Podprůměrné

Výsledky skóre

hype.sk

Skenováno July 10, 2026

WordPress 6.7.5
jQuery
Font Awesome
Swiper
reCAPTCHA
Webpack
Poslední sken: July 10, 2026
Akční plán

Opravte těchto 3 věcí jako první

Seřazeno podle dopadu na skóre — každá oprava posune celkové hodnocení nahoru.

+21potenciální zisk

Performance

Váha: 25% · 9 prošlo · 2 upozornění · 5 selhalo · 1 SPA (ověřte ručně)

Co jsme zjistili: 5.02s (good: <2.5s) — Core Web Vital FAILING

Proč na tom záleží: LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).

Jak to opravit: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.
Důkaz:PSI-lab· Spolehlivost: high
Fix with Performance module →

Co jsme zjistili: 14.4 MB, 147 requests — too heavy!

Proč na tom záleží: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Jak to opravit: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Důkaz:PSI-lab· Spolehlivost: high
Get Performance Optimization →

Co jsme zjistili: 867 KB wasted on unused code!

Proč na tom záleží: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Poznámka: Tato kontrola používá heuristickou detekci a může vrátit i falešně pozitivní výsledky. Doporučujeme ruční ověření.

Jak to opravit: You're loading 867 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Důkaz:PSI-lab· Spolehlivost: low

Co jsme zjistili: Only 5% of 22 scripts optimized — most are render-blocking

Proč na tom záleží: 21 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

Jak to opravit: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.
Důkaz:HTML-heuristic· Spolehlivost: high
Get Performance Optimization →

Co jsme zjistili: 39 CSS files — too many!

Proč na tom záleží: Each CSS file blocks rendering. With 39 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Jak to opravit: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Důkaz:HTML-heuristic· Spolehlivost: high

Co jsme zjistili: 39 CSS files without critical CSS extraction

Proč na tom záleží: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

Jak to opravit: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Důkaz:PSI-lab· Spolehlivost: high
Request quote for speed audit

Co jsme zjistili: 6 external domains without preconnect

Proč na tom záleží: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

Jak to opravit: Add <link rel='preconnect'> for key third-party domains: cdn-cookieyes.com, www.googletagmanager.com, www.google.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Důkaz:PSI-lab· Spolehlivost: high

7 problémů v kategorii Performance. Je tu prostor pro zlepšení.

Váš e-shop zatím nesplňuje podmínky pro odznak Zulien Score. Získejte skóre 80+!

📧 Připomínky opětovného skenu

Jednou měsíčně vám napíšeme, kdy udělat nový sken a sledovat svá zlepšení.

🚀 Zlepšete své skóre

Naše PrestaShop moduly dokáží automaticky opravit většinu těchto problémů.

Bezplatná 15min konzultace · Bez závazku

Sdílet a exportovat

Připraveni zlepšit své skóre?

Váš e-shop přichází o zákazníky každý den. Problémy výše vás stojí prodeje.

Opravte si sami

Projděte si naše moduly a opravte problémy na 2 kliknutí.

Projít moduly Zulien

Nechte to na nás

Popište svůj cíl a do 48 h vám pošleme cenovou nabídku. Bez telefonátu.

Získat cenovou nabídku

Odpověď do 48 h · Bez telefonátu

Spadá vaše firma pod směrnici NIS2?

Směrnice EU NIS2 vyžaduje od mnoha online firem dodržování pravidel kybernetické bezpečnosti. Ověřte, zda se vás týká.

Toto je automatizovaný heuristický odhad, nikoliv profesionální audit. Zjištění odrážejí veřejně pozorovatelné signály v čase skenu a mohou obsahovat i nesprávné nálezy.Přečtěte si o naší metodiceNahlásit nepřesnostOdstranit tento report
Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách
68/100
Grade D
hype.sk
Dátum auditu: July 10, 2026
Platforma: WordPress 6.7.5
Online report: https://score.zulien.sk/r/hype.sk
Vygenerované 29. 7. 2026 11:10:09 · score.zulien.sk · by Zulien

Executive summary

20
Chýb
49
Upozornení
67
OK
138
Spolu kontrol

Skóre po kategóriách

KategóriaSkóreVáhaChybyUpozorneniaOK
Performance67/10025%529
SEO87/10020%1419
Security57/10015%386
Mobile67/10010%187
AI Readiness68/10010%31513
GDPR71/10010%167
Vulnerability48/10010%666

Kritické zistenia

Largest Contentful Paint (LCP)· Performance
LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).
Total Page Weight· Performance
Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.
Unused Code (CSS + JS)· Performance
Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
Script Loading Strategy· Performance
21 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.
CSS File Count· Performance
Each CSS file blocks rendering. With 39 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
Image Alt Attributes· SEO
Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA.
HSTS (Strict-Transport-Security)· Security
Without HSTS, attackers can intercept the first HTTP request and downgrade the connection. This is the #1 way to steal session cookies on public WiFi.
Content-Security-Policy (CSP)· Security
CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.
Clickjacking Protection· Security
Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
Form Input Labels (WCAG 3.3.2)· Mobile
EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.
llms.txt (AI Site Descriptor)· AI Readiness
llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.
Heading Hierarchy for AI· AI Readiness
AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Performance

67/100
Váha: 25% · 9 OK · 2 upozornení · 5 chýb · spolu 17
Largest Contentful Paint (LCP)Zlyhalo
5.02s (good: <2.5s) — Core Web Vital FAILING
Prečo je to dôležité: LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).
Ako opraviť: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.
Total Page WeightZlyhalo
14.4 MB, 147 requests — too heavy!
Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.
Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Unused Code (CSS + JS)Zlyhalo
867 KB wasted on unused code!
Prečo je to dôležité: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
Ako opraviť: You're loading 867 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Script Loading StrategyZlyhalo
Only 5% of 22 scripts optimized — most are render-blocking
Prečo je to dôležité: 21 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.
Ako opraviť: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.
CSS File CountZlyhalo
39 CSS files — too many!
Prečo je to dôležité: Each CSS file blocks rendering. With 39 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
Ako opraviť: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Critical CSS StrategyUpozornenie
39 CSS files without critical CSS extraction
Prečo je to dôležité: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.
Ako opraviť: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Connection Hint CoverageUpozornenie
6 external domains without preconnect
Prečo je to dôležité: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.
Ako opraviť: Add <link rel='preconnect'> for key third-party domains: cdn-cookieyes.com, www.googletagmanager.com, www.google.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Server Response Time (TTFB)Prešlo
76ms
First Contentful Paint (FCP)Prešlo
0.53s
Total Blocking Time (TBT)Prešlo
172ms
Cumulative Layout Shift (CLS)Prešlo
0.000 — Core Web Vital ✓
Speed IndexPrešlo
2.48s
Text Compression (gzip/brotli)Prešlo
All text resources properly compressed
Resource Hints (Preload/Preconnect)Prešlo
1 preload, 0 preconnect hint(s)
Lazy LoadingPrešlo
72% of images use native lazy loading (26/36)
HTTP/3 (QUIC) SupportPrešlo
HTTP/3 enabled via Alt-Svc header
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Kategória 1 / 7 · hype.sk · Zulien Score

