Stayhatch Booking

Stayhatch Booking lets an accommodation owner accept direct booking requests from a WordPress site. It supports multiple units, optional combined bookings, availability calendars, seasonal pricing, minimum and maximum stays, cleaning fees, owner blocks, email workflows with owner notifications, manual payment instructions, and iCalendar import/export for channels such as Booking.com and Airbnb. Booking requests are protected against abuse with a maximum stay per request, rate limiting, optional Cloudflare Turnstile, and by keeping unreviewed requests out of channel exports. The plugin is translation-ready; translations are delivered through translate.wordpress.org. Card payments with Stripe Checkout (deposits, balance payments, refunds, and disputes) are available in the separate Stayhatch Booking Pro add-on. This plugin is fully functional without it. Add the Stayhatch Booking block in the editor or use [stayhatch_booking]. For developers Add-ons load on the stayhatch_booking_loaded action. Other extension points: stayhatch_reconcile (runs every 15 minutes), stayhatch_compose_mail, stayhatch_mail_kinds, stayhatch_mail_job_stale, stayhatch_owner_event_titles, stayhatch_booking_panels, stayhatch_booking_list_note, stayhatch_guard_edit, stayhatch_privacy_retain, stayhatch_mail_queue_ids and stayhatch_client_ip (the visitor address used for rate limiting behind a proxy). External services iCalendar imports are optional. When an administrator adds a feed, WordPress requests that exact HTTPS URL and stores unavailable dates, event identifiers, feed name, unit mapping, fetch time, and errors. Data use is governed by the selected calendar provider's terms and privacy policy. Cloudflare Turnstile is optional and off by default. When an administrator defines STAYHATCH_TURNSTILE_SITE_KEY and STAYHATCH_TURNSTILE_SECRET, the booking form loads Cloudflare's challenge script and the server sends the challenge token and the visitor's IP address to Cloudflare to verify the request. Terms and privacy information: https://www.cloudflare.com/website-terms/ and https://www.cloudflare.com/privacypolicy/ The plugin itself does not contact Stayhatch or require a Stayhatch account.

1.2.0

• New name: Stayhatch Booking.
• New booking references start with SH-; existing references are unchanged.
• Setup and email notices appear only on the plugin's own screens (and the setup notice on the Plugins screen), and the setup notice can be dismissed permanently.
• Quote signatures and rate-limit keys use a dedicated site secret instead of WordPress authentication salts.
• Translations are loaded from translate.wordpress.org instead of bundled files.
• Fix: the booking calendar and price check now work on sites that use plain permalinks.

1.1.1

• Fix: with block themes such as Twenty Twenty-Five the booking form fell back to a plain page reload, because its script settings were added before the script was registered.

1.1.0

• Card payments moved to the separate Stayhatch Booking Pro add-on; existing payment data is kept and works again once the add-on is active.
• All texts are translatable, including emails and the booking form script.
• Extension hooks for payment add-ons: stayhatch_booking_loaded, stayhatch_compose_mail, stayhatch_mail_kinds, stayhatch_mail_job_stale, stayhatch_owner_event_titles, stayhatch_booking_panels, stayhatch_booking_list_note, stayhatch_guard_edit, stayhatch_privacy_retain.
• Expiry of unreviewed requests now runs from the core scheduled task.
• New guest email template for bookings awaiting manual payment.
• Weekday names in the public calendar follow the site language.

1.0.2

• Administrators see a warning and a menu counter when booking requests await review while email is turned off.
• Owner notifications now name the guest, link to the booking, state the hold deadline, and quote the message sent to the guest.
• Email, payment page, and Stripe panel amounts use the booking's own currency.
• Personal-data erasure handles guests with more than 50 bookings.
• The bookings list is paginated; the mail worker, Stripe check, and calendar export only read relevant bookings.
• An accommodation with only past bookings can now be removed.
• The Stripe return page works with block themes.
• Versioned data migrations.

1.0.1

• Security: maximum nights per online request (default 30) so one request cannot hold a whole year.
• Security: unreviewed requests are no longer exported to channel calendars unless the administrator enables it.
• Security: optional Cloudflare Turnstile check on booking requests; stayhatch_client_ip filter for sites behind a proxy.
• Fix: Stripe amounts are converted correctly for currencies without minor units (for example JPY) and with three decimals; such prices must be whole amounts.
• Fix: the scheduled Stripe check only polls payments that can still change instead of every historic booking.
• Fix: the booking form works on sites without HTTPS and in older browsers without crypto.randomUUID.

1.0.0

• Initial product release.
• Multiple accommodation units, pricing, availability, email, Stripe, privacy tools, and iCalendar channels.