Some cookies are necessary for SecondDoor to work. Others are optional, and tell us how the site and the product are used. Accept all, or decline all optional ones. Without a selection, nothing optional is set. More in our cookie policy.
Basic scanSoftware business · Marketing site/Scanned 8 Sept 2026, 13:46 UTC/1 browser pass
Canva blocks automated clients at the door while serving real browsers, making it invisible to agents and pricing inaccessible to machines.
Older scan
This report was produced by an earlier version of the scanner. Some findings may not match how the site is measured now.
Severe. Your human funnel and your agent funnel are different products.
Ordered by what the evidence says is costing most. Written for whoever owns the site, not whoever builds it.
1 piece of evidence and the recommended fix are recorded for this issue, with notes written from your own pages.
This is a basic scan, so it raises the three issues the deterministic evidence supports. A deep scan sends two agents over the site and raises up to ten, each with cited evidence and the screens to prove it.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
The score and the audit trail stay public. The evidence and the files open with an account.
The audit trail behind every number above. Not measured is not zero.
Machine discoverability
Robots.txt blocks 7 AI training crawlers (gptbot, claudebot, anthropic-ai, ccbot, applebot-extended, meta-externalagent, bytespider) while allowing search and agent crawlers. A sitemap lists 459 URLs and is declared in robots.txt.
4 observations recorded.
Programmatic onboarding
OAuth authorization metadata is published at the standard path, enabling remote MCP server discovery. However, the product requires no account to use, so onboarding is not a programmatic problem.
3 observations recorded.
Pricing legibility
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Agent-aware instrumentation
No MCP manifest exists at the 2 standard paths checked. Seven AI crawlers are blocked in robots.txt. OAuth authorization metadata is published, which is the remote MCP discovery convention, but without a manifest or accessible.
4 observations recorded.
Machine-fetchable trust
Security.txt is published at /.well-known/security.txt with a contact route for machines. However, the homepage refuses automated clients outright with HTTP 403, undermining trust in any machine-readable signal.
2 observations recorded.
Commercial rails
OAuth authorization metadata is published, which is the standard for remote MCP procurement. Pricing is not machine-readable. No pricing.md or other structured pricing feed exists.
2 observations recorded.
Steps to first value
The product is usable immediately without any account, signup, or login. A visitor reaches working access in zero steps. This is the strongest possible score for this dimension because nothing stands between a user and the tool.
1 observation recorded.
Required fields
No form exists on the homepage or entry path. The site requires nothing of a visitor. Zero fields are required because there is no account system at all.
1 observation recorded.
Verification walls
There is no account system, so there is nothing to verify. No email confirmation, phone verification, or identity checks stand between a visitor and the product.
1 observation recorded.
Error recovery
No form exists to get wrong, so there is no error path to recover from. The score reflects the absence of a recovery problem rather than the presence of good recovery design.
1 observation recorded.
It got through 6 of 15.
The site refused automated access at canva.com, so the agent could not reach the site at all.