{"id":314275,"date":"2026-08-23T13:00:49","date_gmt":"2026-08-23T13:00:49","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/mhm-rentiva\/"},"modified":"2026-10-24T19:42:06","modified_gmt":"2026-10-24T19:42:06","slug":"mhm-rentiva","status":"publish","type":"plugin","link":"https:\/\/sk.wordpress.org\/plugins\/mhm-rentiva\/","author":20854694,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"6.3.1","stable_tag":"6.3.1","tested":"7.1.3","requires":"6.7","requires_php":"8.1","requires_plugins":null,"header_name":"MHM Rentiva","header_author":"MHM Development Team","header_description":"MHM Rentiva is a powerful and flexible vehicle rental management plugin with secure WooCommerce integration for all frontend bookings.","assets_banners_color":"25464c","last_updated":"2026-10-24 19:42:06","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/wpalemi.com\/rentiva\/","header_author_uri":"https:\/\/wpalemi.com\/","rating":5,"author_block_rating":0,"active_installs":0,"downloads":1360,"num_ratings":1,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"6.0.7":{"tag":"6.0.7","author":"maxhandmade","date":"2026-08-23 13:00:27","revision":3661865},"6.1.0":{"tag":"6.1.0","author":"maxhandmade","date":"2026-08-24 20:04:31","revision":3664218},"6.1.3":{"tag":"6.1.3","author":"maxhandmade","date":"2026-08-29 00:20:54","revision":3671033},"6.1.4":{"tag":"6.1.4","author":"maxhandmade","date":"2026-09-08 10:15:39","revision":3686376},"6.1.5":{"tag":"6.1.5","author":"maxhandmade","date":"2026-09-17 03:12:06","revision":3699470},"6.2.0":{"tag":"6.2.0","author":"maxhandmade","date":"2026-10-11 15:23:22","revision":3739680},"6.2.1":{"tag":"6.2.1","author":"maxhandmade","date":"2026-10-13 14:16:36","revision":3744152},"6.3.0":{"tag":"6.3.0","author":"maxhandmade","date":"2026-10-24 18:15:47","revision":3763625},"6.3.1":{"tag":"6.3.1","author":"maxhandmade","date":"2026-10-24 19:42:06","revision":3763691}},"upgrade_notice":{"6.3.1":"<p>Elementor-built pages are found: &quot;Book now&quot; buttons open your booking page again. On Elementor sites the vehicle pages may move under your vehicle-details page (old addresses redirect).<\/p>","6.3.0":"<p>Unticked e-mail templates and the &quot;Send Booking Notifications&quot; switch now really stop sending, and cancelled bookings send the customer one e-mail. Check your e-mail settings and Settings &gt; Payment after updating. Rentiva Pro users: update Pro to 6.4.0 after this.<\/p>","6.2.1":"<p>Privacy fix: Elementor pages with Rentiva widgets could expose the saving user&#039;s account data to site search. A background job cleans affected pages. Purge page caches and search indexes after updating.<\/p>","6.2.0":"<p>Contact attachments move to a private folder and the customer dashboard is retired. Ten hooks were removed: custom code using them stops working. Rentiva Pro 6.1.0 or older breaks on the vendor panel: update Rentiva Pro to 6.3.0.<\/p>","6.0.1":"<p>Cleanup and bug-fix release. No action required; an automatic one-time migration removes some internal database indexes. If you build pages with this plugin&#039;s blocks, this release repairs the favourite and compare buttons on them.<\/p>","6.0.0":"<p>Major release. Data migrates automatically, but 113 hooks and every post type name were renamed: custom code that hooks or queries them stops working silently. See the changelog before updating.<\/p>","5.1.0":"<p>Security hardening and WordPress.org compliance. No action required; your settings and data are unaffected.<\/p>","5.0.2":"<p>Compliance housekeeping and translation improvements. No action required; your settings and data are unaffected.<\/p>","5.0.1":"<p>Maintenance and translation update. No action required.<\/p>","5.0.0":"<p>First WordPress.org release.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3661857,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3661857,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3661857,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3661857,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["6.0.7","6.1.0","6.1.3","6.1.4","6.1.5","6.2.0","6.2.1","6.3.0","6.3.