Some cookies are necessary for SecondDoor to work. Others are optional, and tell us how the site and the product are used. Accept all, or decline all optional ones. Without a selection, nothing optional is set. More in our cookie policy.
Basic scanSoftware business · Marketing site/Scanned 8 Sept 2026, 13:45 UTC/1 browser pass
Figma blocks AI crawlers from reading its pricing and product pages, then publishes no API surface for agents to complete purchases programmatically.
Older scan
This report was produced by an earlier version of the scanner. Some findings may not match how the site is measured now.
Present. Agents lose ground at specific gates, not everywhere.
Ordered by what the evidence says is costing most. Written for whoever owns the site, not whoever builds it.
1 piece of evidence and the recommended fix are recorded for this issue.
This is a basic scan, so it raises the three issues the deterministic evidence supports. A deep scan sends two agents over the site and raises up to ten, each with cited evidence and the screens to prove it.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
The score and the audit trail stay public. The evidence and the files open with an account.
The audit trail behind every number above. Not measured is not zero.
Machine discoverability
Robots.txt blocks 5 of the 9 named AI crawlers that fetch pages to answer buyers: oai-searchbot, claude-searchbot, perplexitybot, chatgpt-user and claude-user.
4 observations recorded.
Programmatic onboarding
No API credentials, endpoints, code samples or authentication documentation exist at /developers. OAuth authorization metadata is published, which signals remote MCP capability, but the documentation itself contains no API surface to call.
3 observations recorded.
Pricing legibility
9 prices are readable in raw HTML without JavaScript: Starter at $12, Professional at $16, and per-seat rates from $3 to $90. An Enterprise tier routes to sales, which is standard practice. Prices are legible to machines and humans alike.
1 observation recorded.
Agent-aware instrumentation
No MCP manifest exists at any of the 3 standard paths checked. OAuth authorization metadata is published, which is how a remote MCP server is discovered, but no manifest implements it.
4 observations recorded.
Machine-fetchable trust
Security.txt is published at /.well-known/security.txt with a contact route for machines. The homepage answers automated requests with HTTP 200 and serves structured data (Organization and ContactPoint). A real browser is not blocked.
2 observations recorded.
Commercial rails
Prices are published in raw HTML on the pricing page. A self-serve signup form is 2 steps from the homepage with a single Google sign-in option and no required fields.
2 observations recorded.
Steps to first value
The signup form is 2 steps from the homepage via 'Get started for free'. The form contains 1 field with no required fields and offers Google sign-in, reducing friction. The walk could not verify what happens after submission.
1 observation recorded.
Required fields
The signup form has 1 field total and 0 required fields. Google sign-in is offered as an alternative, eliminating the need to enter credentials. A visitor can proceed without providing any information.
1 observation recorded.
Verification walls
No verification requirement appears on the signup page itself. Google sign-in avoids email verification entirely. The walk could not verify what verification steps occur after form submission.
1 observation recorded.
Error recovery
0 of 1 inputs on the signup form carry validation rules, descriptions or live error regions. A visitor entering invalid data receives no inline guidance. The form offers no recovery path visible before submission.
1 observation recorded.
It got through 8 of 15.
The agent got through 8 of 15 requests, but could not find out whether machines are welcome. It came up empty on 6 other checks too. That is enough missing for a machine to give up before it reaches a purchase.