Deep scanSoftware business · Storefront property/Scanned 4 Sept 2026, 00:54 UTC/2 walks, 16 requests, 3 moments recorded/Partial scan
hubspot.com
HubSpot publishes real prices and a clean marketing site, but the actual signup form sits behind a robots.txt wall that blocks every automated buyer, human-only funnel dressed up as self-serve.
Two issues, in priority order
Each one is drawn from evidence recorded during the walks.
3 pieces of evidence and the recommended fix are recorded for this issue.
What a visitor actually meets
3 moments, 2 with friction, 1 blocking
We walked the funnel in a real browser and captured every step. Nothing was submitted and no account was created.
- 01
Pricing page load
Direct navigation to hubspot.com/pricing/marketing first returned a blank white page. Prices are injected by JavaScript only: 16 prices rendered client side, zero in raw HTML. A non-JS agent sees nothing.
friction·/pricing/marketing
Pricing page - 02
Attempting the self-serve signup flow
Following "Get started free" leads to app.hubspot.com/signup-hubspot/crm. That subdomain is blocked by robots.txt with "Disallow: /". An automated visitor honouring robots.txt cannot reach the signup form, even though a human clicking the same link lands on it in two steps.
blocked·/pricing/marketing
- 03
Pricing page, second load
A later render showed four tiers for Marketing Hub: Free $0/mo, Starter $7/mo/seat (down from $20), Professional $800/mo (down from $890), Enterprise partly hidden behind a sales chat popup. Pricing is per seat, extra seats billed separately, real total needs a "Calculate price" tool.
friction·/pricing/marketing
Signup page attempt
We sent a buying agent
16 requests, in order
The agent got through 10 of 16 requests, but could not find a published agent interface. It came up empty on 5 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- 01reached
www.hubspot.com
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
www.hubspot.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
/.well-known/security.txt
find a contact route for machines
- 07not found
www.hubspot.com
find a published agent interface
- 08not found
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
www.hubspot.com
find out whether verified agents are recognised
- 10reached
www.hubspot.com
read the homepage as data rather than as a page
- 11not found
www.hubspot.com
find a machine readable API spec
- 12reached
www.hubspot.com
read the developer documentation
- 13not found
/pricing/marketing
read the prices without running JavaScript
- 14reached
www.hubspot.com
find a comparison page worth citing
- 15not found
www.hubspot.com
walk the way a visitor would, to a signup form or a product
- 16reached
/docs/api/overview
check if API key/app creation is self-serve
Ten dimensions
Not measured is not zero.
The agent door
40 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
Robots.txt names every major AI crawler as allowed, a sitemap lists 1203 URLs, llms.txt is published, and structured data covers 9 schema types. Pricing content itself still only renders after JavaScript.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
The developer docs link to app.hubspot.com/signup-hubspot/crm for API keys, and that subdomain's robots.txt disallows all automated access. No OpenAPI spec exists at any standard path, and docs show endpoint examples only, no documented.
3 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
16 real prices exist on the pricing page, from $0 to $3,600, but all of them are injected by JavaScript. Raw HTML returns zero prices, so any client that does not render JS sees a blank page.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
No MCP manifest.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
security.txt is published with a working contact route, robots.txt is present with 358 directives, and the homepage serves structured data and responds normally to automated requests.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Prices exist on the page but only after JavaScript runs, so a non-rendering client sees no catalog at all. The checkout path itself sits on app.hubspot.com, which disallows all automated visitors in robots.txt.
3 observations recorded.
The human door
80 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
A human reaches the signup CTA in 2 steps from the homepage. Robots.txt closes app.hubspot.com to automated visitors, so nothing past that click was read for an agent.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.