SEO

87/100
Váha: 20% · 19 OK · 4 upozornení · 1 chýb · spolu 25
Image Alt AttributesZlyhalo
Only 31% of 36 images have alt text
Prečo je to dôležité: Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA.
Ako opraviť: 25 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.
H1 HeadingUpozornenie
5 H1 tags (should be exactly 1)
Prečo je to dôležité: Multiple H1 tags dilute the main topic signal. Google's John Mueller confirmed: one H1 per page is best practice.
Ako opraviť: Consolidate to exactly one H1 tag per page. Use H2-H6 for subheadings.
Image Format OptimizationUpozornenie
0% next-gen formats — 4 JPEG, 18 PNG images
Prečo je to dôležité: Your images are using legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.
Ako opraviť: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
Semantic HTML StructureUpozornenie
Only 2/6 semantic elements — missing: <article>, <header>, <footer>, <aside>
Prečo je to dôležité: Semantic HTML gives search engines clear signals about content structure. Pages with proper semantic markup earn more featured snippets and knowledge panel appearances.
Ako opraviť: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
Excessive Resource RequestsUpozornenie
23 JS + 39 CSS = 62 external requests
Prečo je to dôležité: Google's crawl budget is limited. Sites with excessive resources get crawled less frequently and experience slower indexation of new content.
Ako opraviť: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.
Meta TitlePrešlo
38 chars — "Hype - digitálna marketingová agentúra"
Meta DescriptionPrešlo
138 chars
Content Structure (H2 Headings)Prešlo
34 H2 subheadings found
Open Graph TagsPrešlo
og:title, og:description, og:image, og:type
Open Graph Image FormatPrešlo
image/jpeg
Twitter/X CardsPrešlo
Card type: summary_large_image
Canonical URLPrešlo
https://hype.sk/
Structured Data (JSON-LD)Prešlo
1 block(s): WebPage, ReadAction, ImageObject, BreadcrumbList
JSON-LD ValidityPrešlo
1 block(s) parse cleanly
robots.txtPrešlo
Present, references sitemap
XML SitemapPrešlo
Found with ~9+ URLs
HTML Language AttributePrešlo
lang="sk-SK"
Meta Robots TagPrešlo
index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1
FaviconPrešlo
Favicon detected
Content DepthPrešlo
1017 words — sufficient content
Deep Heading HierarchyPrešlo
H2: 34, H3: 9 — well-structured content
Internal LinkingPrešlo
51 internal links — strong site navigation
Accessibility FundamentalsPrešlo
3/4 a11y signals: 15 ARIA roles, 19 ARIA labels, lang="sk-SK"
Sitemap FreshnessPrešlo
Newest <lastmod> 92 day(s) ago
Text-to-HTML RatioInfo
3% ratio but 1017 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.
Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.
Kategória 2 / 7 · hype.sk · Zulien Score

Security

57/100
Váha: 15% · 6 OK · 8 upozornení · 3 chýb · spolu 17
HSTS (Strict-Transport-Security)Zlyhalo
Prečo je to dôležité: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection. This is the #1 way to steal session cookies on public WiFi.
Ako opraviť: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
Content-Security-Policy (CSP)Zlyhalo
Prečo je to dôležité: CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.
Ako opraviť: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
Clickjacking ProtectionZlyhalo
Prečo je to dôležité: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
Ako opraviť: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
CAA DNS RecordUpozornenie
No CAA records — any CA can issue certificates for this domain
Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
X-Content-Type-OptionsUpozornenie
Prečo je to dôležité: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.
Ako opraviť: Add header: X-Content-Type-Options: nosniff
Referrer-PolicyUpozornenie
Prečo je to dôležité: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.
Ako opraviť: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
Permissions-PolicyUpozornenie
Prečo je to dôležité: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.
Ako opraviť: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
Subresource Integrity (SRI)Upozornenie
Only 0/3 SRI-eligible third-party scripts have integrity hashes (3 auto-updating provider script(s) excluded — SRI not applicable)
Prečo je to dôležité: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site. The British Airways breach (£20M fine) was exactly this attack vector.
Ako opraviť: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
security.txt (RFC 9116)Upozornenie
Prečo je to dôležité: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all. Required by ISO 27001 and SOC 2.
Ako opraviť: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
CDN / WAF ProtectionUpozornenie
Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts. Cloudflare blocks 150+ billion daily threats.
Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
Iframe SandboxingUpozornenie
1/1 unknown iframe(s) without sandbox attribute
Prečo je to dôležité: Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS.
Ako opraviť: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
SSL/TLS CertificatePrešlo
Valid HTTPS connection established
DNSSECPrešlo
Zone is DNSSEC-signed (DNSKEY published)
Prečo je to dôležité: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.
HTTP → HTTPS RedirectPrešlo
HTTP properly redirects to HTTPS
Cookie Security FlagsPrešlo
No cookies set on initial response
Technology DisclosurePrešlo
Server: openresty (no version)
Server Version DisclosurePrešlo
openresty — version hidden
Kategória 3 / 7 · hype.sk · Zulien Score

