# Bombas: 79 point Door Gap
- Site: bombas.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: unknown
- Report: https://www.seconddoor.io/r/bombas-tchp9v
- Scanner version: 12
The site blocks both automated clients and real browsers from accessing its homepage and pricing, making the business model invisible to machines and difficult for humans to discover.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 94/100 |
| Agents | 15/100 |
| Composite | 55/100 |
| Door Gap | 79 points |
| Percentile | 38th |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The site refused automated access at bombas.com, so the agent could not reach the site at all.
- blocked reach the site at all
- blocked find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- blocked read the site's own guide for language models
- blocked find out what pages exist
- blocked find a contact route for machines
- blocked find a published agent interface
- blocked find an agent plugin manifest
- blocked find out whether verified agents are recognised
- missing read the homepage as data rather than as a page
- blocked find a machine readable API spec
- missing read the developer documentation
- blocked read the prices without running JavaScript
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **/, /pricing turn a real browser's own request away, so the wall sits below HTTP and no crawler reaches the page.** (machine_discoverability)
2. **No developer documentation is linked from the homepage, in raw HTML or the rendered page, so integration starts with a search engine.** (programmatic_onboarding)
3. **Automated clients receive HTTP 429 on the homepage and pricing page, blocking all machine discovery and pricing legibility.** (machine_discoverability)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/bombas-tchp9v
## Files generated from this scan
- **Let verified assistants through** at `notes`, 1 hour, developer. Verify: The next scan opens the homepage and the key pages in a real browser and under the search crawler names, and every one is served.
- **Organization structured data** at `homepage`, 15 minutes, developer. Verify: The next scan reads Organization and WebSite nodes in the homepage JSON-LD and the structured data check passes.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/bombas-tchp9v
## The agent door
- **machine_discoverability** 13/100. No AI crawler is blocked, a real browser is refused or served a stripped page, which is how assistant shopping arrives, no sitemap, no schema.org markup, the homepage turns a real browser's own request away, so the wall sits below HTTP.
- **programmatic_onboarding** 20/100. No API documentation is linked from the homepage. Automated access to all 6 standard OpenAPI paths was refused. The product requires no account, so programmatic signup is not applicable, but there is no way for an agent to understand what.
- **pricing_legibility** null/100. Could not verify: this scan did not reach the pages that would show it.
- **agent_aware_instrumentation** 8/100. No MCP manifest.
- **machine_fetchable_trust** 25/100. Security.txt could not be checked because automated access was refused with HTTP 429. The homepage refuses automated clients outright. No trust signals are machine-readable.
- **commercial_rails** 10/100. .
## The human door
- **steps_to_first_value** 95/100. The product is usable immediately with no account required and no signup form. A visitor can access the service without any steps, though the homepage itself is blocked from view for automated clients and stripped for real browsers.
- **required_fields** 100/100. No form exists on the homepage. Nothing is asked of a visitor. Zero required fields.
- **verification_walls** 100/100. No account system exists. There is nothing to verify and no verification wall to pass.
- **error_recovery** 80/100. No form means no validation errors to recover from. The only error is the HTTP 429 wall itself, which is not a form error but a network-level block.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp