Deep scanSoftware and storefront · Storefront property/Scanned 3 Sept 2026, 19:13 UTC/2 agent walks, 18 requests
seconddoor.io
SecondDoor publishes clean SaaS pricing and a frictionless two-field signup, but neither an agent nor a shopper has any documented way to actually pay.
No issues were written
This scan did not gather enough evidence to rank what is costing you most. The dimension scores below reflect only what was actually observed. Running the scan again usually fixes it.
What a visitor actually meets
3 moments, 1 with friction
We walked the funnel in a real browser and captured every step. Nothing was submitted and no account was created.
- 01
Pricing page
Four tiers shown without login: Free $0, Starter $29, Pro $99, Agency $249. A fifth "Dedicated Consulting" tier priced around $2,500 per the pricing data. All prices are readable without JavaScript, no quote-gating. This is a straightforward SaaS pricing table, no physical product catalog anywhere on the site.
smooth·/pricing
Pricing page - 02
Dedicated Consulting tier
No published price, no self-serve path. Routes only to sales@seconddoor.io. This is the one part of the funnel where a visitor is diverted to a sales conversation instead of self-serve signup.
friction·/signup
- 03
Signup form
Only two required fields: work email and password, plus Google SSO. A 3-step bar shows Account, Confirm, Scan. Fine print says reports you run are public, part of how the index works. No payment requested, consistent with the free tier.
smooth·/signup
Signup form
We sent a buying agent
18 requests, in order
The agent got through 16 of 18 requests, but could not find out whether verified agents are recognised. It came up empty on 1 other check too.
- 01reached
www.seconddoor.io
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
www.seconddoor.io
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
/.well-known/security.txt
find a contact route for machines
- 07reached
/.well-known/mcp.json
find a published agent interface
- 08reached
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
www.seconddoor.io
find out whether verified agents are recognised
- 10reached
www.seconddoor.io
read the homepage as data rather than as a page
- 11reached
/openapi.json
find a machine readable API spec
- 12reached
www.seconddoor.io
read the developer documentation
- 13reached
/pricing
read the prices without running JavaScript
- 14not found
www.seconddoor.io
read the product catalogue as data
- 15reached
www.seconddoor.io
read a product page as data
- 16reached
www.seconddoor.io
read the returns and shipping terms
- 17reached
www.seconddoor.io
find a comparison page worth citing
- 18reached
/signup
walk the way a visitor would, to a signup form or a product
Ten dimensions
Not measured is not zero.
The agent door
80 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
robots.txt names all 14 major AI crawlers and allows them, a real browser gets the page normally, a 59-URL sitemap and llms.txt are both published, and key pages render without JavaScript.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
A machine readable API spec is published.
3 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
Six prices ($0, $29, $99, $249, $2,500) are readable in raw HTML on the pricing page with no JavaScript required, and FAQ schema is attached. Only the top consulting tier routes to sales, which is standard.
2 observations recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
An MCP manifest, an ai-plugin.json, and a full OpenAPI spec are all published and reachable, so an agent can generate a client rather than guess at the API.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
security.txt is published with a contact route and the returns policy reads as plain text at /refunds, but the shipping policy was not found at any of the usual paths, leaving one trust document unaccounted for.
3 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Pricing is published in raw HTML and signup needs no card, but the probe found no UCP manifest, no storefront MCP, no ACP manifest, and no payment processor anywhere on the homepage.
4 observations recorded.
The human door
83 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The signup form sits two steps from the homepage via a single 'Sign up for free' CTA, with no intervening marketing gate or account-tier chooser.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
The signup form asks for exactly two fields, work email and password, both required, plus a Google SSO option that skips the form entirely.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
No verification requirement is visible on the signup page itself, and the Google SSO path avoids one entirely, though the 'Confirm' step in the flow bar suggests an email check happens after submission.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Both of the two signup inputs carry HTML validation constraints, giving the browser a way to catch bad input before submission, though no live error region was detected.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.