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[269,13605,35555,722,262926],"plugin_category":[40],"plugin_contributors":[277101],"plugin_business_model":[],"class_list":["post-314275","plugin","type-plugin","status-publish","hentry","plugin_tags-booking","plugin_tags-car-rental","plugin_tags-rent-a-car","plugin_tags-reservation","plugin_tags-vehicle-rental","plugin_category-calendar-and-events","plugin_contributors-maxhandmade","plugin_committers-maxhandmade"],"banners":{"banner":"https:\/\/ps.w.org\/mhm-rentiva\/assets\/banner-772x250.png?rev=3661857","banner_2x":"https:\/\/ps.w.org\/mhm-rentiva\/assets\/banner-1544x500.png?rev=3661857","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/mhm-rentiva\/assets\/icon-128x128.png?rev=3661857","icon_2x":"https:\/\/ps.w.org\/mhm-rentiva\/assets\/icon-256x256.png?rev=3661857","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>MHM Rentiva is a vehicle rental management plugin for car and motorcycle rental businesses. You manage your fleet, availability and bookings from the WordPress admin; frontend payments are handled by WooCommerce, and administrators can also create and manage bookings manually.<\/p>\n\n<p>Everything described below works in full. There are no vehicle, booking or listing caps, no feature timers, and no locked screens.<\/p>\n\n<p><strong>Features:<\/strong><\/p>\n\n<ul>\n<li><strong>Vehicle Management:<\/strong> Add, edit and manage your fleet with detailed attributes (transmission, fuel type, seats, and your own custom features and equipment).<\/li>\n<li><strong>Booking System:<\/strong> Booking engine with calendar view, availability checking and automatic price calculation.<\/li>\n<li><strong>Payment via WooCommerce:<\/strong> Frontend payments go through WooCommerce, so you keep whatever payment gateways you already use. Native offline payment is supported for admin-created manual bookings.<\/li>\n<li><strong>Customer Management:<\/strong> Customer records, booking history, and CSV export of your customer list.<\/li>\n<li><strong>Email Notifications:<\/strong> Editable email templates for booking confirmations, cancellations, refunds and reminders.<\/li>\n<li><strong>Customer Account Pages:<\/strong> Bookings, favourites and payment history in the customer's WooCommerce account area.<\/li>\n<li><strong>16 Shortcodes:<\/strong> (one of them, the customer dashboard, retired in 6.2.0 and now only points to My Account) Search, results, vehicle grids and lists, vehicle details, booking form, availability calendar, comparison, testimonials, ratings, contact form, and the customer account views.<\/li>\n<li><strong>16 Gutenberg Blocks:<\/strong> One for each frontend shortcode, built on a Render Parity architecture \u2014 a block, its Elementor widget and its shortcode all delegate to the same renderer, so they produce identical output.<\/li>\n<li><strong>17 Elementor Widgets:<\/strong> The same components as Elementor widgets, with Elementor's own controls and live preview. (Two of the seventeen \u2014 Vehicle Card and Vehicles List \u2014 render the same underlying component with different presets, so the seventeen widgets cover sixteen distinct components.)<\/li>\n<li><strong>REST API:<\/strong> Endpoints under <code>mhm-rentiva\/v1<\/code> for availability checks, customer records and admin dashboard data.<\/li>\n<li><strong>Translation Ready:<\/strong> Ships with a full Turkish translation.<\/li>\n<\/ul>\n\n<p><strong>Documentation and support<\/strong><\/p>\n\n<ul>\n<li><a href=\"https:\/\/maxhandmade.github.io\/mhm-rentiva-docs\/\">Documentation<\/a> \u2014 setup, shortcodes, blocks and Elementor widgets, in English and Turkish<\/li>\n<li><a href=\"https:\/\/wordpress.org\/support\/plugin\/mhm-rentiva\/\">Support forum<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/MaxHandMade\/mhm-rentiva\">Source code and issue tracker on GitHub<\/a><\/li>\n<li><a href=\"https:\/\/wpalemi.com\/\">wpalemi.com<\/a> \u2014 the author's site<\/li>\n<li><a href=\"https:\/\/www.youtube.com\/channel\/UC3qBE6ZCCEc8ugFUYXwtcpA\">MaxHandMade on YouTube<\/a> \u2014 WordPress and WooCommerce videos from the author<\/li>\n<\/ul>\n\n<p><strong>Requirements:<\/strong> WooCommerce. It is declared in the plugin header and checked on activation, so the plugin will not activate without it. WooCommerce provides the cart, checkout and payment gateways used for frontend bookings.