# Canva: 75 point Door Gap
- Site: canva.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/canva-amqns6
- Scanner version: 12
Canva blocks automated clients at the door while serving real browsers, making it invisible to agents and pricing inaccessible to machines.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 94/100 |
| Agents | 19/100 |
| Composite | 57/100 |
| Door Gap | 75 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The site refused automated access at canva.com, so the agent could not reach the site at all.
- blocked reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- blocked read the site's own guide for language models
- ok      find out what pages exist
- ok      find a contact route for machines
- missing find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- missing read the homepage as data rather than as a page
- missing find a machine readable API spec
- blocked read the developer documentation
- blocked read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **/, /en_gb/pricing/, /docs/ turn the honest automated client away while serving a real browser, so the search crawlers that would cite the page are turned away by a rule about the.** (machine_discoverability)
2. **robots.txt blocks 7 AI crawlers, so those assistants cannot read this site at all.** (machine_discoverability)
3. **No MCP manifest or API specification is published, leaving agents unable to understand what they would be authorizing or how to use the API.** (agent_aware_instrumentation)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/canva-amqns6
## Files generated from this scan
- **Let verified assistants through** at `notes`, 1 hour, developer. Verify: The next scan opens the homepage and the key pages in a real browser and under the search crawler names, and every one is served.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **Organization structured data** at `homepage`, 15 minutes, developer. Verify: The next scan reads Organization and WebSite nodes in the homepage JSON-LD and the structured data check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/canva-amqns6
## The agent door
- **machine_discoverability** 27/100. Robots.txt blocks 7 AI training crawlers (gptbot, claudebot, anthropic-ai, ccbot, applebot-extended, meta-externalagent, bytespider) while allowing search and agent crawlers. A sitemap lists 459 URLs and is declared in robots.txt.
- **programmatic_onboarding** 32/100. OAuth authorization metadata is published at the standard path, enabling remote MCP server discovery. However, the product requires no account to use, so onboarding is not a programmatic problem.
- **pricing_legibility** null/100. Could not verify: this scan did not reach the pages that would show it.
- **agent_aware_instrumentation** 0/100. No MCP manifest exists at the 2 standard paths checked. Seven AI crawlers are blocked in robots.txt. OAuth authorization metadata is published, which is the remote MCP discovery convention, but without a manifest or accessible.
- **machine_fetchable_trust** 25/100. Security.txt is published at /.well-known/security.txt with a contact route for machines. However, the homepage refuses automated clients outright with HTTP 403, undermining trust in any machine-readable signal.
- **commercial_rails** 10/100. OAuth authorization metadata is published, which is the standard for remote MCP procurement. Pricing is not machine-readable. No pricing.md or other structured pricing feed exists.
## The human door
- **steps_to_first_value** 95/100. The product is usable immediately without any account, signup, or login. A visitor reaches working access in zero steps. This is the strongest possible score for this dimension because nothing stands between a user and the tool.
- **required_fields** 100/100. No form exists on the homepage or entry path. The site requires nothing of a visitor. Zero fields are required because there is no account system at all.
- **verification_walls** 100/100. There is no account system, so there is nothing to verify. No email confirmation, phone verification, or identity checks stand between a visitor and the product.
- **error_recovery** 80/100. No form exists to get wrong, so there is no error path to recover from. The score reflects the absence of a recovery problem rather than the presence of good recovery design.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp