Booking for WordPress that cannot double-book
Most booking plugins check whether a time is free, and then save the booking. Two customers can pass that check at the same instant and both get saved. SureBook does not check and then save.
A booking is written as a single, indivisible database operation guarded by a uniqueness constraint on the resource and the exact time slot. Two overlapping requests can arrive at the same moment; the database itself guarantees only one of them wins. That is not a claim about how carefully the code is written — it is a property of the database, which is the difference that matters when your calendar is busy.
What it does
| Appointments | Fixed-length bookings picked from a list of free times, with per-resource opening hours, buffers and one-off exceptions. |
|---|---|
| Rentals | Flexible-length hire — a room for an afternoon, equipment for four days — priced by exact proration, including overnight and multi-day spans. |
| Payments | In person, or online by card through Stripe. Apple Pay and Google Pay included. Deposits are authorised and captured properly rather than tracked as a flag. |
| Cancellations | Customers can move or cancel their own booking from a link in their confirmation email. Refunds on cancellation are optional, with a notice period you set. |
| WooCommerce | Optional. SureBook works standalone; if you already run WooCommerce it can use your existing checkout instead. |
It shows you what runs on your payment page
The scripts on a WordPress checkout come from the theme, from every plugin installed, and from whatever those plugins load off other companies' domains. Almost nobody can name them, which is a problem, because the realistic attack on an online payment form is a script that was not there yesterday.
SureBook lists them — every script on the page where your customers pay, traced back to the plugin, theme or outside domain it came from. It records that list as a baseline, and tells you when something appears, changes or disappears. A new script from a domain you have not accepted is the one thing it treats as urgent.
What it does not do
It does not tell you whether you are PCI compliant, and no plugin honestly can. It reports facts about your own site and states what the standard asks of you. What that is worth is a decision for your assessor, not for us.
Card details never reach your server
Card numbers are typed directly into fields hosted by Stripe and go straight to Stripe. They do not pass through your WordPress site, your database, or anything of ours. Your server stores an identifier for the payment and nothing that could be used to make another one.
Price
The plugin is free, and every payment method is included in it. There is no feature in the free plugin that is switched off until you pay.
A paid tier is in development, covering the things a plugin running inside your site structurally cannot do for itself: scheduled work that does not depend on someone visiting your site, and monitoring your payment page from outside, where a compromised site cannot show the monitor a clean copy. It is not available yet, and this page will say so until it is.
Try it
There is a working demonstration at rig.pharos-secure.com, running against Stripe's test environment. Nothing is charged and no appointment is really reserved.