# Gusto: 40 point Door Gap
- Site: gusto.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/gusto-jdkx73
- Scanner version: 12
Gusto blocks automated clients at the door while publishing pricing behind the same wall, forcing agents to browse as humans or abandon the evaluation.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 63/100 |
| Agents | 23/100 |
| Composite | 43/100 |
| Door Gap | 40 points |
| Percentile | 7th |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The site refused automated access at gusto.com, so the agent could not reach the site at all.
- blocked reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- blocked find out what pages exist
- missing find a contact route for machines
- missing find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- missing read the homepage as data rather than as a page
- missing find a machine readable API spec
- missing read the developer documentation
- blocked read the prices without running JavaScript
- blocked find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **/, /product/pricing turn the honest automated client away while serving a real browser, so the search crawlers that would cite the page are turned away by a rule about the client.** (machine_discoverability)
2. **Automated clients cannot read pricing or reach the signup form because the homepage and pricing page both refuse HTTP requests.** (machine_discoverability)
3. **No API surface is published, so agents cannot obtain credentials or call endpoints to integrate Gusto programmatically.** (programmatic_onboarding)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/gusto-jdkx73
## Files generated from this scan
- **Let verified assistants through** at `notes`, 1 hour, developer. Verify: The next scan opens the homepage and the key pages in a real browser and under the search crawler names, and every one is served.
- **robots.txt rules for AI crawlers** at `/robots.txt`, 10 minutes, no developer needed. Verify: The next scan reads robots.txt and finds every search and agent crawler allowed, none of them kept off product or pricing paths.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **Organization structured data** at `homepage`, 15 minutes, developer. Verify: The next scan reads Organization and WebSite nodes in the homepage JSON-LD and the structured data check passes.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/gusto-jdkx73
## The agent door
- **machine_discoverability** 43/100. Gusto publishes llms.txt and allows major AI crawlers in robots.txt, but the homepage and pricing page both refuse HTTP clients while serving real browsers normally.
- **programmatic_onboarding** 10/100. No API surface exists. The documentation at docs.gusto.com contains 755 characters of text but no credentials, endpoints, code samples, or authentication details.
- **pricing_legibility** null/100. Could not verify: this scan did not reach the pages that would show it.
- **agent_aware_instrumentation** 8/100. No MCP manifest is published at any of the three standard paths. No OpenAPI spec, OAuth metadata, or Web Bot Auth signals are present. An agent has no machine readable way to understand what Gusto offers or how to interact with it.
- **machine_fetchable_trust** 15/100. No security.txt file is published. The homepage refuses automated clients outright with HTTP 403, blocking any agent from fetching trust signals. A real browser is served the page, but trust verification requires HTTP access.
- **commercial_rails** 40/100. A self serve signup form is reachable from the homepage in 2 steps and asks for 9 fields, 7 required. No payment is collected on signup. The form accepts Google single sign on.
## The human door
- **steps_to_first_value** 80/100. The signup form is 2 steps from the homepage. The form collects first name, last name, work email, company name, employee count, password and password confirmation. No verification step appears on the form itself.
- **required_fields** 33/100. 7 of 9 fields on the signup form are required: first name, last name, work email, company name, employee count, password and password confirmation. Google single sign on is offered as an alternative to email.
- **verification_walls** 80/100. No verification requirement appears on the signup form. Email verification, phone verification or identity checks are not mentioned. Google single sign on bypasses email entry entirely.
- **error_recovery** 58/100. 8 of 16 form inputs carry validation rules. 2 live regions are present for error messaging. No inline error containers are documented. An agent or human can see that some fields have constraints, but error recovery flows are not fully.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp