Deep scanSoftware business · Storefront property/Scanned 3 Sept 2026, 21:57 UTC/2 walks, 16 requests, 3 moments recorded/Partial scan
hubspot.com
HubSpot publishes prices and docs to search engines but routes every actual signup and checkout through app.hubspot.com, a host robots.txt closes entirely to automated visitors.
Two issues, in priority order
Each one is drawn from evidence recorded during the walks.
2 pieces of evidence and the recommended fix are recorded for this issue.
What a visitor actually meets
3 moments, 2 with friction, 1 blocking
We walked the funnel in a real browser and captured every step. Nothing was submitted and no account was created.
- 01
Landing page
Headline is vague: "Where go-to-market teams go to scale." Not immediately clear this is CRM/marketing/sales software. Two competing CTAs shown: "Get a demo" and "Get started free", plus a chat popup appears unprompted.
friction·/pricing/marketing
HubSpot landing page - 02
Pricing page
Prices only appear after JavaScript runs: Free $0, Starter $7/seat, Professional $800/mo, Enterprise $3,000+/mo. Raw HTML has zero prices. Tiers are per seat with extra "core seat" costs shown further down the page.
friction·/pricing/marketing
Pricing page for Marketing Hub - 03
Attempting self-serve signup
"Get started free" leads to app.hubspot.com/signup-hubspot/crm, disallowed for automated visitors by robots.txt (Disallow: /). An agent honouring robots.txt cannot reach the signup form a human sees. Chat widget instead pushes "Chat with sales" or "Book a meeting".
blocked·/pricing/marketing
Signup path blocked by robots.txt
We sent a buying agent
16 requests, in order
The agent got through 10 of 16 requests, but could not find a published agent interface. It came up empty on 5 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- 01reached
www.hubspot.com
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
www.hubspot.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
/.well-known/security.txt
find a contact route for machines
- 07not found
www.hubspot.com
find a published agent interface
- 08not found
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
www.hubspot.com
find out whether verified agents are recognised
- 10reached
www.hubspot.com
read the homepage as data rather than as a page
- 11not found
www.hubspot.com
find a machine readable API spec
- 12reached
www.hubspot.com
read the developer documentation
- 13not found
/pricing/marketing
read the prices without running JavaScript
- 14reached
www.hubspot.com
find a comparison page worth citing
- 15not found
www.hubspot.com
walk the way a visitor would, to a signup form or a product
- 16reached
/docs/api/overview
check if API key/app creation is self-serve
Ten dimensions
Not measured is not zero.
The agent door
41 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
No AI crawler is blocked, a real browser gets the page normally, llms.txt is published with 293 lines, sitemap lists 1144 URLs and 9 schema.org types sit on the homepage. Strong surface discoverability.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
The only signup path found leads to app.hubspot.com/signup-hubspot/crm, which robots.txt disallows entirely (Disallow: /). No OpenAPI spec exists and docs show endpoint examples but no documented self-serve key issuance.
4 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
16 prices render after JavaScript (Free $0 to Enterprise $3,000+/mo) but the raw HTML pricing page has zero prices. A client that does not execute JS sees no cost information at all.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
No MCP manifest.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
security.txt is published with a working contact route and the homepage answers automated requests cleanly, giving a machine reader a verifiable trust anchor.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Prices exist only after JavaScript renders, and the actual purchase and signup flow sits behind app.hubspot.com, which robots.txt closes with Disallow: /. No pricing.md or machine-readable rail exists for an agent to transact.
3 observations recorded.
The human door
80 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The 'Get started free' CTA sits 2 clicks from the homepage for a human, but the destination form lives on a host robots.txt disallows entirely, so no automated walk could confirm what happens past that click.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.