Mobile

67/100
Váha: 10% · 7 OK · 8 upozornení · 1 chýb · spolu 16
Form Input Labels (WCAG 3.3.2)Zlyhalo
Iba 0/18 inputs má label (0%)
Prečo je to dôležité: EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.
Ako opraviť: 18 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
Mobile Performance ScoreUpozornenie
62/100 (target: 90+)
Prečo je to dôležité: Over 65% of e-commerce traffic is mobile (Statista 2024). Google ranks based on mobile performance, not desktop. Mobile score <50 means you're penalized in mobile search.
Ako opraviť: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.
Touch Target SizeUpozornenie
Prečo je to dôležité: Small tap targets cause 37% more mis-taps on mobile (Google UX research). In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityUpozornenie
Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience. Users over 40 are especially affected — and they have the highest purchasing power.
Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
Theme ColorUpozornenie
Prečo je to dôležité: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional — small detail, big perception impact.
Ako opraviť: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Apple Mobile Web AppUpozornenie
Missing: apple-mobile-web-app-capable, status-bar-style
Prečo je to dôležité: These tags enable 'Add to Home Screen' on iOS with a full-screen experience. 45% of mobile shoppers use iOS — a polished home screen presence increases return visits.
Ako opraviť: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
Form Input TypesUpozornenie
phone fields use type='text' instead of type='tel'
Prečo je to dôležité: Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors by 30% and speeds up form completion (Baymard Institute).
Ako opraviť: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
Print StylesheetUpozornenie
Order/invoice page without print styles
Prečo je to dôležité: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.
Ako opraviť: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
Fixed Width ElementsUpozornenie
Large fixed-width elements detected — may cause horizontal scroll
Prečo je to dôležité: Fixed-width elements wider than the viewport cause horizontal scrolling on mobile. Google's mobile-friendly test specifically checks for this.
Ako opraviť: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
Viewport ConfigurationPrešlo
width=device-width, initial-scale=1
Content Fits ViewportPrešlo
No horizontal scrolling needed
Responsive Design TechniquesPrešlo
Flexbox, CSS Grid, Media queries detected
Mobile Navigation (Semantic)Prešlo
<nav> element present — proper navigation landmark
Responsive Images (srcset)Prešlo
9 image(s) use srcset for responsive sizing
Heading Hierarchy (WCAG 1.3.1)Prešlo
Žiadne preskočené úrovne
Link Text Quality (WCAG 2.4.4)Prešlo
Všetky odkazy majú popisný text
Kategória 4 / 7 · hype.sk · Zulien Score

AI Readiness

68/100
Váha: 10% · 13 OK · 15 upozornení · 3 chýb · spolu 31
llms.txt (AI Site Descriptor)Zlyhalo
Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.
Ako opraviť: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.
Heading Hierarchy for AIZlyhalo
5 H1, 34 H2, 9 H3 — poor structure
Prečo je to dôležité: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.
Ako opraviť: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
Image Alt Text Quality for AIZlyhalo
Only 22% quality alt text — 25 missing, 3 poor
Prečo je to dôležité: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.
Ako opraviť: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
llms-full.txt (Complete AI Content)Upozornenie
Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
Ako opraviť: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
Organization Schema + Entity LinkingUpozornenie
Organization schema found but no sameAs links
Prečo je to dôležité: sameAs links tell AI: 'This is the same entity across the web.' Sites with sameAs to Wikipedia are 3x more likely to appear in AI-generated answers. It's how Google builds Knowledge Panels.
Ako opraviť: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.
FAQ Schema (Direct AI Answers)Upozornenie
Prečo je to dôležité: FAQ schema provides 30% higher AI citation rates (LLMClicks research). ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. It's the fastest way to get your content cited by AI.
Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Semantic HTML StructureUpozornenie
2/6 elements — missing: <article>, <header>, <footer>, <aside>
Prečo je to dôležité: AI crawlers don't see your CSS. They rely on semantic HTML to distinguish main content from navigation, ads, and boilerplate. The WordLift AI Audit weights semantic HTML as a primary machine-readability signal.
Ako opraviť: Add: <article>, <header>, <footer>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
Structured Content (Lists & Tables)Upozornenie
12 lists found — consider adding comparison tables
Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with much higher accuracy than paragraph text. Structured content = more AI citations.
Ako opraviť: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.
Content Freshness SignalsUpozornenie
Schema dates found but no visible date on page
Prečo je to dôležité: 76.4% of ChatGPT's top 1000 cited pages were updated within 30 days. AI-cited content is 25.7% fresher than traditional organic results. Freshness signals tell AI your content is current and reliable.
Ako opraviť: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
Entity Clarity & Brand SignalsUpozornenie
OG tags complete but no sameAs entity links
Prečo je to dôležité: AI needs to confidently identify your brand entity. Open Graph + sameAs create a cross-platform identity that AI models recognize. The HubSpot AEO Grader found entity clarity is a top-3 factor for AI brand recognition.
Ako opraviť: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
Author Expertise Signals (E-E-A-T)Upozornenie
Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited 3x more than anonymous content. This is especially important for product guides, reviews, and advice content.
Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Statistics & Data PresenceUpozornenie
Only 2 data point(s) — add more
Prečo je to dôležité: Princeton/Georgia Tech study found that adding statistics to content improves AI visibility by 41% — the single most effective GEO optimization. AI assistants prefer content with verifiable data points.
Ako opraviť: Add specific statistics, percentages, dollar amounts, and quantified claims. E.g., '93% of customers report...', 'saves an average of €200/year', '3x faster than...' Data makes content citable.
Section Length OptimizationUpozornenie
Avg section: 40 words — only 6% in 80-200 word optimal range
Prečo je to dôležité: Pages with 120-180 word sections earn 70% more AI citations (Otterly Citation Economy 2026). For Google AI Overviews specifically, 100-150 words per section is the sweet spot.
Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsUpozornenie
Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.
Ako opraviť: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
Content Readability for AIUpozornenie
Grade 18 — too complex for broad AI citation (technical threshold: 14)
Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are 28% more likely to be cited by AI.
Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Expert Quotations & CitationsUpozornenie
Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.
Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
ai.txt (AI Permissions)Upozornenie
Prečo je to dôležité: ai.txt is an emerging standard (proposed May 2025) for fine-grained AI permissions beyond robots.txt. Early adoption signals AI-forward thinking and gives you control over how AI uses your content.
Ako opraviť: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
WebMCP Agentic ReadinessUpozornenie
Prečo je to dôležité: WebMCP is called 'the new Schema.org moment' — it's how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
AI Bot Access PolicyPrešlo
No AI bot restrictions (allowed by default)
Content Accessibility for AIPrešlo
1017 words in raw HTML (3.0% text ratio) — readable by AI crawlers without executing JS
Structured Data FoundationPrešlo
1 JSON-LD blocks with 10 schema types: WebPage, ReadAction, ImageObject, BreadcrumbList, ListItem, WebSite
Breadcrumb SchemaPrešlo
BreadcrumbList structured data found — clear navigation hierarchy
Site Search Schema (SearchAction)Prešlo
WebSite SearchAction configured — AI can search your store
Content Depth for AIPrešlo
1017 words — rich content for AI analysis and citation
Answer-First Content FormatPrešlo
First paragraph: 44 words — good content density above the fold
Extractable Answer BlocksPrešlo
25 paragraphs, avg 63 words — optimal for AI extraction
Internal Link DensityPrešlo
50 contextual internal links per 1,000 words — strong knowledge graph signal
Canonical Tag for AI DeduplicationPrešlo
Self-referencing canonical — clean signal for AI
Knowledge Graph ReadinessPrešlo
3/4 entity signals — strong Knowledge Graph presence
Content-to-Boilerplate RatioPrešlo
91% of text in <main>/<article> — clean content signal
Social Proof (Testimonials / Case Studies)Prešlo
Strong social proof: testimonials, case studies / portfolio
Kategória 5 / 7 · hype.sk · Zulien Score

GDPR

71/100
Váha: 10% · 7 OK · 6 upozornení · 1 chýb · spolu 14
Privacy Policy PageZlyhalo
Prečo je to dôležité: A missing privacy policy is the #1 most cited GDPR violation. Every EU data protection authority considers this a basic requirement — and fines start at €5,000 for small businesses.
Ako opraviť: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).
GDPR Art. 12 · GDPR Art. 13 · GDPR Art. 14 · SK 18/2018 § 19 · SK 18/2018 § 20
Cookie PolicyUpozornenie
Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
Terms & Conditions PageUpozornenie
Prečo je to dôležité: EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights.
Ako opraviť: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
Third-party Data SharingUpozornenie
6 third-party domains loading scripts
Prečo je to dôležité: Every third-party script is a potential data processor under GDPR. You need a DPA with each one, and they must be disclosed to users. Excessive third parties also increase data breach risk.
Ako opraviť: Your page loads scripts from 6 external domains. Review each one: cdn-cookieyes.com, www.googletagmanager.com, www.google.com, cdn.jsdelivr.net, t.leady.com... Ensure each has a Data Processing Agreement (DPA) and is listed in your privacy policy.
Forms Without Privacy NoticeUpozornenie
4 form(s) on page with no privacy policy link
Prečo je to dôležité: GDPR Article 13 requires informing users about data processing at the point of collection. Forms without privacy notices violate the transparency principle.
Ako opraviť: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.
Right to Erasure (Data Deletion)Upozornenie
Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process. Italian DPA fined companies €20M+ for obstructing erasure requests.
Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Data Protection Officer ContactUpozornenie
Prečo je to dôležité: GDPR Article 37 requires a DPO for organizations processing personal data at scale. Even if not mandatory, having a designated privacy contact builds trust and is expected by regulators.
Ako opraviť: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
Cookie Consent Banner (CMP)Prešlo
CookieYes detected
Tracking Scripts & ConsentPrešlo
2 tracker(s) detected with CMP: Google Analytics/GTM, Meta Pixel
Google Consent Mode v2Prešlo
Consent mode signals detected (ad_storage, analytics_storage)
Legal Contact / Imprint PagePrešlo
/o-nas
Data Encryption (No Mixed Content)Prešlo
All resources loaded over HTTPS
Newsletter ConsentPrešlo
Newsletter form with consent mechanism detected
Withdrawal of Consent MechanismPrešlo
Consent withdrawal / opt-out mechanism found
Kategória 6 / 7 · hype.sk · Zulien Score

