Anderson Appointment Booking

Let visitors book appointments with you on your own WordPress site. Open times come live from your Google Calendar (and optionally Outlook), every booking lands in Google Calendar with a Meet link and invite, paid sessions go through Stripe, and the booking calendar looks like it was built for your theme.

Every feature is free. No add-ons, no SaaS in the middle, no build step.

Contents

• Why this plugin
• Features
• How it works
  • Architecture
  • Booking a free appointment
  • Booking a paid appointment
  • Booking lifecycle
  • How open times are calculated
  • Rescheduling
  • Hourly background tasks
• Requirements
• Setup
• Appointment types
• Settings reference
• Styling
• Emails
• Developers
• Security and privacy
• Running it in production
• Troubleshooting
• Research and roadmap

Why this plugin

Built for solo professionals and small businesses who live in Google Calendar: consultants, freelancers, coaches, agencies, therapists, tutors. Compared with the usual WordPress booking plugins (full research):

Features

How it works

Architecture

flowchart LR
    subgraph Visitor["Visitor's browser"]
        W["Booking widget"]
        M["Manage page"]
    end

    subgraph WP["Your WordPress site"]
        REST["REST API<br/>aab/v1"]
        AV["Availability"]
        BK["Bookings"]
        PAY["Payments"]
        CRON["Hourly tasks"]
        DB[("Database")]
    end

    subgraph Ext["External services"]
        G["Google Calendar"]
        MS["Microsoft Graph"]
        S["Stripe"]
    end

    W --> REST
    M --> REST
    REST --> AV
    REST --> BK
    BK --> PAY
    BK --> DB
    CRON --> BK
    CRON --> PAY
    AV -->|free/busy| G
    AV -->|busy times| MS
    BK -->|create, move, delete| G
    PAY -->|checkout, refunds| S
    S -.->|webhook| REST

Booking a free appointment

sequenceDiagram
    autonumber
    actor V as Visitor
    participant W as Widget
    participant R as REST API
    participant B as Bookings
    participant G as Google Calendar
    actor O as You

    V->>W: Pick type, day, time
    W->>R: GET /availability?type=…
    R->>G: freeBusy (cached 2 min)
    G-->>R: busy ranges
    R-->>W: open start times
    V->>W: Name, email, answers
    W->>R: POST /bookings
    R->>R: Honeypot, timing, rate limit, validation
    R->>B: create()
    B->>B: Atomic lock on the start time
    B->>G: freeBusy again (live, no cache)
    alt Time still free
        B->>G: Insert event (fixed ID, Meet, invite)
        G-->>B: Event + Meet link
        B-->>V: Confirmation email with manage link
        B-->>O: New booking email
        R-->>W: Booked
    else Just taken
        R-->>W: 409, reload times
    end

Booking a paid appointment

The slot is held while the visitor pays on Stripe's hosted page. Nothing is confirmed until Stripe says it's paid, and every confirmation path re-reads the payment from Stripe.

sequenceDiagram
    autonumber
    actor V as Visitor
    participant W as Widget
    participant R as REST API
    participant P as Payments
    participant S as Stripe
    participant G as Google Calendar

    V->>W: Submit form for a paid type
    W->>R: POST /bookings
    R->>P: Lock, live re-check, then hold the slot (about 35 min)
    P->>S: Create Checkout Session (idempotency key)
    S-->>P: Session URL
    R-->>W: checkout URL
    W->>S: Redirect to Stripe Checkout
    V->>S: Pays
    par Webhook
        S->>R: checkout.session.completed (signed)
        R->>P: Verify signature, amount, currency
    and Visitor returns
        S-->>V: Redirect to manage page
        V->>R: Manage page asks Stripe for the session
    end
    P->>G: Insert event (safe if both arrive)
    P-->>V: Confirmation email
    Note over P,G: If Google is down after payment, the slot stays held,<br/>you're emailed, and the hourly task retries.

Booking lifecycle

stateDiagram-v2
    [*] --> pending: Free type booked
    [*] --> awaiting_payment: Paid type booked
    pending --> confirmed: Google event created
    awaiting_payment --> confirmed: Paid and Google event created
    awaiting_payment --> expired: Not paid within the hold
    awaiting_payment --> cancelled: Visitor backs out of checkout
    confirmed --> confirmed: Rescheduled (visitor or Google Calendar)
    confirmed --> cancelled: Visitor, you, or deleted in Google Calendar
    cancelled --> [*]
    expired --> [*]

    note right of awaiting_payment
        Holds the slot while unpaid.
        Once paid it holds until confirmed.
    end note
    note right of cancelled
        Paid bookings are refunded:
        always when you cancel,
        before the cut-off when the visitor cancels.
    end note

How open times are calculated

flowchart TD
    A["Date range requested<br/>(one month at a time)"] --> B["Clamp to booking window<br/>today … today + N days"]
    B --> C{"Day off?"}
    C -->|yes| X["No times that day"]
    C -->|no| D["Type's hours or your usual hours<br/>e.g. 09:00-12:00, 13:00-17:00"]
    D --> E["Candidate starts every N minutes<br/>that fit the type's length<br/>(DST-safe, site timezone)"]
    E --> F["Drop starts sooner than minimum notice"]
    F --> G["Busy ranges"]
    G --> G1["Google free/busy<br/>booking calendar + conflict calendars"]
    G --> G2["Outlook calendarView<br/>Busy, Tentative, Out of office"]
    G --> G3["Bookings made here<br/>widened by their buffers<br/>(payment holds included)"]
    G1 & G2 & G3 --> H{"Candidate + buffers<br/>overlaps anything?"}
    H -->|yes| Y["Not offered"]
    H -->|no| I{"Daily cap reached?"}
    I -->|yes| Y
    I -->|no| J["Offered"]
    G1 -. "can't be read" .-> Z["Fail closed:<br/>no times offered"]
    G2 -. "can't be read" .-> Z