<\/p>\n\n<h4>External services<\/h4>\n\n<p>This plugin does not send your data anywhere. It makes no requests to any third-party service: no analytics, no geolocation lookups, no remotely-hosted fonts or scripts. Every asset it loads, including its webfont, is served from your own site. Nothing about your site, your bookings or your customers leaves your server.<\/p>\n\n<p>For completeness, the plugin's admin screens do contain ordinary hyperlinks to pages outside your site, which open only if you click them and send nothing when you do:<\/p>\n\n<ul>\n<li>Its documentation at <a href=\"https:\/\/maxhandmade.github.io\/mhm-rentiva-docs\/\">https:\/\/maxhandmade.github.io\/mhm-rentiva-docs\/<\/a> (source: <a href=\"https:\/\/github.com\/MaxHandMade\/mhm-rentiva-docs\">https:\/\/github.com\/MaxHandMade\/mhm-rentiva-docs<\/a>)<\/li>\n<li>Its issue tracker at <a href=\"https:\/\/github.com\/MaxHandMade\/mhm-rentiva\/issues\">https:\/\/github.com\/MaxHandMade\/mhm-rentiva\/issues<\/a>, linked from the About screen<\/li>\n<li>The author's site and support page at <a href=\"https:\/\/wpalemi.com\/\">https:\/\/wpalemi.com\/<\/a> \u2014 terms: <a href=\"https:\/\/wpalemi.com\/terms\/\">https:\/\/wpalemi.com\/terms\/<\/a> , privacy policy: <a href=\"https:\/\/wpalemi.com\/privacy\/\">https:\/\/wpalemi.com\/privacy\/<\/a><\/li>\n<li>This plugin's own support forum at <a href=\"https:\/\/wordpress.org\/support\/plugin\/mhm-rentiva\/\">https:\/\/wordpress.org\/support\/plugin\/mhm-rentiva\/<\/a> and, in the setup wizard's e-mail step, links to the wp-mail-smtp and fluent-smtp plugin pages on WordPress.org<\/li>\n<li>The author's YouTube channel at <a href=\"https:\/\/www.youtube.com\/channel\/UC3qBE6ZCCEc8ugFUYXwtcpA\">https:\/\/www.youtube.com\/channel\/UC3qBE6ZCCEc8ugFUYXwtcpA<\/a>, linked from the About screen<\/li>\n<\/ul>\n\n<p>These are links, not integrations: the plugin performs no HTTP request to any of them. A check in our build guards against reintroducing the specific third-party services earlier versions used \u2014 geolocation lookups, CDN-hosted fonts and scripts, analytics and Gravatar \u2014 by failing if any of those hosts reappears in the PHP we ship.<\/p>\n\n<h4>Privacy<\/h4>\n\n<p>MHM Rentiva stores its booking and customer records (such as names, e-mail addresses and phone numbers) locally in your WordPress database and does not transmit them anywhere.<\/p>\n\n<p>Four other things it keeps are worth naming; three of them record an IP address, which in most jurisdictions counts as personal data in its own right.<\/p>\n\n<p>If you publish the plugin's <strong>contact form<\/strong>, each submission is saved as a private record holding the sender's name, e-mail address, telephone number, company, the message itself, any file they attached, and the <strong>IP address<\/strong> and <strong>browser user-agent<\/strong> it was sent from. The record also keeps the rest of what the form submitted: which vehicle the enquiry was about, a preferred date, a priority, a rating, and which variant of the form was used. These records have no retention setting and are never removed automatically; you read and delete them yourself under MHM Rentiva \u2192 Contact Messages. Files attached to a contact message are stored in a plugin-owned folder inside your uploads directory (<code>wp-content\/uploads\/mhm-rentiva-private\/contact\/<\/code>) under a random name with no file extension. They are <strong>not encrypted<\/strong>. On Apache the folder ships with an <code>.htaccess<\/code> that denies direct access; on nginx you must add a <code>location ^~ \/wp-content\/uploads\/mhm-rentiva-private\/ { deny all; }<\/code> rule yourself, otherwise the only protection is the unguessable name and the folder's empty index page. If you use a plugin that copies every upload to external storage (a CDN or cloud offload plugin), exclude the <code>mhm-rentiva-private<\/code> folder in its settings, or it may copy these files as well \u2014 or, if it moves files away from your server, contact attachments may fail to upload. The file is deleted when the message is permanently deleted, and when the plugin is deleted with its \"Wipe all data on uninstall\" setting turned on. On a multisite network that wipe covers the main site only: delete the other sites' <code>mhm-rentiva-private\/contact\/<\/code> folders by hand. A copy is also sent as an attachment of the notification e-mail, which this plugin does not control once sent. Attachments saved by earlier versions were public files in the normal uploads folder; updating moves those it can positively identify into the private folder and lists the rest in an admin notice.