin UI; Booking Form Designer's Fields Layout panel can add fields back after removing them.
• Fix: corrected garbled/mis-encoded text across the admin UI, booking widget, and block editor.
• Tested up to WordPress 7.1.