Deep scanSoftware business · Marketing site/Scanned 3 Sept 2026, 19:39 UTC/2 agent walks, 16 requests
zapier.com
Zapier lets a human or an agent start free in two clicks, but there is no documented way for an agent to get an API key or a machine readable spec without reading prose first.
One issues, in priority order
Each one is drawn from evidence recorded during the walks.
2 pieces of evidence and the recommended fix are recorded for this issue.
What a visitor actually meets
3 moments, 1 with friction
We walked the funnel in a real browser and captured every step. Nothing was submitted and no account was created.
- 01
Landing page first impression
Headline is vague, but subhead and app logos (Claude, ChatGPT, Cursor) clarify this is an AI workflow automation platform for teams and IT. A survey popup covers part of the screen unprompted before the page is even read.
friction·/pricing
Zapier landing page - 02
Pricing page
Published prices without login: Free, Professional $19.99, Team $69. Enterprise is quote only via sales, standard practice. A task-volume slider adjusts cost by usage, useful for estimating total spend.
smooth·/sign-up
Pricing page - 03
Signup form
Form asks for work email, first name, last name, password, or Google SSO. Fields marked with asterisks but not actually enforced as required in the markup. No credit card requested for the free plan. Mentions a 14-day trial of premium features layered on top of the free tier. Two clicks from homepage to this point.
smooth·/sign-up
Sign up form
We sent a buying agent
16 requests, in order
The agent got through 12 of 16 requests, but could not find a contact route for machines. It came up empty on 3 other checks too.
- 01reached
zapier.com
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
zapier.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/uag6x9zaeydnbfy75xsggcsb37h8cgzf-two-service-sitemap.xml
find out what pages exist
- 06not found
/.well-known/security.txt
find a contact route for machines
- 07reached
//docs.zapier.com/.well-known/mcp.json
find a published agent interface
- 08not found
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
zapier.com
find out whether verified agents are recognised
- 10reached
zapier.com
read the homepage as data rather than as a page
- 11not found
zapier.com
find a machine readable API spec
- 12reached
zapier.com
read the developer documentation
- 13reached
/pricing
read the prices without running JavaScript
- 14reached
zapier.com
find a comparison page worth citing
- 15reached
/sign-up
walk the way a visitor would, to a signup form or a product
- 16reached
/sdk
check whether API key can be self-issued
Ten dimensions
Not measured is not zero.
The agent door
72 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
Robots.txt names 8 AI crawlers and allows them, a sitemap lists 1228 URLs, llms.txt is published, and comparison pages render without JavaScript. Nothing blocks discovery.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
Authentication is documented, endpoint examples are shown, code samples are provided.
4 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
Three tiers (Free $0, Professional $19.99, Team $69) are readable in raw HTML with Offer structured data attached. Enterprise routes to a quote, which is standard and does not count against this.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
An MCP manifest is published, robots.txt names 8 AI crawlers and allows them, pricing.md publishes prices in a form an agent can read directly, developer documentation describes an API, but only in prose.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
No security.txt at the standard path, returning a 404. The homepage does answer automated requests normally, but no other machine readable trust signal was found.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Prices are published in raw HTML, pricing.md is machine readable, and the free signup form asks for no payment card. But the SDK's Enterprise tier is off by default and requires a manual sales opt-in, so the highest-value path is not.
4 observations recorded.
The human door
73 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The Start free CTA reaches a working signup form in 2 clicks from the homepage, with no payment requested for the free tier.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
The signup form has 4 fields and 0 are enforced as required in the markup, plus a Google SSO option. Almost nothing stands between a visitor and an account.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
No verification step appears on the signup page itself, and the Google SSO path bypasses any such check entirely.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
0 of 13 inputs on the signup form carry validation constraints, and there are no inline error containers, only 3 live regions. A mistyped field has no client-side signal before submission.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.