Vulnerability

48/100
Váha: 10% · 6 OK · 6 upozornení · 6 chýb · spolu 18
CMS Version DisclosureZlyhalo
"WordPress 6.7.5" exposed in meta generator
Prečo je to dôležité: Knowing your exact CMS version lets attackers search CVE databases instantly. E.g., PrestaShop 1.7.8.x is associated with known SQL injection CVEs. Hiding the version forces attackers to guess.
Ako opraviť: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.
Admin Panel at Default URLZlyhalo
Accessible at: /admin, /wp-admin
Prečo je to dôležité: Default admin URLs receive thousands of automated brute-force attempts daily. Botnets target /admin, /wp-admin, /administrator relentlessly. A renamed path blocks 99% of automated attacks.
Ako opraviť: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).
Suspicious Inline Script PatternsZlyhalo
Detected: Dynamic script injection
Prečo je to dôležité: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. The 2024 Akamai report found skimmers disguised as Google Tag Manager on thousands of e-commerce sites.
Ako opraviť: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
DMARC Policy (Email Auth)Zlyhalo
Prečo je to dôležité: Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.
Ako opraviť: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
Clickjacking on Sensitive PageZlyhalo
Login/payment page without X-Frame-Options or CSP frame-ancestors
Prečo je to dôležité: Clickjacking on payment/login pages is a high-severity vulnerability. Users unknowingly submit credentials or payments through invisible iframes. PCI DSS requires frame-busting on payment pages.
Ako opraviť: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
Server Error LeakZlyhalo
PHP/server error messages visible in page output
Prečo je to dôležité: Error messages reveal file paths, database structure, table names, and query logic. This is a goldmine for attackers — it turns a blind SQL injection into a targeted one, reducing attack time from days to minutes.
Ako opraviť: Set display_errors=Off in php.ini and log_errors=On. Configure a custom error page. Never show stack traces, SQL errors, or file paths to users.
CMS Information FilesUpozornenie
readme.html accessible — reveals version details
Prečo je to dôležité: Even if you hide the generator tag, readme.html and CHANGELOG.txt reveal exact version numbers. Attackers check these as a fallback.
Ako opraviť: Delete or block access to readme.html. These files reveal your exact CMS version and update history.
Form CSRF ProtectionUpozornenie
1/4 forms have CSRF tokens
Prečo je to dôležité: Forms without CSRF tokens allow cross-site request forgery — an attacker's site can submit orders, change settings, or modify data on behalf of your logged-in users.
Ako opraviť: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
Open Redirect DetectionUpozornenie
URL redirect parameter found in page links
Prečo je to dôležité: Open redirects are used in phishing attacks — attackers craft URLs that appear to be your domain but redirect to a malicious site. This abuses your domain's trust.
Ako opraviť: Validate all redirect URLs server-side against a whitelist. Never allow user-controlled redirect targets without validation.
Source Maps ExposedUpozornenie
JavaScript source maps (.js.map) are publicly accessible
Prečo je to dôležité: Source maps reveal your original source code, variable names, comments, and application logic. Attackers use this to find vulnerabilities, API keys in code, and understand your authentication flow.
Ako opraviť: Remove source maps from production or block access via server config. In Vite/Webpack: set sourcemap: false for production builds.
Cross-Origin IsolationUpozornenie
Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
CDN Script Integrity (SRI)Upozornenie
1 CDN script(s) without Subresource Integrity
Prečo je to dôležité: CDN scripts without SRI can be tampered with if the CDN is compromised. The polyfill.io attack (2024, 380K+ sites) and British Airways breach (£20M fine) were both CDN supply chain attacks.
Ako opraviť: Add integrity='sha384-...' crossorigin='anonymous' to CDN scripts from: cdn.jsdelivr.net. Generate hashes at srihash.org.
Sensitive Files ExposedPrešlo
.env, .git, composer.json — all properly blocked
Install Script ExposedPrešlo
No /install/ or /setup/ paths accessible
Directory ListingPrešlo
Disabled — file structure hidden
Debug Mode / Error ExposurePrešlo
No debug indicators found in page output
SPF Record (Email Security)Prešlo
SPF configured: v=spf1 a mx include:_spf.m1.websupport.sk ?all
DKIM Signing (Email Auth)Prešlo
DKIM configured (selectors: mail)
Kategória 7 / 7 · hype.sk · Zulien Score

Ďalšie kroky

  1. Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
  2. Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
  3. Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
  4. Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/hype.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk