# php.net — Zulien Score 70/100 (známka B)

> Bezplatný audit e-shopu: 70/100 celkové skóre. 100+ kontrol v 7 kategóriách (výkon, SEO, bezpečnosť, mobil, AI pripravenosť, GDPR, zraniteľnosti).

- **Auditovaný:** https://www.php.net
- **Dátum auditu:** 2026-07-16
- **Plná správa:** https://score.zulien.sk/cs/r/php.net
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/php.net

## Zhrnutie auditu

Váš web má základné webové zdravie, ale chýbajú mu kritické časti. Hneď pridajte H1 nadpis na každú stránku. Vaša SEO je relatívne silná, čím máte dobrý základ na rozvoj.

## Skóre podľa kategórií

| Kategória | Skóre |
|---|---|
| Výkon | 91/100 |
| SEO | 70/100 |
| Bezpečnosť | 66/100 |
| Mobil | 88/100 |
| AI pripravenosť | 49/100 |
| GDPR | 48/100 |
| Zraniteľnosti | 68/100 |
| Prístupnosť | 53/100 |

## Detailné nálezy

### Výkon — 91/100

- **[CHYBA]** Script Loading Strategy — Only 14% of 7 scripts optimized — most are render-blocking
  - Riešenie: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** CSS File Count — 10 CSS files — too many!
  - Riešenie: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Resource Hints (Preload/Preconnect)
  - Riešenie: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Lazy Loading — 4 images without lazy loading
  - Riešenie: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Critical CSS Strategy — 10 CSS files without critical CSS extraction
  - Riešenie: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Dôkaz: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Dôkaz: PSI-lab
- **[OK]** Server Response Time (TTFB) — 8ms
  - Dôkaz: PSI-lab
- **[OK]** First Contentful Paint (FCP) — 0.26s
  - Dôkaz: PSI-lab
- **[OK]** Largest Contentful Paint (LCP) — 0.48s — Core Web Vital ✓
  - Dôkaz: PSI-lab
- **[OK]** Total Blocking Time (TBT) — 142ms
  - Dôkaz: PSI-lab
- **[OK]** Cumulative Layout Shift (CLS) — 0.002 — Core Web Vital ✓
  - Dôkaz: PSI-lab
- **[OK]** Speed Index — 0.94s
  - Dôkaz: PSI-lab
- **[OK]** Total Page Weight — 925 KB (26 requests)
  - Dôkaz: PSI-lab
- **[OK]** Unused Code (CSS + JS) — Only 34 KB of unused code — well optimized
  - Dôkaz: PSI-lab
- **[OK]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Dôkaz: HTTP-header

### SEO — 70/100

- **[CHYBA]** H1 Heading
  - Riešenie: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Structured Data (JSON-LD)
  - Riešenie: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
  - Dôkaz: schema
- **[UPOZORNENIE]** Meta Title — 3 chars (optimal: 30-60)
  - Riešenie: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Open Graph Tags — Missing: og:title
  - Riešenie: Add the missing OG tags: og:title. Use high-quality 1200×630px images for og:image.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Alt Attributes — Only 75% of 4 images have alt text
  - Riešenie: 1 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Format Optimization — 0% next-gen formats — 0 JPEG, 1 PNG images
  - Riešenie: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical URL Consistency — Canonical points to different URL: https://www.php.net/index.php
  - Riešenie: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Sitemap in robots.txt — robots.txt exists but doesn't reference your sitemap
  - Riešenie: Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Deep Heading Hierarchy — No H3 subheadings for long content
  - Riešenie: Add H3 subheadings under your H2 sections to create a deeper content hierarchy. This helps search engines understand sub-topics and improves featured snippet eligibility.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Internal Linking — Only 4 internal links
  - Riešenie: Add more internal links to related content. Target 5+ internal links per page for strong site crawlability.
  - Dôkaz: HTML-heuristic
- **[OK]** Meta Description — 132 chars
  - Dôkaz: HTML-heuristic
- **[OK]** Content Structure (H2 Headings) — 25 H2 subheadings found
  - Dôkaz: HTML-heuristic
- **[OK]** Open Graph Image Format — image/png
  - Dôkaz: HTML-heuristic
- **[OK]** Twitter/X Cards — Card type: summary_large_image
  - Dôkaz: HTML-heuristic
- **[OK]** Canonical URL — https://www.php.net/index.php
  - Dôkaz: HTML-heuristic
- **[OK]** robots.txt — Present
  - Dôkaz: file-probe
- **[OK]** XML Sitemap — Found with ~39+ URLs
  - Dôkaz: file-probe
- **[OK]** HTML Language Attribute — lang="en"
  - Dôkaz: HTML-heuristic
- **[OK]** Hreflang Tags (Multilingual) — 1 language(s): x-default
  - Dôkaz: HTML-heuristic
- **[OK]** Text-to-HTML Ratio — 27% (2001 words)
  - Dôkaz: HTML-heuristic
- **[OK]** Favicon — Favicon detected
  - Dôkaz: file-probe
- **[OK]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <header>, <footer>, <aside>
  - Dôkaz: HTML-heuristic
- **[OK]** Content Depth — 2001 words — sufficient content
  - Dôkaz: HTML-heuristic
- **[OK]** Accessibility Fundamentals — 3/4 a11y signals: 3 ARIA roles, 11 ARIA labels, lang="en"
  - Dôkaz: HTML-heuristic

### Bezpečnosť — 66/100

- **[CHYBA]** Content-Security-Policy (CSP)
  - Riešenie: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** DNSSEC — No DNSKEY records — zone is unsigned
  - Riešenie: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Dôkaz: DNS
- **[UPOZORNENIE]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Riešenie: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Dôkaz: DNS
- **[UPOZORNENIE]** HSTS (Strict-Transport-Security) — max-age too short (15768000s, need 31536000), missing includeSubDomains
  - Riešenie: Set: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org for browser preloading.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** X-Content-Type-Options
  - Riešenie: Add header: X-Content-Type-Options: nosniff
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Referrer-Policy
  - Riešenie: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Cookie Security Flags — 1 cookie(s): 1 missing Secure, 1 missing HttpOnly, 1 missing SameSite
  - Riešenie: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Technology Disclosure — Server: BunnyCDN-DE1-1331
  - Riešenie: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** CDN / WAF Protection
  - Riešenie: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Dôkaz: HTTP-header
- **[OK]** SSL/TLS Certificate — Valid HTTPS connection established
  - Dôkaz: SSL
- **[OK]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Dôkaz: HTTP-header
- **[OK]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN
  - Dôkaz: HTTP-header
- **[OK]** Permissions-Policy — interest-cohort=()
  - Dôkaz: HTTP-header
- **[OK]** Subresource Integrity (SRI) — No SRI-eligible third-party scripts loaded
  - Dôkaz: HTML-heuristic
- **[OK]** security.txt (RFC 9116) — Present at /.well-known/security.txt
  - Dôkaz: file-probe
- **[OK]** Server Version Disclosure — BunnyCDN-DE1-1331 — version hidden
  - Dôkaz: HTTP-header

### Mobil — 88/100

- **[UPOZORNENIE]** Touch Target Size
  - Riešenie: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Font Size Readability
  - Riešenie: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Responsive Design Techniques
  - Riešenie: Implement responsive CSS with @media queries for key breakpoints: 480px (small mobile), 768px (tablet), 1024px (laptop). Use Flexbox and CSS Grid for fluid layouts.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Theme Color
  - Riešenie: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Responsive Images (srcset) — 4 images without responsive sizing
  - Riešenie: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Text Overflow Handling — No word-break/overflow-wrap CSS detected
  - Riešenie: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
  - Dôkaz: HTML-heuristic
- **[OK]** Viewport Configuration — width=device-width, initial-scale=1
  - Dôkaz: HTML-heuristic
- **[OK]** Mobile Performance Score — 99/100 — excellent
  - Dôkaz: PSI-lab
- **[OK]** Content Fits Viewport — No horizontal scrolling needed
  - Dôkaz: HTML-heuristic
- **[OK]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Dôkaz: HTML-heuristic
- **[OK]** Form Input Types — Optimized: 2 search
  - Dôkaz: HTML-heuristic
- **[OK]** Form Input Labels (WCAG 3.3.2) — 2/2 inputs majú label
  - Dôkaz: HTML-heuristic
- **[OK]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Dôkaz: HTML-heuristic

