Deep scanSoftware business · Storefront property/Scanned 3 Sept 2026, 21:39 UTC/2 walks, 16 requests, 4 moments recorded/Partial scan
hubspot.com
HubSpot publishes real prices and a developer platform, but robots.txt seals the actual signup form away from every automated buyer, human or agent.
Two issues, in priority order
Each one is drawn from evidence recorded during the walks.
2 pieces of evidence and the recommended fix are recorded for this issue.
What a visitor actually meets
4 moments, 3 with friction, 1 blocking
We walked the funnel in a real browser and captured every step. Nothing was submitted and no account was created.
- 01
Landing page
Headline "Where go-to-market teams go to scale". It's clearly a CRM/marketing suite for businesses but exact product and price aren't stated up front. Two competing CTAs: "Get a demo" and "Get started free". A chat widget pops up immediately offering help, adding a third path.
friction·/pricing/marketing
HubSpot landing page - 02
Pricing page
Prices only render via JavaScript, nothing in raw HTML. Four tiers: Free $0, Starter $7/mo/seat, Professional $800/mo, Enterprise price further down. A chat bubble pushes "chat with a sales agent" over the self-serve figures. Big jump from $7 to $800 with no mid-tier.
friction·/pricing/marketing
Pricing page for Marketing Hub - 03
Signup attempt from pricing page
Clicking "Get started free" opened a chatbot pushing "Book a meeting" or "Chat with sales" rather than a signup page. The actual form at app.hubspot.com/signup-hubspot/crm is disallowed by robots.txt for this scanner. An automated visitor cannot reach it.
blocked·/pricing/marketing
Attempted signup path blocked by robots.txt - 04
Developer platform page
A separate developers.hubspot.com site exists with docs, API references, and a "Create developer account" button. This is a reasonable path for an agent integrator, but it is not linked from the main homepage nav, a visitor has to know to look for it. The main signup funnel and this developer funnel are disconnected.
friction·developers.hubspot.com
Developer platform landing page
We sent a buying agent
16 requests, in order
The agent got through 10 of 16 requests, but could not find a published agent interface. It came up empty on 5 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- 01reached
www.hubspot.com
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
www.hubspot.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
/.well-known/security.txt
find a contact route for machines
- 07not found
www.hubspot.com
find a published agent interface
- 08not found
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
www.hubspot.com
find out whether verified agents are recognised
- 10reached
www.hubspot.com
read the homepage as data rather than as a page
- 11not found
www.hubspot.com
find a machine readable API spec
- 12reached
www.hubspot.com
read the developer documentation
- 13not found
/pricing/marketing
read the prices without running JavaScript
- 14reached
www.hubspot.com
find a comparison page worth citing
- 15not found
www.hubspot.com
walk the way a visitor would, to a signup form or a product
- 16reached
/docs/api/overview
check if API key can be self-issued without human approval
Ten dimensions
Not measured is not zero.
The agent door
40 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
Robots.txt allows all named AI crawlers, a real browser gets the page normally, and a sitemap lists 1062 URLs with 9 schema.org types on the homepage.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
The signup path at app.hubspot.com is disallowed by robots.txt for automated clients, and no API key can be issued without going through it. Developer docs show endpoint examples but no documented key issuance or self-serve flag.
4 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
16 prices from $0 to $3,600 render on the pricing page but only after JavaScript runs, with zero prices in raw HTML. A client that does not execute scripts, including many agents, sees no price at all.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
No MCP manifest at any of 3 standard paths, no ai-plugin.json, and no OpenAPI spec at any of 6 standard paths checked. An agent has to hand-write a client from prose documentation.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
security.txt is published with a working contact route, and the homepage answers automated requests cleanly with structured Organization and Product data in JSON-LD.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Prices do exist and render for a browser, but the checkout path an agent needs to turn a price into a paid account sits at app.hubspot.com, which robots.txt disallows outright for automated visitors, and no machine readable pricing file or.
4 observations recorded.
The human door
80 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The signup CTA is 2 clicks from the homepage, a short path by design, but robots.txt closes app.hubspot.com to automated visitors, so nothing past that click was actually read by the scan.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.