Rescheduling

sequenceDiagram
    autonumber
    actor V as Visitor
    participant P as Manage page
    participant R as REST API
    participant B as Bookings
    participant G as Google Calendar

    V->>P: Opens link from any email (token)
    P->>V: Appointment, Reschedule, Cancel
    V->>P: Reschedule
    P->>R: GET /availability?booking=ID&token=…
    Note right of R: The booking's own slot counts as free,<br/>so it can move 30 minutes later.
    R-->>P: Open times for its type
    V->>P: Picks a new time, confirms
    P->>R: POST /bookings/ID/reschedule
    R->>B: Token, cut-off, limit, atomic lock, live re-check
    B->>G: PATCH the same event (same Meet link, guests updated)
    B-->>V: "Moved" email
    B-->>V: Same manage link keeps working

Hourly background tasks

flowchart LR
    T(["WP-Cron, hourly"]) --> S1["Sync with Google Calendar"]
    T --> S2["Reminders"]
    T --> S3["Payments sweep"]
    T --> S4["Retention"]
    S1 --> S1a["Event deleted → cancel booking,<br/>refund if paid, email visitor"]
    S1 --> S1b["Event moved → update booking,<br/>email visitor"]
    S2 --> S2a["Email visitors N hours before,<br/>once, skipping last-minute bookings"]
    S3 --> S3a["Paid but unconfirmed → retry Google"]
    S3 --> S3b["Unpaid and past hold → release"]
    S3 --> S3c["Missed webhook → ask Stripe"]
    S4 --> S4a["Delete records older than N days<br/>(if enabled)"]

Requirements

Setup

Install the plugin (upload the zip under Plugins → Add New) and open Appointments → Settings. Each connection has step-by-step instructions on that screen with the exact URLs to copy.

1. Google Calendar (required)

2. Appointment types

Open Appointments → Appointment types and add what visitors can book (see Appointment types). Upgrading from 1.2 or earlier creates the first type from your old settings.

3. Stripe (optional, for paid types)

Without the webhook, paid bookings still confirm when the visitor returns from Stripe or within the hour.

4. Outlook / Microsoft 365 (optional)

5. Put the calendar on a page

Keeping secrets out of the database

Any of these in wp-config.php takes precedence over the settings screen:

define( 'AAB_GOOGLE_CLIENT_ID', '…apps.googleusercontent.com' );
define( 'AAB_GOOGLE_CLIENT_SECRET', '…' );
define( 'AAB_STRIPE_SECRET_KEY', 'sk_live_…' );
define( 'AAB_STRIPE_WEBHOOK_SECRET', 'whsec_…' );
define( 'AAB_MS_CLIENT_ID', '…' );
define( 'AAB_MS_CLIENT_SECRET', '…' );
define( 'AAB_ENCRYPTION_KEY', 'a long random string' ); // optional: key for secrets stored in the DB

Appointment types

erDiagram
    APPOINTMENT_TYPE ||--o{ QUESTION : asks
    APPOINTMENT_TYPE ||--o{ BOOKING : "booked as"
    BOOKING ||--o| GOOGLE_EVENT : "creates"
    BOOKING ||--o| STRIPE_SESSION : "paid through"
    BOOKING ||--o{ ANSWER : stores

    APPOINTMENT_TYPE {
        string id "used in type=..."
        string name
        int duration "minutes"
        int interval "start times every"
        bool custom_hours
        string location
        string meet "default, on, off"
        int price "minor units, 0 = free"
        bool active
    }
    QUESTION {
        string id
        string label
        string kind "text, textarea, select, checkbox"
        bool required
    }
    BOOKING {
        int id "private post"
        int start "unix"
        int end
        string status
        string email
        string event_id
        int amount
        int paid_at
        int reschedules
    }
    ANSWER {
        string label
        string value
    }

Types share buffers and limits because one calendar holds one appointment at a time: a consult blocks intro calls in the same hour. Deleting a type keeps its bookings, which can still be rescheduled.

Settings reference

Styling

The calendar always uses the surrounding page's font and text color. Appointments → Settings → Appearance adds a live preview rendered inside your actual theme.

flowchart LR
    A["Plugin defaults<br/>(zero specificity)"] --> B["Theme tokens<br/>theme.json or probed from page"]
    B --> C["Appearance settings"]
    C --> D["Block / shortcode overrides"]
    D --> E["Custom CSS"]
    E --> F["Your theme's .aab rules"]
    F --> G(["What visitors see"])

Shortcode attributes

CSS variables

Declared at zero specificity, so a plain .aab { … } rule in your theme wins:

Parts: .aab__types, .aab__type, .aab__type-price, .aab__body, .aab__cal, .aab__month-label, .aab__nav, .aab__day (.is-open, .is-selected), .aab__bar, .aab__panel, .aab__time, .aab__form, .aab__field, .aab__input, .aab__submit, .aab__done, .aab__tz. Calendar buttons are protected from theme button rules with .aab:not(#aab-x) …; use the same prefix, or the variables, to restyle them.

Emails

Google Calendar also emails invited guests its own invites and updates.

Developers

REST API (/wp-json/aab/v1)

Hooks

File map

Development

No build step: edit and reload. CI (GitHub Actions) checks PHP syntax on 7.4 to 8.4 and JavaScript syntax on every push. Release zips come from git archive, which leaves out docs/, .github/ and this README (see .gitattributes).

Security and privacy

Running it in production

Troubleshooting

Research and roadmap

• Competitive analysis: how the WordPress booking plugins compare, with sources
• Roadmap

License

MIT © Jeremy Anderson