Deep scanSoftware business · Marketing site/Scanned 3 Sept 2026, 21:41 UTC/2 walks, 16 requests, 3 moments recorded/Partial scan
webflow.com
Webflow prices itself openly on the marketing site but seals the door behind a press-and-hold bot challenge, so no unverified agent can shop, sign up, or provision an API key without a human.
Two issues, in priority order
Each one is drawn from evidence recorded during the walks.
3 pieces of evidence and the recommended fix are recorded for this issue.
What a visitor actually meets
3 moments, 2 with friction, 1 blocking
We walked the funnel in a real browser and captured every step. Nothing was submitted and no account was created.
- 01
Landing page
Headline "Build for what's next", tagline "agentic web platform for modern businesses". Mixes builder pitch for marketing teams with vague AI language, not concretely explained. Clear it's a site builder/CMS/hosting tool but agentic framing confuses. No pricing above fold.
friction·webflow.com
Webflow landing page - 02
Pricing page
Site plans published clearly: Starter free, Basic $15/mo, Premium $25/mo, with usage tiers for bandwidth. Add-ons priced too. But Team plan is $2,500/mo, annual contract, "Talk to us". Enterprise is "Custom, Talk to us". Bigger plans require sales contact.
friction·/pricing
Pricing page - 03
Signup page (via Start for free / Get started CTA)
Signup URL returns a bot check: "Confirm you're not a bot, press and hold the button to confirm you're human." Not solvable by an automated visitor or agent. A human would likely pass it and reach a form 2 steps from the homepage, but nothing behind this wall is visible: no field list, no trial terms.
blocked·/signup
Signup page blocked
We sent a buying agent
16 requests, in order
The agent got through 13 of 16 requests, but could not find a published agent interface. It came up empty on 2 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- 01reached
webflow.com
reach the site at all
- 02reached
webflow.com
find out whether machines are welcome
- 03reached
webflow.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
webflow.com
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
webflow.com
find a contact route for machines
- 07not found
webflow.com
find a published agent interface
- 08reached
webflow.com
find an agent plugin manifest
- 09not found
webflow.com
find out whether verified agents are recognised
- 10reached
webflow.com
read the homepage as data rather than as a page
- 11not found
webflow.com
find a machine readable API spec
- 12reached
webflow.com
read the developer documentation
- 13reached
webflow.com
read the prices without running JavaScript
- 14reached
webflow.com
find a comparison page worth citing
- 15reached
webflow.com
walk the way a visitor would, to a signup form or a product
- 16reached
/data/reference/oauth-app
check if API key/OAuth app registration is self-serve
Ten dimensions
Not measured is not zero.
The agent door
31 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
No user agent rule turns away named AI crawlers and the sitemap lists 6510 URLs with rich schema.org markup, but a real browser hit an automated traffic challenge on the homepage itself.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
Auth is documented with code samples, but getting a credential needs a workspace account and an App built in the dashboard, with the client secret visible only to an admin. No self-serve key issuance was found.
4 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
10 prices sit in the homepage HTML ($6 to $200 range) and the pricing page lists Starter, Basic and Premium plans clearly, but there is no machine-readable pricing file for an agent to parse.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
No MCP manifest exists at the one standard path checked, /mcp.json. There is no structured entry point for an agent to discover tools or actions programmatically.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
No security.txt, the homepage answers automated requests.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Starter through Premium plans are priced in the open, but the signup CTA itself is refused for an automated browser by a press-and-hold challenge, and neither pricing.md nor OAuth metadata exists to script an account or a purchase.
4 observations recorded.
The human door
80 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The 'Start for free' CTA sits 2 steps from the homepage for a human visitor, but the same path answered an automated browser with a human challenge, so nothing past that point was read.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Could not verify: this scan did not reach the pages that would show it.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.