<\/p>\n\n<p>If you publish the plugin's <strong>rating form<\/strong>, each review is stored as an ordinary WordPress comment, so WordPress itself records the reviewer's IP address and browser user-agent alongside it, exactly as it does for any comment \u2014 and for a review left by someone who is not logged in, the name and e-mail address they typed. Those guest reviews are reachable through Tools \u2192 Export\/Erase Personal Data, which matches comments by e-mail address. From version 6.0.1, a review left by a logged-in customer is saved the same way WordPress saves any comment from a signed-in visitor: against their user ID, and with the display name, e-mail address and website address from their profile written onto the comment. Those reviews are matched by the same Export\/Erase tools, on the account's e-mail address. Reviews that logged-in customers left in earlier versions carry no name and no e-mail address on the comment, and updating does not fill them in, so the Export\/Erase tools \u2014 which look comments up by e-mail address \u2014 do not return those older ones; remove them from the Comments screen instead.<\/p>\n\n<p>The <strong>activity log<\/strong> records, for each entry, the IP address and browser user-agent of the request that produced it, along with the WordPress user ID where there is one. Unlike contact messages, log entries are deleted automatically after a retention period you set in the plugin's settings (30 days by default).<\/p>\n\n<p>The <strong>e-mail log<\/strong> records, for each message sent through the plugin's notification system, the recipient address, the subject, whether delivery succeeded, and the booking details the message was built from \u2014 which for a booking e-mail means the customer's name, contact details and rental dates. The assembled message body itself is not stored. This log has its own retention setting on the same terms (also 30 days by default).<\/p>\n\n<p>Booking records themselves do not store an IP address: no code path in this version writes one, whether the booking comes through WooCommerce checkout or an administrator enters it by hand. Records created by older versions may still carry an IP address and user-agent; where they exist they have no expiry and go only when the booking is permanently deleted.<\/p>\n\n<p>If you keep a privacy policy, these are the parts of the plugin it should describe.<\/p>\n\n<p>The plugin registers no personal-data exporter or eraser. Contact-form submissions are not covered by Tools \u2192 Export\/Erase Personal Data: search for them by e-mail address under MHM Rentiva \u2192 Contact Messages and delete them there.<\/p>\n\n<h4>A paid version exists<\/h4>\n\n<p>A separate paid Rentiva plugin adds a multi-vendor marketplace, VIP transfers with location-based routes, customer messaging, advanced reports and vendor payouts. It is a separate add-on plugin. Nothing described on this page is withheld or limited to promote it, and this plugin never advertises it to you in the admin.<\/p>\n\n<h3>Source code<\/h3>\n\n<p>Most of this plugin is plain, human-readable PHP with no build step.<\/p>\n\n<p>Five admin screens (Dashboard, Customers, Contact Messages, About and Shortcode Pages) are built in React. Their compiled bundles ship in <code>build\/admin\/<\/code>. They are generated from un-minified React sources that are NOT part of this ZIP: those live in the public GitHub repository linked below, under <code>src-react\/<\/code>, next to the build tooling. What does ship under <code>src-react\/<\/code> is plain CSS: the five screens' stylesheets and the shared admin stylesheet (<code>src-react\/shared\/admin.css<\/code>) that the vehicle, booking and add-on list screens load directly. No obfuscated code is bundled.