How Guests Book a Table: Reservation Codes, Spam Protection and Confirmation

An online booking page is convenient for guests, and an open door for fake bookings and tables that stay empty. BiteTwo gives you two ways to let guests book, and both are built so that a reservation stands for a real person. This post shows the guest's side of a reservation, step by step.

The booking page

Every restaurant has its booking page at /reservations/your-address, the same address as your public menu. While guests can book, the public menu shows a Reserve a table button.

The guest chooses the number of people, a day and one of the free start times. Depending on your settings they may also choose an area or a table on the floor plan. Then they enter their name and email address, and optionally a phone number and a note such as "high chair". The page speaks the guest's language: English, German, Spanish, French, Italian, Czech or Portuguese.

Booking with a reservation code

In the mode Guests with a code, only people with a code from you see the free times. You and your staff create codes on the Reservations page, under Codes:

• a label, for example "Regulars" or "Wedding Smith",
• the maximum number of bookings (one, a few, or unlimited),
• an optional valid until date.

Each code is 8 characters long and can be shared as a link that fills it in. BiteTwo counts how often a code has been used, refuses it when it is used up or expired, and you can switch a code off at any time. Reservations made with a code are confirmed at once, because the code already tells you who the guest is.

Codes are also accepted in public mode. A guest with a code skips the bot check and the email step.

Public booking: the invisible bot check

In the mode Everyone online, anyone can book. To keep bots out without puzzles or image challenges, BiteTwo uses a proof-of-work check:

1. When the guest submits the booking, their browser receives a small task from the server.
2. It solves the task by trying numbers until a hash matches. On a phone this takes about a second, and the guest only sees "Checking…".
3. The server checks the solution. Each solution works once and expires after ten minutes.

For a real guest that second does not matter. A bot that wants to create hundreds of bookings has to pay it for every single one. On top of that:

• a hidden form field catches simple bots, which then get a normal answer while nothing is saved,
• one email address can make at most 3 public bookings per hour, and one internet connection at most 10.

Confirming by email

A public booking first holds the table for 30 minutes. The guest gets an email with a Confirm reservation button. Only after the guest taps it is the reservation confirmed. If nobody confirms, BiteTwo cancels the booking and the table is free again. Fake addresses therefore never block a table for long.

The confirmation needs a tap on the page that the link opens. Email programs that check links automatically therefore do not confirm the booking by accident.

If you chose Confirm every online booking myself, the confirmed booking arrives as a request. Your team accepts or declines it on the reservations page, and the guest gets an email either way.

Changing or cancelling

Every email contains the guest's personal link. With it the guest can:

• see the reservation, its time, party size and status,
• change the day, the time or the number of people. BiteTwo checks the new time again and keeps the table if it is still free,
• cancel the reservation, so the table becomes free for others.

This works until the lead time you set, for example 2 hours before the start. Later, the page asks the guest to call the restaurant. The link only shows this one reservation, never your internal notes or other bookings.

No-shows and privacy

If a party does not come, staff mark the reservation as a no-show, which frees the table. The next time someone books with the same email address or phone number, staff see how many no-shows came before and can decide how to handle it.

Guests' contact details are only used for their reservation. 90 days after the visit, BiteTwo removes the name, email address, phone number and notes from the reservation.