Basic scanUnclassified/Scanned 3 Sept 2026, 19:28 UTC/1 browser pass
patagonia.com
A major retailer blocks automated clients from accessing its homepage, leaving machines unable to discover products or pricing.
Three issues, in priority order
Each one is drawn from evidence recorded during the walks.
1 piece of evidence and the recommended fix are recorded for this issue.
We sent a buying agent
14 requests, in order
The agent got through 4 of 14 requests, but could not find out whether machines are welcome. It came up empty on 9 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- 01reached
patagonia.com
reach the site at all
- 02not found
/robots.txt
find out whether machines are welcome
- 03reached
patagonia.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04not found
/llms.txt
read the site's own guide for language models
- 05not found
patagonia.com
find out what pages exist
- 06not found
/.well-known/security.txt
find a contact route for machines
- 07not found
patagonia.com
find a published agent interface
- 08not found
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
patagonia.com
find out whether verified agents are recognised
- 10not found
patagonia.com
read the homepage as data rather than as a page
- 11not found
patagonia.com
find a machine readable API spec
- 12not found
patagonia.com
read the developer documentation
- 13reached
patagonia.com
read the prices without running JavaScript
- 14reached
patagonia.com
walk the way a visitor would, to a signup form or a product
Deep scans need an account. Accounts are free.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
Ten dimensions
Not measured is not zero.
The agent door
13 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
No sitemap, no schema.org markup, and a real browser is refused or served a stripped page with only 97 characters of content. Automated clients cannot read the catalog or understand what is offered.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
No API documentation is linked from the homepage, no OpenAPI spec at any standard path, and no developer portal is discoverable. The product requires no account, so programmatic access has no entry point.
3 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
No MCP manifest at the three standard paths checked. No ai-plugin.json or Web Bot Auth signals. The site publishes no machine-readable instructions for agents to follow.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
No security.txt published at /.well-known/security.txt. No llms.txt or robots.txt to signal policy. Machines have no way to verify the site's security posture or access rules.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
.
2 observations recorded.
The human door
94 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The product is usable immediately with no account required and no signup form. A visitor can browse and act without any prerequisite steps, though automated clients cannot reach the content.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
No form exists on the homepage. Nothing is asked of a visitor because the site requires no account and no signup. Zero required fields.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
No account system exists, so there is nothing to verify. A visitor can use the site without email confirmation, phone verification, or any other gate.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
No form means no validation errors to recover from. The site offers no error messages or recovery paths because it asks for nothing from visitors.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.