<\/p>\n\n<p>The build tooling itself (<code>package.json<\/code>, <code>webpack.config.js<\/code>) is not included in this plugin's ZIP -- it lives only in the public GitHub repository, alongside the same <code>src-react\/<\/code> sources:<\/p>\n\n<p><a href=\"https:\/\/github.com\/MaxHandMade\/mhm-rentiva\">https:\/\/github.com\/MaxHandMade\/mhm-rentiva<\/a><\/p>\n\n<p>To rebuild the admin bundles from source, clone or download that repository and run the following from the repository root:<\/p>\n\n<pre><code>npm install\nnpm run build\n<\/code><\/pre>\n\n<p>The build uses <a href=\"https:\/\/www.npmjs.com\/package\/@wordpress\/scripts\">@wordpress\/scripts<\/a> (webpack). Run <code>npm start<\/code> instead of <code>npm run build<\/code> for a watched development build.<\/p>\n\n<h4>Bundled third-party libraries<\/h4>\n\n<p>Three bundled JavaScript libraries and one webfont ship with the plugin -- two of the libraries on the front end, one in the admin dashboard only -- all permissively licensed and with public upstream source.<\/p>\n\n<p>Two are pre-built (minified) under <code>assets\/vendor\/<\/code>:<\/p>\n\n<ul>\n<li><strong>flatpickr<\/strong> v4.6.13 \u2014 date picker, MIT License. Source: <a href=\"https:\/\/github.com\/flatpickr\/flatpickr\">https:\/\/github.com\/flatpickr\/flatpickr<\/a><\/li>\n<li><strong>Swiper<\/strong> 14.1.0 \u2014 touch slider, MIT License. Source: <a href=\"https:\/\/github.com\/nolimits4web\/swiper\">https:\/\/github.com\/nolimits4web\/swiper<\/a><\/li>\n<\/ul>\n\n<p>One is compiled into the admin dashboard bundle (<code>build\/admin\/dashboard.js<\/code>) by the build described above, and is declared as a dependency in <code>package.json<\/code>:<\/p>\n\n<ul>\n<li><strong>Chart.js<\/strong> v4.5.1 \u2014 dashboard charts, MIT License. Source: <a href=\"https:\/\/github.com\/chartjs\/Chart.js\">https:\/\/github.com\/chartjs\/Chart.js<\/a><\/li>\n<\/ul>\n\n<p>One webfont is bundled under <code>assets\/vendor\/fonts\/<\/code>, served from your own site rather than from a font CDN:<\/p>\n\n<ul>\n<li><strong>Plus Jakarta Sans<\/strong> \u2014 SIL Open Font License 1.1, with the license text shipped alongside it at <code>assets\/vendor\/fonts\/LICENSE-Plus-Jakarta-Sans.txt<\/code>. Source: <a href=\"https:\/\/github.com\/tokotype\/PlusJakartaSans\">https:\/\/github.com\/tokotype\/PlusJakartaSans<\/a><\/li>\n<\/ul>\n\n<p>None of these libraries is modified from its upstream release; their full source is public on the repositories linked above.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to the <code>\/wp-content\/plugins\/mhm-rentiva<\/code> directory, or install the plugin through the WordPress plugins screen directly.<\/li>\n<li>Activate the plugin through the 'Plugins' screen in WordPress.<\/li>\n<li>Install and activate WooCommerce first. It is a required dependency: activation is refused without it.<\/li>\n<li>Use the Settings menu to configure your vehicle features, equipment, and module preferences.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20it%20work%20with%20woocommerce%3F\"><h3>Does it work with WooCommerce?<\/h3><\/dt>\n<dd><p>It requires it. WooCommerce handles frontend checkout and payment, so your existing payment gateways\nwork as they are, and the plugin will not activate without it. Bookings an administrator creates by\nhand can still be settled offline, without going through checkout.<\/p><\/dd>\n<dt id=\"can%20i%20add%20custom%20features%20to%20vehicles%3F\"><h3>Can I add custom features to vehicles?<\/h3><\/dt>\n<dd><p>Absolutely. You can add, rename, or remove custom features and equipment via the Vehicle Settings page.<\/p><\/dd>\n<dt id=\"are%20there%20any%20limits%20on%20how%20many%20vehicles%20or%20bookings%20i%20can%20have%3F\"><h3>Are there any limits on how many vehicles or bookings I can have?<\/h3><\/dt>\n<dd><p>No. There are no caps of any kind.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20contact%20any%20external%20server%3F\"><h3>Does the plugin contact any external server?<\/h3><\/dt>\n<dd><p>No. It makes no third-party requests at all \u2014 see the \"External services\" section above.<\/p><\/dd>\n<dt id=\"is%20it%20mobile-ready%3F\"><h3>Is it mobile-ready?<\/h3><\/dt>\n<dd><p>Yes, all frontend components and admin settings are fully responsive.<\/p><\/dd>\n<dt id=\"does%20it%20work%20on%20a%20wordpress%20multisite%20network%3F\"><h3>Does it work on a WordPress multisite network?