OpenStay WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

Zero-friction booking manager for a single place: public availability calendar and list, front-end management for the owner, private iCal sync.

Public Calendar & List

• Show availability with the [openstay] shortcode or the OpenStay block (with per-page display options)
• Choose between month and multi-month year views, powered by a locally bundled FullCalendar (no CDN)
• Display an optional reservations list below the calendar
• Mask private entries behind a configurable public label (e.g. "Unavailable") so visitors never see internal names
• Match your site: each reservation type gets its own name and color

Front-End Management

• Add, edit and delete reservations directly on the public page when logged in as administrator — no back-office round trips
• Create as many reservation types as you need, each with a "show name publicly" toggle
• Choose which optional fields appear in the reservation popup: email, phone, arrival/departure times, internal note
• Set overlap-safe dates: server-side validation keeps entries consistent

Calendar Sync (iCal)

• Subscribe from Google Calendar, Apple Calendar or Outlook via a private, read-only .ics feed
• Generate the feed URL with a secret token (~190 bits of entropy) and regenerate it in one click if it ever leaks
• Feed exposes the same anonymized window as the public calendar: no internal notes, no hidden names

Key Features

• Multilingual: works with content in any language; calendar UI follows the site locale
• Translation-Ready: all strings are internationalized (French translation included)
• Secure: capability checks on every write, REST permission callbacks, nonces, secret-token iCal feed
• Private by Design: non-public reservation types are masked on the calendar, the list and the iCal feed
• Self-Contained: FullCalendar is bundled locally — no external CDN or third-party service
• GitHub Updates: automatic updates from GitHub releases

Requirements

• WordPress 6.5 or higher
• PHP 7.4 or higher

Installation

1. Upload the openstay folder to /wp-content/plugins/
2. Activate the plugin through the Plugins menu in WordPress
3. Go to Reservations in the WordPress admin menu and configure your place name, reservation types and display options
4. Paste the [openstay] shortcode into any page — or add the OpenStay block in the editor

FAQ

How do I display the calendar?

Paste the [openstay] shortcode into any page, or add the OpenStay block in the editor. The block also offers per-page display options (year button, list, popup fields).

Can visitors see guest names?

Only for types where "Show name publicly" is ticked. All other entries appear under the public label you set (e.g. "Unavailable"), on the calendar, in the list and in the iCal feed.

Can someone other than an administrator manage reservations?

Yes, map management to another capability with the openstay_capability filter:

add_filter( 'openstay_capability', function() {
    return 'edit_others_posts';
} );

How do I see reservations in my own calendar app?

Go to Reservations, copy the private iCal URL and subscribe to it from Google Calendar, Apple Calendar or Outlook. If the URL leaks, click Regenerate URL — the old link stops working immediately.

Does deactivating the plugin delete my reservations?

No. Data is removed only when the plugin is uninstalled, and only if you ticked "Permanently delete all reservations" in the settings.

Project Structure

.
├── openstay.php                      # Main plugin file (constants, bootstrap, row meta)
├── uninstall.php                     # Opt-in cleanup on uninstall
├── README.md
├── assets
│   ├── css
│   │   ├── openstay.css              # Public calendar/list styles
│   │   ├── openstay-block.css        # Block editor preview styles
│   │   └── openstay-settings.css     # Settings page styles
│   └── js
│       ├── openstay.js               # Calendar, list and management popup
│       ├── openstay-block.js         # Gutenberg block registration
│       ├── openstay-settings.js      # Settings page (types repeater, copy button)
│       └── vendor
│           └── fullcalendar          # Bundled FullCalendar v6 (+ locales)
├── includes
│   ├── class-block.php               # Gutenberg block (wraps the shortcode renderer)
│   ├── class-github-updater.php      # GitHub auto-updates
│   ├── class-ical.php                # Private read-only iCal feed
│   ├── class-installer.php           # Table creation and upgrades
│   ├── class-permissions.php         # Capability and token checks
│   ├── class-plugin.php              # Bootstrap: wires everything together
│   ├── class-repository.php          # Database access
│   ├── class-rest-controller.php     # REST routes (openstay/v1)
│   ├── class-settings.php            # Settings page and accessors
│   ├── class-shortcode.php           # [openstay] shortcode and assets
│   ├── class-validation.php          # Server-side input validation
│   └── Parsedown.php                 # Markdown parser for the update popup
├── languages
│   ├── openstay-fr_FR.mo             # French translation (binary)
│   ├── openstay-fr_FR.po             # French translation (source)
│   └── openstay.pot                  # Translation template
└── templates
    └── openstay-page.php             # Front-end markup template

Changelog

1.0.4 - 2026-07-13

• Fixed: Booked day tiles now show their day number in white for better contrast against the colored tile, matching today's highlighted date
• Fixed: The status-message area no longer reserves an empty gap above the calendar; it stays in the DOM as an accessibility live region but collapses until a success or error message is shown

1.0.3 - 2026-07-12

• Fixed: The reservation popup no longer appears behind the site header on themes whose layout traps it in a stacking context, such as Divi 5. The modals are now rendered at the end of <body> and sit above the header and admin bar

1.0.2 - 2026-07-12

• Fixed: Day tiles no longer collapse into thin strips (and year-view tiles no longer vanish) under themes that add global table-cell padding, such as Divi 5
• New: Same-day turnovers are shown clearly — when one stay checks out on the day another checks in, the day is split diagonally in both stays' colors. A checkout day with no same-day arrival shows a half tile for the departure morning

1.0.1 - 2026-07-12

• New: Configurable front-end card background color (Reservations → Display → Background color), with a "Reset to default" control

1.0.0 - 2026-07-12

• Initial release
• Public availability calendar and optional list via the [openstay] shortcode or the OpenStay block
• Front-end reservation management for administrators (add, edit, delete)
• Configurable reservation types with per-type name, color and "show name publicly" toggle
• Private, read-only iCal feed with a secret, regeneratable token
• Automatic updates from GitHub releases, with a "View details" popup fed by this README
• Guilamu Bug Reporter integration ("🐛 Report a Bug" link on the Plugins screen)

Security

If you discover a security vulnerability in this plugin, please report it responsibly through GitHub Security Advisories. Do not open a public issue for security reports.

Contributing

Contributions are welcome! Please open an issue or submit a pull request on GitHub.

For translations, the plugin uses WordPress i18n. You can contribute translations by editing the .po files in the languages/ directory and generating the corresponding .mo files with the wp i18n CLI commands.

License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) — see the LICENSE file for details.

Made with love for the WordPress community