# bidfood.sk — Zulien Score 71/100 (známka B)

> Bezplatný audit e-shopu: 71/100 celkové skóre. Platforma: Magento. Firma: Bidfood Slovakia s. r. o.. 100+ kontrol v 7 kategóriách (výkon, SEO, bezpečnosť, mobil, AI pripravenosť, GDPR, zraniteľnosti).

- **Auditovaný:** https://bidfood.sk
- **Platforma:** Magento
- **Firma:** Bidfood Slovakia s. r. o.
- **Dátum auditu:** 2026-07-02
- **Plná správa:** https://score.zulien.sk/cs/r/bidfood.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/bidfood.sk

## Skóre podľa kategórií

| Kategória | Skóre |
|---|---|
| Výkon | 71/100 |
| SEO | 70/100 |
| Bezpečnosť | 74/100 |
| Mobil | 77/100 |
| AI pripravenosť | 53/100 |
| GDPR | 77/100 |
| Zraniteľnosti | 78/100 |

## Detailné nálezy

### Výkon — 71/100

- **[CHYBA]** Cumulative Layout Shift (CLS) — 0.792 (good: <0.1) — Core Web Vital FAILING
  - Riešenie: Urgent layout stability issues. 1) Add width/height to all <img> and <video>, 2) Reserve space for ads with min-height, 3) Use font-display: swap for web fonts, 4) Don't dynamically inject content above visible area.
  - Dôkaz: PSI-lab
- **[CHYBA]** Total Page Weight — 7.3 MB, 60 requests — too heavy!
  - Riešenie: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Dôkaz: PSI-lab
- **[CHYBA]** Script Loading Strategy — Only 33% of 3 scripts optimized — most are render-blocking
  - Riešenie: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Font Loading Strategy — Google Fonts detected without font-display
  - Riešenie: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Font Preloading — Custom fonts detected without preload hints
  - Riešenie: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Dôkaz: HTML-heuristic
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Dôkaz: PSI-lab
- **[OK]** Server Response Time (TTFB) — 37ms
  - Dôkaz: PSI-lab
- **[OK]** First Contentful Paint (FCP) — 0.48s
  - Dôkaz: PSI-lab
- **[OK]** Largest Contentful Paint (LCP) — 0.96s — Core Web Vital ✓
  - Dôkaz: PSI-lab
- **[OK]** Total Blocking Time (TBT) — 0ms
  - Dôkaz: PSI-lab
- **[OK]** Speed Index — 2.59s
  - Dôkaz: PSI-lab
- **[OK]** Unused Code (CSS + JS) — Only 28 KB of unused code — well optimized
  - Dôkaz: PSI-lab
- **[OK]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Dôkaz: HTTP-header
- **[OK]** Resource Hints (Preload/Preconnect) — 1 preload, 2 preconnect hint(s)
  - Dôkaz: HTML-heuristic
- **[OK]** Lazy Loading — 91% of images use native lazy loading (49/54)
  - Dôkaz: HTML-heuristic
- **[OK]** CSS File Count — 3 CSS file(s) — well consolidated
  - Dôkaz: HTML-heuristic

### SEO — 70/100

- **[CHYBA]** Meta Description
  - Riešenie: Write a compelling meta description (120-160 chars) with a call-to-action. Include your target keyword naturally.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Open Graph Tags
  - Riešenie: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Structured Data (JSON-LD)
  - Riešenie: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
  - Dôkaz: schema
- **[CHYBA]** Text-to-HTML Ratio — 2% — very thin content (422 words)
  - Riešenie: Your page is almost entirely HTML/CSS/JS with very little actual content. Add substantial product descriptions, content blocks, and informational text.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Twitter/X Cards
  - Riešenie: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Alt Attributes — Only 87% of 54 images have alt text
  - Riešenie: 7 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Format Optimization — Only 39% next-gen formats — 0 legacy images remain
  - Riešenie: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use <picture> element for browser fallback.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical URL Consistency — Canonical points to different URL: https://www.bidfood.sk/
  - Riešenie: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Dimension Attributes — Only 41% of images have width/height attributes
  - Riešenie: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Sitemap Host Consistency — robots.txt Sitemap points to www.bidfood.cz (page is bidfood.sk)
  - Riešenie: Update the Sitemap: line in robots.txt to your canonical host. A staging/dev hostname (new., staging., dev.) leaks pre-production to Google and feeds crawlers URLs that 404 or duplicate the live site.
  - Dôkaz: HTML-heuristic
- **[OK]** Meta Title — 40 chars — "Bidfood \| Výrobca a distribútor potravín"
  - Dôkaz: HTML-heuristic
- **[OK]** H1 Heading — "Váš výrobca a distribútor potravín"
  - Dôkaz: HTML-heuristic
- **[OK]** Content Structure (H2 Headings) — 10 H2 subheadings found
  - Dôkaz: HTML-heuristic
- **[OK]** Canonical URL — https://www.bidfood.sk/
  - Dôkaz: HTML-heuristic
- **[OK]** robots.txt — Present, references sitemap
  - Dôkaz: file-probe
- **[OK]** XML Sitemap — Found with ~274+ URLs
  - Dôkaz: file-probe
- **[OK]** HTML Language Attribute — lang="sk"
  - Dôkaz: HTML-heuristic
- **[OK]** Hreflang Tags (Multilingual) — 7 language(s): cs, sk, hu, de, en
  - Dôkaz: HTML-heuristic
- **[OK]** Favicon — Favicon detected
  - Dôkaz: file-probe
- **[OK]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>
  - Dôkaz: HTML-heuristic
- **[OK]** Content Depth — 422 words — sufficient content
  - Dôkaz: HTML-heuristic
- **[OK]** Deep Heading Hierarchy — H2: 10, H3: 8 — well-structured content
  - Dôkaz: HTML-heuristic
- **[OK]** Internal Linking — 69 internal links — strong site navigation
  - Dôkaz: HTML-heuristic
- **[OK]** Empty/Dead Links — 1 minor dead link(s) — acceptable
  - Dôkaz: HTML-heuristic
- **[OK]** Accessibility Fundamentals — 4/4 a11y signals: 13 ARIA roles, 13 ARIA labels, skip link, lang="sk"
  - Dôkaz: HTML-heuristic
- **[OK]** Sitemap Freshness — Newest <lastmod> 1 day(s) ago
  - Dôkaz: HTML-heuristic

### Bezpečnosť — 74/100

- **[CHYBA]** Content-Security-Policy (CSP)
  - Riešenie: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Riešenie: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Dôkaz: DNS
- **[UPOZORNENIE]** Referrer-Policy
  - Riešenie: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Permissions-Policy
  - Riešenie: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Technology Disclosure — X-Powered-By: PHP/8.4.13
  - Riešenie: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Subresource Integrity (SRI) — Only 0/1 SRI-eligible third-party scripts have integrity hashes (1 auto-updating provider script(s) excluded — SRI not applicable)
  - Riešenie: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** security.txt (RFC 9116)
  - Riešenie: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** CDN / WAF Protection
  - Riešenie: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Dôkaz: HTTP-header
- **[OK]** SSL/TLS Certificate — Valid HTTPS connection established
  - Dôkaz: SSL
- **[OK]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
  - Dôkaz: DNS
- **[OK]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Dôkaz: HTTP-header
- **[OK]** HSTS (Strict-Transport-Security) — max-age=31536000, includeSubDomains
  - Dôkaz: HTTP-header
- **[OK]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN
  - Dôkaz: HTTP-header
- **[OK]** X-Content-Type-Options — nosniff
  - Dôkaz: HTTP-header
- **[OK]** Cookie Security Flags — No cookies set on initial response
  - Dôkaz: HTTP-header
- **[OK]** Server Version Disclosure — openresty — version hidden
  - Dôkaz: HTTP-header

### Mobil — 77/100

- **[UPOZORNENIE]** Mobile Performance Score — 79/100 (target: 90+)
  - Riešenie: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Touch Target Size
  - Riešenie: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Font Size Readability
  - Riešenie: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Theme Color
  - Riešenie: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Inline CSS Size — 77 KB of inline CSS
  - Riešenie: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Apple Mobile Web App — Missing: apple-mobile-web-app-capable, status-bar-style
  - Riešenie: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Print Stylesheet — Order/invoice page without print styles
  - Riešenie: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Fixed Width Elements — Large fixed-width elements detected — may cause horizontal scroll
  - Riešenie: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h1→h3, h2→h6
  - Riešenie: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
  - Dôkaz: HTML-heuristic
- **[OK]** Viewport Configuration — width=device-width, initial-scale=1
  - Dôkaz: HTML-heuristic
- **[OK]** Content Fits Viewport — No horizontal scrolling needed
  - Dôkaz: HTML-heuristic
- **[OK]** Responsive Design Techniques — Flexbox, Media queries detected
  - Dôkaz: HTML-heuristic
- **[OK]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Dôkaz: HTML-heuristic
- **[OK]** Responsive Images (srcset) — 28 image(s) use srcset for responsive sizing
  - Dôkaz: HTML-heuristic
- **[OK]** Form Input Types — Optimized: 1 search
  - Dôkaz: HTML-heuristic
- **[OK]** Form Input Labels (WCAG 3.3.2) — 1/1 inputs majú label
  - Dôkaz: HTML-heuristic
- **[OK]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Dôkaz: HTML-heuristic

### AI pripravenosť — 53/100

- **[CHYBA]** llms.txt (AI Site Descriptor)
  - Riešenie: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
  - Dôkaz: file-probe
- **[CHYBA]** Structured Data Foundation
  - Riešenie: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
  - Dôkaz: schema
- **[CHYBA]** Organization Schema + Entity Linking
  - Riešenie: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Dôkaz: schema
- **[CHYBA]** Content Freshness Signals
  - Riešenie: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Entity Clarity & Brand Signals
  - Riešenie: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Image Alt Text Quality for AI — Only 48% quality alt text — 7 missing, 21 poor
  - Riešenie: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** llms-full.txt (Complete AI Content)
  - Riešenie: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** FAQ Schema (Direct AI Answers)
  - Riešenie: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Dôkaz: schema
- **[UPOZORNENIE]** Content Depth for AI — 422 words — add more for better AI citations
  - Riešenie: Expand to 500+ words: add detailed product descriptions, use cases, benefits, specifications, comparison info, and buying guides. AI needs substantial content to summarize and cite.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Structured Content (Lists & Tables) — 19 lists found — consider adding comparison tables
  - Riešenie: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Author Expertise Signals (E-E-A-T)
  - Riešenie: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Statistics & Data Presence — No statistical data found in content
  - Riešenie: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Section Length Optimization — Avg section: 28 words — only 0% in 80-200 word optimal range
  - Riešenie: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Q&A Format Headings
  - Riešenie: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.bidfood.sk/
  - Riešenie: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Knowledge Graph Readiness — 1/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema
  - Riešenie: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Content Readability for AI — Grade 20 — too complex for broad AI citation
  - Riešenie: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Expert Quotations & Citations
  - Riešenie: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** ai.txt (AI Permissions)
  - Riešenie: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** WebMCP Agentic Readiness
  - Riešenie: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Social Proof (Testimonials / Case Studies)
  - Riešenie: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is the #1 credibility lever.
  - Dôkaz: HTML-heuristic
- **[OK]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Dôkaz: file-probe
- **[OK]** Content Accessibility for AI — 422 words in raw HTML (2.1% text ratio) — readable by AI crawlers without executing JS
  - Dôkaz: HTML-heuristic
- **[OK]** Answer-First Content Format — First paragraph: 144 words — good content density above the fold
  - Dôkaz: HTML-heuristic
- **[OK]** Heading Hierarchy for AI — Proper structure: 1 H1 → 10 H2s → 8 H3s — clear content outline
  - Dôkaz: HTML-heuristic
- **[OK]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>
  - Dôkaz: HTML-heuristic
- **[OK]** Extractable Answer Blocks — 10 paragraphs, avg 35 words — optimal for AI extraction
  - Dôkaz: HTML-heuristic
- **[OK]** Internal Link Density — 164 contextual internal links per 1,000 words — strong knowledge graph signal
  - Dôkaz: HTML-heuristic
- **[OK]** Content-to-Boilerplate Ratio — 69% of text in <main>/<article> — clean content signal
  - Dôkaz: HTML-heuristic

### GDPR — 77/100

- **[CHYBA]** Google Consent Mode v2
  - Riešenie: Implement Google Consent Mode v2 with gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied' }). Required since March 2024 for EU audiences.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Cookie Policy
  - Riešenie: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Right to Erasure (Data Deletion)
  - Riešenie: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Withdrawal of Consent Mechanism
  - Riešenie: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Dôkaz: HTML-heuristic
- **[OK]** Cookie Consent Banner (CMP) — Cookiebot detected
  - Dôkaz: HTML-heuristic
- **[OK]** Tracking Scripts & Consent — 1 tracker(s) detected with CMP: Google Analytics/GTM
  - Dôkaz: HTML-heuristic
- **[OK]** Privacy Policy Page — https://www.freeprivacypolicy.com/free-privacy-policy-generator/
  - Dôkaz: HTML-heuristic
- **[OK]** Legal Contact / Imprint Page — /o-nas
  - Dôkaz: HTML-heuristic
- **[OK]** Terms & Conditions Page — /dodavatel/obchodne-podmienky
  - Dôkaz: HTML-heuristic
- **[OK]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Dôkaz: HTML-heuristic
- **[OK]** Third-party Data Sharing — 2 third-party domain(s)
  - Dôkaz: HTML-heuristic
- **[OK]** Data Protection Officer Contact — DPO / data protection contact found
  - Dôkaz: HTML-heuristic

### Zraniteľnosti — 78/100

- **[CHYBA]** CMS Version Disclosure — "Drupal 11 (https://www.drupal.org)" exposed in meta generator
  - Riešenie: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Form CSRF Protection — 1 form(s) without CSRF tokens
  - Riešenie: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Dôkaz: HTML-heuristic · istota: low
- **[UPOZORNENIE]** X-Powered-By Header — PHP/8.4.13
  - Riešenie: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').
  - Dôkaz: file-probe
- **[UPOZORNENIE]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Riešenie: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
  - Dôkaz: DNS
- **[UPOZORNENIE]** Cross-Origin Isolation
  - Riešenie: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Dôkaz: HTTP-header
- **[OK]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Dôkaz: file-probe
- **[OK]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Dôkaz: file-probe
- **[OK]** Directory Listing — Disabled — file structure hidden
  - Dôkaz: file-probe
- **[OK]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Dôkaz: file-probe
- **[OK]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Dôkaz: HTML-heuristic
- **[OK]** PHP Version — PHP 8.4.13 — current
  - Dôkaz: file-probe
- **[OK]** SPF Record (Email Security) — SPF configured: v=spf1 mx -all
  - Dôkaz: DNS
- **[OK]** DKIM Signing (Email Auth) — DKIM configured (selectors: mail)
  - Dôkaz: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).

---

Zulien Score je bezplatný automatizovaný heuristický audit pokrývajúci výkon (Core Web Vitals, TTFB, page weight), SEO (meta tagy, štruktúrované dáta, sitemap), bezpečnosť (SSL/TLS, HSTS, CSP), mobilnú použiteľnosť, AI pripravenosť, súlad s GDPR / ePrivacy a zraniteľnosti. Výsledky sú cache-ované na 6 hodín a re-skenovateľné na požiadanie.

[Zobraziť plnú interaktívnu správu na Zulien Score →](https://score.zulien.sk/cs/r/bidfood.sk)