# Webflow: 49 point Door Gap
- Site: webflow.com
- Scanned: 2026-09-03
- Scan type: Deep scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/webflow-udc9yw
- Scanner version: 10
Webflow prices itself openly on the marketing site but seals the door behind a press-and-hold bot challenge, so no unverified agent can shop, sign up, or provision an API key without a human.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 80/100 |
| Agents | 31/100 |
| Composite | 56/100 |
| Door Gap | 49 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 13 of 16 requests, but could not find a published agent interface. It came up empty on 2 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- ok      find a contact route for machines
- missing find a published agent interface
- ok      find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- ok      read the developer documentation
- ok      read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
- ok      check if API key/OAuth app registration is self-serve
## What a visitor meets
1. **Landing page** (friction). Headline "Build for what's next", tagline "agentic web platform for modern businesses". Mixes builder pitch for marketing teams with vague AI language, not concretely explained. Clear it's a site builder/CMS/hosting tool but agentic framing confuses. No pricing above fold.
2. **Pricing page** (friction). Site plans published clearly: Starter free, Basic $15/mo, Premium $25/mo, with usage tiers for bandwidth. Add-ons priced too. But Team plan is $2,500/mo, annual contract, "Talk to us". Enterprise is "Custom, Talk to us". Bigger plans require sales contact.
3. **Signup page (via Start for free / Get started CTA)** (blocked). Signup URL returns a bot check: "Confirm you're not a bot, press and hold the button to confirm you're human." Not solvable by an automated visitor or agent. A human would likely pass it and reach a form 2 steps from the homepage, but nothing behind this wall is visible: no field list, no trial terms.
## Top issues
1. **No OpenAPI specification is published at any of the standard paths, so a client for Webflow's API has to be hand written from prose documentation.** (agent_aware_instrumentation)
2. **No machine-readable pricing file or OAuth authorization server metadata is published, so an agent cannot script account creation or cost comparison end to end.** (commercial_rails)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/webflow-udc9yw
## Files generated from this scan
- **Let verified assistants through** at `notes`, 1 hour, developer. Verify: The next scan opens the homepage and the key pages in a real browser and under the search crawler names, and every one is served.
- **robots.txt rules for AI crawlers** at `/robots.txt`, 10 minutes, no developer needed. Verify: The next scan reads robots.txt and finds every search and agent crawler allowed, none of them kept off product or pricing paths.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **pricing.md** at `/pricing.md`, 20 minutes, no developer needed. Verify: The next scan fetches /pricing.md as text and records pricing as machine readable.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
- **llms.txt** at `/llms.txt`, 15 minutes, no developer needed. Verify: The next scan fetches /llms.txt as text and the llms.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/webflow-udc9yw
## The agent door
- **machine_discoverability** 61/100. No user agent rule turns away named AI crawlers and the sitemap lists 6510 URLs with rich schema.org markup, but a real browser hit an automated traffic challenge on the homepage itself.
- **programmatic_onboarding** 20/100. Auth is documented with code samples, but getting a credential needs a workspace account and an App built in the dashboard, with the client secret visible only to an admin. No self-serve key issuance was found.
- **pricing_legibility** 35/100. 10 prices sit in the homepage HTML ($6 to $200 range) and the pricing page lists Starter, Basic and Premium plans clearly, but there is no machine-readable pricing file for an agent to parse.
- **agent_aware_instrumentation** 8/100. No MCP manifest exists at the one standard path checked, /mcp.json. There is no structured entry point for an agent to discover tools or actions programmatically.
- **machine_fetchable_trust** 40/100. No security.txt, the homepage answers automated requests.
- **commercial_rails** 20/100. Starter through Premium plans are priced in the open, but the signup CTA itself is refused for an automated browser by a press-and-hold challenge, and neither pricing.md nor OAuth metadata exists to script an account or a purchase.
## The human door
- **steps_to_first_value** 80/100. The 'Start for free' CTA sits 2 steps from the homepage for a human visitor, but the same path answered an automated browser with a human challenge, so nothing past that point was read.
- **required_fields** null/100. Could not verify: this scan did not reach the pages that would show it.
- **verification_walls** null/100. Could not verify: this scan did not reach the pages that would show it.
- **error_recovery** null/100. Could not verify: this scan did not reach the pages that would show it.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp