Basic scanSoftware business · Storefront property/Scanned 7 Sept 2026, 12:27 UTC/1 browser pass
hubspot.com
Prices render only in JavaScript, the signup form is blocked to agents by robots.txt, and API integration requires hand-written clients from prose documentation.
Three issues, in priority order
Each one is drawn from evidence recorded during the walks.
1 piece of evidence and the recommended fix are recorded for this issue.
We sent a buying agent
15 requests, in order
The agent got through 9 of 15 requests, but could not find a published agent interface. It came up empty on 5 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- 01reached
www.hubspot.com
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
www.hubspot.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
/.well-known/security.txt
find a contact route for machines
- 07not found
www.hubspot.com
find a published agent interface
- 08not found
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
www.hubspot.com
find out whether verified agents are recognised
- 10reached
www.hubspot.com
read the homepage as data rather than as a page
- 11not found
www.hubspot.com
find a machine readable API spec
- 12reached
www.hubspot.com
read the developer documentation
- 13not found
/pricing/marketing
read the prices without running JavaScript
- 14reached
www.hubspot.com
find a comparison page worth citing
- 15not found
www.hubspot.com
walk the way a visitor would, to a signup form or a product
Deep scans need an account. Accounts are free.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
Ten dimensions
Not measured is not zero.
The agent door
38 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
No AI crawler is blocked by robots.txt, a real browser is served the page normally, and llms.txt is published with a declared intent for assistants. A sitemap lists 1194 URLs and the homepage carries 9 schema.org types.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
The API documentation at developers.hubspot.com shows endpoint examples but no machine readable specification. A client must be written by hand from prose.
3 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
16 prices are rendered on the pricing page but only after JavaScript executes. The raw HTML contains zero prices. A client that does not render pages sees no pricing at all, making cost evaluation impossible without a browser.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
No MCP manifest is published at any of the 3 standard paths checked. No ai-plugin.json is present. The site does not expose machine readable integration points for agents to discover and use its capabilities.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
security.txt is published at /.well-known/security.txt with a contact route for machines. The homepage responds to automated requests with HTTP 200 and serves structured data.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
The pricing page routes to sales without publishing any prices in the raw HTML. Prices appear only after JavaScript renders, and the page is gated to sales for custom quotes. An agent cannot compute total cost from published tiers.
2 observations recorded.
The human door
80 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The signup page at app.hubspot.com is 2 steps from the homepage. However, robots.txt at app.hubspot.com contains 'Disallow: /' which closes the signup form to automated visitors honouring the standard.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.