<\/h3><\/dt>\n<dd><p>Yes, and it can be network-activated. One limit is worth knowing before you plan around it: the\nparts that manage WordPress user accounts -- the Customers screens and creating a customer account\nfrom a booking -- require a Super Admin. WordPress itself reserves user management for the network\nlevel on multisite, so a site administrator will not see those screens even though they can use\neverything else. Vehicles, bookings, add-ons, payments and all frontend features work normally for\na site administrator.<\/p><\/dd>\n<dt id=\"which%20page%20builders%20are%20supported%3F\"><h3>Which page builders are supported?<\/h3><\/dt>\n<dd><p>Gutenberg and Elementor, plus plain shortcodes for any other theme or builder. All three render identical output.<\/p><\/dd>\n<dt id=\"why%20does%20wp-login.php%20send%20me%20to%20the%20my%20account%20page%2C%20and%20can%20i%20turn%20that%20off%3F\"><h3>Why does wp-login.php send me to the My Account page, and can I turn that off?<\/h3><\/dt>\n<dd><p>By default the plugin routes wp-login.php to your WooCommerce My Account page, so customers meet one\nlogin form styled like the rest of your site rather than the plain WordPress one. It deliberately steps\naside where the real form is needed: submitting the login form itself, logging out, password reset and\nlost-password links, e-mail confirmation links, anyone who can manage plugins, and any site where\nWooCommerce is inactive.<\/p>\n\n<p>If you would rather keep the standard WordPress login page, add this to your theme's functions.php or a\nsmall plugin of your own:<\/p>\n\n<pre><code>add_filter( 'mhmrentiva_takeover_login', '__return_false' );\n<\/code><\/pre>\n\n<p>The default is <code>true<\/code>. The filter is read while the plugin sets up its hooks, on the <code>init<\/code> action at\npriority 2, so add it somewhere that runs before then \u2014 a theme's functions.php or an ordinary plugin\nfile is early enough.<\/p><\/dd>\n<dt id=\"my%20site%20is%20behind%20cloudflare%20%28or%20another%20reverse%20proxy%20%2F%20cdn%29%20%E2%80%94%20will%20rate%20limiting%20still%20work%20correctly%3F\"><h3>My site is behind Cloudflare (or another reverse proxy \/ CDN) \u2014 will rate limiting still work correctly?<\/h3><\/dt>\n<dd><p>By default, no \u2014 and this is worth fixing. The plugin's anonymous rate limits (contact form submissions,\nprice and availability lookups on the booking form, and others) are counted per visitor IP address, read\nfrom the server's <code>REMOTE_ADDR<\/code>. Behind Cloudflare or any reverse proxy, <code>REMOTE_ADDR<\/code> is the proxy's own\nedge IP, the same for every visitor \u2014 so instead of limiting each visitor separately, the plugin\neffectively limits your whole site to one shared bucket (for example, the contact form's default of 5\nsubmissions per 5 minutes becomes 5 submissions per 5 minutes for every visitor combined).<\/p>\n\n<p>This default is intentional, not an oversight: trusting a header like <code>X-Forwarded-For<\/code> automatically\nwould let anyone bypass rate limiting outright, since that header can be set by any visitor unless your\nproxy is configured to overwrite it. If you know your proxy overwrites it \u2014 which Cloudflare does \u2014 you\ncan opt the specific header back in:<\/p>\n\n<pre><code>add_filter( 'mhmrentiva_trusted_proxy_ip_headers', function () {\n    return array( 'HTTP_CF_CONNECTING_IP' ); \/\/ Cloudflare\n} );\n<\/code><\/pre>\n\n<p>Add this to your theme's functions.php or a small plugin of your own. List headers in priority order \u2014\nthe plugin uses the first one present that holds a valid public IP address, falling back to <code>REMOTE_ADDR<\/code>\nif none match. Only add a header your proxy is actually configured to set and protect; adding one that\nordinary visitors can also send re-opens the bypass this default closes.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<p>WordPress.org renders at most 5,000 characters of this section, so only the releases published since the version currently in the directory are repeated here. The complete history, in English and Turkish, ships with the plugin as changelog.json and changelog-tr.json, 6.0.0's breaking-change notice among them.<\/p>\n\n<h4>6.3.1<\/h4>\n\n<ul>\n<li>Fixed: pages built with Elementor are found, so \"Book now\" buttons and other links no longer fall back to the home page and Shortcode Pages no longer lists them as missing. A page with the shortcode or block in its content still wins. On Elementor sites whose vehicle-details page is now found, vehicle pages move under that page, with a 301 from \/vehicle\/...