### AI pripravenosť — 49/100

- **[CHYBA]** Structured Data Foundation
  - Riešenie: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
  - Dôkaz: schema
- **[CHYBA]** Organization Schema + Entity Linking
  - Riešenie: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Dôkaz: schema
- **[CHYBA]** Heading Hierarchy for AI — 0 H1, 25 H2, 0 H3 — poor structure
  - Riešenie: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Entity Clarity & Brand Signals
  - Riešenie: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Common Question Coverage — Answers only 1/5 key shopper questions: availability
  - Riešenie: Your page barely addresses core shopper questions. Add sections covering price, shipping (options + cost), returns/refunds, availability, and payment methods — as visible text, not just in schema. Link to a dedicated FAQ, Shipping, and Returns page.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Knowledge Graph Readiness
  - Riešenie: Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Image Alt Text Quality for AI — Only 0% quality alt text — 1 missing, 3 poor
  - Riešenie: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Content-to-Boilerplate Ratio — Only 3% in main content — mostly boilerplate
  - Riešenie: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** FAQ Schema (Direct AI Answers)
  - Riešenie: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Dôkaz: schema
- **[UPOZORNENIE]** Structured Content (Lists & Tables) — 7 lists found — consider adding comparison tables
  - Riešenie: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Content Freshness Signals — Visible date found but not in structured data
  - Riešenie: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Author Expertise Signals (E-E-A-T)
  - Riešenie: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Extractable Answer Blocks — 82 paragraphs, avg 21 words — too short for citation
  - Riešenie: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Statistics & Data Presence — No statistical data found in content
  - Riešenie: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Section Length Optimization — Avg section: 69 words — only 8% in 80-200 word optimal range
  - Riešenie: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Q&A Format Headings
  - Riešenie: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Internal Link Density — only 2/1000w (target: 3-5)
  - Riešenie: Add 3-5 contextual internal links per 1,000 words using descriptive anchor text. Link to related products, categories, and guides. Replace generic anchors ('click here', 'read more') with descriptive text.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.php.net/index.php
  - Riešenie: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Expert Quotations & Citations
  - Riešenie: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** WebMCP Agentic Readiness
  - Riešenie: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Social Proof (Testimonials / Case Studies)
  - Riešenie: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is a leading credibility lever.
  - Dôkaz: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Dôkaz: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Dôkaz: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Dôkaz: file-probe
- **[INFO]** Agent-Commerce Readiness — 50/100 — čiastočne pripravené (Prístup 100 · Porozumenie 0 · Transakcia 50)
- **[INFO]** Agent: Prístup — dostane sa agent dnu — 100/100 (2 signály/-ov)
- **[INFO]** Agent: Porozumenie — rozumie produktom — 0/100 (2 signály/-ov)
- **[INFO]** Agent: Transakcia — vie konať (kôš/podmienky) — 50/100 (1 signál)
- **[OK]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Dôkaz: file-probe
- **[OK]** Content Accessibility for AI — 2001 words in raw HTML (26.8% text ratio) — readable by AI crawlers without executing JS
  - Dôkaz: HTML-heuristic
- **[OK]** Content Depth for AI — 2001 words — rich content for AI analysis and citation
  - Dôkaz: HTML-heuristic
- **[OK]** Answer-First Content Format — First paragraph: 249 words — good content density above the fold
  - Dôkaz: HTML-heuristic
- **[OK]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <header>, <footer>, <aside>
  - Dôkaz: HTML-heuristic
- **[OK]** Content Readability for AI — Flesch-Kincaid Grade 8 — accessible and clear
  - Dôkaz: HTML-heuristic

### GDPR — 48/100

- **[CHYBA]** Cookie Consent Banner (CMP)
  - Riešenie: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Tracking Scripts Without Consent — 1 tracker(s) loading without consent: Matomo
  - Riešenie: These tracking scripts fire before user consent: Matomo. Configure your CMP to block them until explicit opt-in. Use Tag Manager's consent mode or CMP script blocking.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Cookie Policy
  - Riešenie: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Legal Contact / Imprint Page
  - Riešenie: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Terms & Conditions Page
  - Riešenie: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Personal Data Exposure in Source — 1 personal email(s) in page source: php@fosstodon.org
  - Riešenie: Remove person-named email addresses (e.g. firstname.lastname@) from the public HTML. Use role mailboxes (info@, sales@) or a contact form instead.
  - Dôkaz: HTML-heuristic · php@fosstodon.org · istota: low
- **[UPOZORNENIE]** Right to Erasure (Data Deletion)
  - Riešenie: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Data Protection Officer Contact
  - Riešenie: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Withdrawal of Consent Mechanism
  - Riešenie: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Dôkaz: HTML-heuristic
- **[OK]** Privacy Policy Page — /privacy.php
  - Dôkaz: HTML-heuristic
- **[OK]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Dôkaz: HTML-heuristic

### Zraniteľnosti — 68/100

- **[CHYBA]** Sensitive Files Exposed — composer.json (dependency map) — CRITICAL!
  - Riešenie: URGENT: Block these files immediately! Apache: add to .htaccess: <FilesMatch '\.(env\|git\|json)$'>Require all denied</FilesMatch>. Nginx: location ~ /\. { deny all; }
  - Dôkaz: file-probe
- **[CHYBA]** Install Script Exposed — /install/, /install.php or /setup/ still accessible — CRITICAL!
  - Riešenie: Delete the install/ and setup/ directories from the web root immediately after CMS installation. Attackers can reset the database or re-run the installer to seize admin access.
  - Dôkaz: file-probe
- **[CHYBA]** Form CSRF Protection — 1 form(s) without CSRF tokens
  - Riešenie: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Dôkaz: HTML-heuristic · istota: low
- **[UPOZORNENIE]** package.json Exposed — package.json accessible — reveals all dependencies and versions
  - Riešenie: Block access to package.json via .htaccess or server config. It should never be served to the public.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Riešenie: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
  - Dôkaz: DNS
- **[UPOZORNENIE]** Cross-Origin Isolation
  - Riešenie: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Dôkaz: HTTP-header
- **[OK]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Dôkaz: HTML-heuristic
- **[OK]** Directory Listing — Disabled — file structure hidden
  - Dôkaz: file-probe
- **[OK]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Dôkaz: file-probe
- **[OK]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Dôkaz: HTML-heuristic
- **[OK]** jQuery Version — jQuery 3.6.0
  - Dôkaz: file-probe
- **[OK]** SPF Record (Email Security) — SPF configured: v=spf1 ip4:140.211.15.143 ip4:45.112.84.5 ip4:142.93.197.176 ip6:2604:a880:400:d
  - Dôkaz: DNS
- **[OK]** DKIM Signing (Email Auth) — DKIM configured (selectors: mail)
  - Dôkaz: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Prístupnosť — 53/100

- **[CHYBA]** Heading Structure — The page has no <h1> heading
  - Riešenie: Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Landmark Regions — No <main> landmark region found
  - Riešenie: Wrap the primary content in <main> and use <nav>, <header>, <footer> for the page regions.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Alt Text — 1 of 4 images missing alt text
  - Riešenie: Add alt text to the remaining images (alt="" for decorative ones).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Skip Link — No skip-to-content link detected
  - Riešenie: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Dôkaz: HTML-heuristic · istota: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[OK]** Page Language — <html lang="en"> is set
  - Dôkaz: HTML-heuristic
- **[OK]** Form Labels — All 2 form inputs are labelled
  - Dôkaz: HTML-heuristic
- **[OK]** Link Text — Links use descriptive text
  - Dôkaz: HTML-heuristic · istota: low
- **[OK]** Zoom & Scaling — Pinch-zoom is not disabled
  - Dôkaz: HTML-heuristic

---

Zulien Score je bezplatný automatizovaný heuristický audit pokrývajúci výkon (Core Web Vitals, TTFB, page weight), SEO (meta tagy, štruktúrované dáta, sitemap), bezpečnosť (SSL/TLS, HSTS, CSP), mobilnú použiteľnosť, AI pripravenosť, súlad s GDPR / ePrivacy a zraniteľnosti. Výsledky sú cache-ované na 6 hodín a re-skenovateľné na požiadanie.

[Zobraziť plnú interaktívnu správu na Zulien Score →](https://score.zulien.sk/cs/r/php.net)
