Deep scanSoftware business · Marketing site/Scanned 3 Sept 2026, 21:44 UTC/2 walks, 17 requests, 4 moments recorded
zapier.com
Zapier lets a human sign up for free in two clicks, but a developer or agent wanting programmatic API access hits a sales-only wall on the Workflow API page.
Three issues, in priority order
Each one is drawn from evidence recorded during the walks.
2 pieces of evidence and the recommended fix are recorded for this issue.
What a visitor actually meets
4 moments, 2 with friction
We walked the funnel in a real browser and captured every step. Nothing was submitted and no account was created.
- 01
Landing page
Headline "Smarter workflows. Smaller bills." explains AI automation across apps. Takes a moment to grasp this is an AI/app integration platform. A survey popup covers part of the page immediately, adding friction before reading.
friction·/sign-up
Zapier landing page - 02
Signup form
Reached in 2 clicks from homepage. Form asks work email, first name, last name, or Google SSO. No password field shown yet, no credit card required. Mentions 14-day trial of premium features, implying free plan afterward. Fields are simple and few, no visible required-field friction beyond the basics.
smooth·/sign-up
Sign up form - 03
Pricing page
Prices published without gating: Free, Professional $19.99, Team $69, Enterprise by quote. A task-volume slider adjusts tiers. A sales chat popup appears unsolicited, another interruption. Prices are legible without login, good for self-serve evaluation.
smooth·/pricing
Pricing page - 04
Developer platform / API page
The Workflow API page for powering a product or AI agent leads only to "Contact sales" as its call to action, no self-serve API key or docs link on this hero. A developer wanting programmatic access without a sales call hits a wall here, docs exist in the nav but the primary CTA is sales-gated.
friction·/developer-platform
Developer platform page
We sent a buying agent
17 requests, in order
The agent got through 12 of 17 requests, but could not find a contact route for machines. It came up empty on 4 other checks too.
- 01reached
zapier.com
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
zapier.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/uag6x9zaeydnbfy75xsggcsb37h8cgzf-two-service-sitemap.xml
find out what pages exist
- 06not found
/.well-known/security.txt
find a contact route for machines
- 07reached
//docs.zapier.com/.well-known/mcp.json
find a published agent interface
- 08not found
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
zapier.com
find out whether verified agents are recognised
- 10reached
zapier.com
read the homepage as data rather than as a page
- 11not found
zapier.com
find a machine readable API spec
- 12reached
zapier.com
read the developer documentation
- 13reached
/pricing
read the prices without running JavaScript
- 14reached
zapier.com
find a comparison page worth citing
- 15reached
/sign-up
walk the way a visitor would, to a signup form or a product
- 16not found
/app/developer
Check developer platform API key signup path
- 17reached
/.well-known/mcp.json
Check MCP manifest content for auth/key issuance details
Ten dimensions
Not measured is not zero.
The agent door
72 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
robots.txt names all 8 major AI crawlers and allows them, a sitemap lists 1228 URLs, llms.txt is published, and key pages render without JavaScript. Nothing blocks discovery.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
Authentication is documented, endpoint examples are shown, code samples are provided.
4 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
Three prices, $0, $19.99, $69, are readable without JavaScript on the pricing page, with Offer structured data and a machine readable pricing.md. Enterprise routes to sales, which is normal.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
An MCP manifest is published and pricing.md gives agents a machine readable price list, but the MCP endpoint only serves documentation search, not account or key provisioning, and the API itself is documented only in prose.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
No security.txt file exists at the standard path. The homepage otherwise answers automated requests normally, so trust signals are thin but the site is not hostile to automation.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Prices are in raw HTML for Free, Professional and Team tiers, pricing.md is machine readable, and signup needs no sales call. But there is no published API for provisioning or billing, so an agent can read the price list but cannot.
4 observations recorded.
The human door
73 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The 'Start free' entry is reached in 2 clicks from the homepage into a signup form with only 4 fields, none required, plus Google SSO. That is a short path to a working account.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
The signup form asks for work email, first and last name, or Google SSO, with 0 of 4 fields marked required and no password field shown up front. Almost nothing stands between a visitor and an account.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
No verification step appears on the signup page itself, and Google SSO bypasses email verification entirely for those who use it. The walk did not observe what happens after submission.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
0 of 13 inputs on the signup form carry validation constraints and there are no inline error containers, only 3 live regions. A mistyped field has little on-page feedback to recover from.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.