<\/li>\n<li>Fixed: translation tokens in notices are written {key}, which WordPress.org's translation checks accept; the Turkish catalogue uses translate.wordpress.org's plural formula.<\/li>\n<\/ul>\n\n<h4>6.3.0<\/h4>\n\n<ul>\n<li>New: Settings &gt; Payment has a site-wide rental deposit: full payment or a percentage (default 10%, as before). A vehicle's own rate still wins; an empty vehicle field now follows the site setting instead of charging in full.<\/li>\n<li>New: in the Elementor and block editors, Rentiva widgets show safe previews: account widgets show sample rows, never your own data, and forms are inert.<\/li>\n<li>New: all Rentiva blocks sit in a \"Rentiva\" category; block settings panels and Elementor \"Additional Settings\" are translatable, and the Turkish translation was reviewed end to end.<\/li>\n<li>Changed: a vehicle whose service type is \"transfer only\" can no longer be rented; it is hidden from rental lists and the server refuses the booking.<\/li>\n<li>Changed: e-mail templates whose \"Enabled\" box is unticked are no longer sent. On cancellation the customer gets one \"Booking Cancelled\" e-mail instead of two. Customer e-mails use the site language. The \"Admin Email\" fields are now used. The \"Send Booking Notifications\" switch now really stops the booking confirmation, reminder and cancellation e-mails to customers. The admin alerts sent directly (needs review, refund failed, mixed currency, order cancelled) and the admin copy of a cancellation are still sent when \"Enable Outgoing Emails\" is off.<\/li>\n<li>Changed: the search form hides the drop-off field unless a page turns it on (show_dropoff_location=\"true\").<\/li>\n<li>Security: the booking form checks the return time, required add-ons and the payment type on the server; vehicle titles and plates are always handled as text in scripts.<\/li>\n<li>Fixed: saving or editing a booking in the admin keeps add-ons, the deposit and weekend pricing, and refuses dates the vehicle is not free for.<\/li>\n<li>Fixed: the customer's booking page tells the truth about status and payment, and the booking number is the same everywhere.<\/li>\n<li>Fixed: the cart shows \"[vehicle name] rental\" with the vehicle image, one priced row per add-on, and no return row on transfers; prices follow the store's currency format.<\/li>\n<li>Fixed: unavailable dates show the notice and alternatives; rating bars count 1 and 2 stars; comparison table defaults; login links under reviews; English strings in Turkish admin screens. Full list in changelog.json.<\/li>\n<\/ul>\n\n<h4>6.2.1<\/h4>\n\n<ul>\n<li>Security: Rentiva Elementor widgets wrote the saving user's bookings, payment history, favourites, e-mail address and security tokens into the plain-text copy Elementor stores in the post content, which the site search could find on published pages. They now write nothing into Elementor's plain-text and markdown copies and are never stored in Elementor's shared element cache.<\/li>\n<li>Fixed: a one-time background job rebuilds the stored plain text of affected Elementor pages in batches through WP-Cron, without changing their modified date or creating revisions. Purge page caches and search indexes after updating. Older revisions keep the old text and are visible only to users who can edit the page.<\/li>\n<\/ul>","raw_excerpt":"Vehicle rental management for WordPress: fleet, availability, bookings and customers, with WooCommerce handling frontend payments.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/314275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=314275"}],"author":[{"embeddable":true,"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/maxhandmade"}],"wp:attachment":[{"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=314275"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=314275"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=314275"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=314275"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=314275"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/sk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=314275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}