Deep scanSoftware business · Marketing site/Scanned 3 Sept 2026, 19:35 UTC/2 agent walks, 17 requests/Partial scan
webflow.com
Webflow publishes real prices and a clean signup CTA, then puts a press-and-hold bot challenge exactly where an agent or scripted buyer needs to act.
Incomplete scan
The human side of this site could not be measured, so there is no Door Gap to report. The scores below cover only what the scan actually reached.
Three issues, in priority order
Each one is drawn from evidence recorded during the walks.
3 pieces of evidence and the recommended fix are recorded for this issue.
What a visitor actually meets
3 moments, 1 with friction, 1 blocking
We walked the funnel in a real browser and captured every step. Nothing was submitted and no account was created.
- 01
Landing page
Headline "agentic web platform for modern businesses" is vague. Scrolling reveals it is a website builder for marketing teams. Two CTAs: "Get started" (self-serve) and "Talk to Sales". Pricing link in nav.
friction·/pricing
Webflow landing page - 02
Pricing page
Prices published without login: Free, Premium $15/mo, Team $2,500/mo, Enterprise custom via sales. Toggle for monthly/yearly. Rare positive for an agent evaluator since totals are computable.
smooth·/signup
Pricing page - 03
Signup page
Navigating to /signup returns HTTP 403 and a "press and hold" bot challenge. An automated or agent visitor cannot pass this, so the signup form fields cannot be inspected at all. Hard stop for any non-human evaluator.
blocked·/signup
Signup page access denied
We sent a buying agent
17 requests, in order
The agent got through 13 of 17 requests, but could not find a published agent interface. It came up empty on 3 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- 01reached
webflow.com
reach the site at all
- 02reached
webflow.com
find out whether machines are welcome
- 03reached
webflow.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
webflow.com
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
webflow.com
find a contact route for machines
- 07not found
webflow.com
find a published agent interface
- 08reached
webflow.com
find an agent plugin manifest
- 09not found
webflow.com
find out whether verified agents are recognised
- 10reached
webflow.com
read the homepage as data rather than as a page
- 11not found
webflow.com
find a machine readable API spec
- 12reached
webflow.com
read the developer documentation
- 13reached
webflow.com
read the prices without running JavaScript
- 14reached
webflow.com
find a comparison page worth citing
- 15reached
/signup
walk the way a visitor would, to a signup form or a product
- 16not found
/pricing
check pricing tiers and checkout path
- 17reached
/docs/getting-started-with-apps
check if API key can be self-serve obtained
Ten dimensions
Not measured is not zero.
The agent door
39 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
Sitemap lists 6510 URLs, 19 schema.org types are present, and no crawler user agent rule blocks the named AI bots. Comparison pages render without JavaScript. Discovery is thoroughly open.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
There is no self-serve API key. Getting an API credential requires a Workspace with Admin permissions and registering an OAuth app, and advanced access needs a separate 'Developer Workspace' request.
4 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
10 prices sit in the homepage HTML ($6, $4, $25, $200 tiers) and the pricing page itself shows Free, Premium $15/mo, Team $2,500/mo with an Enterprise sales tier, so a buyer can compute cost.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
No MCP manifest.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
robots.txt, security.txt, llms.txt and ai-plugin.json all failed to fetch. The homepage itself answers automated requests fine and carries structured Organization data, but the trust surface files a scanner expects are missing.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Self-serve pricing and a 'Start for free' CTA exist, but the signup step returns a 403 with a press-and-hold challenge to an automated client, and no pricing.md or OAuth authorization metadata exists to let an agent complete a purchase.
4 observations recorded.
The human door
0 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.