# dev.proenergy.sk — Zulien Score 73/100 (Grade B)

> Free e-commerce audit: 73/100 overall score. Platform: WooCommerce (WP 6.1.1). 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://dev.proenergy.sk
- **Platform:** WooCommerce (WP 6.1.1)
- **Scan date:** 2026-10-19
- **Full report:** https://score.zulien.sk/de/r/dev.proenergy.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/dev.proenergy.sk

## Audit summary

Your store works reasonably well, but has notable gaps in SEO and security. Prioritize adding meta descriptions to all products and pages immediately. On the bright side, your accessibility for all visitors is excellent.

## Score by category

| Category | Score |
|---|---|
| Performance | 87/100 |
| SEO | 66/100 |
| Security | 60/100 |
| Mobile | 72/100 |
| AI Readiness | 48/100 |
| GDPR | 65/100 |
| Vulnerability | 76/100 |
| Accessibility | 100/100 |

## Detailed findings

### Performance — 87/100

- **[FAIL]** Script Loading Strategy — Only 0% of 41 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
  - Evidence: HTML-heuristic
- **[FAIL]** CSS File Count — 28 CSS files — too many!
  - Fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Evidence: HTML-heuristic
- **[WARN]** Request Budget — 120 requests — over the budget of 80, but at or below the median of the award-winning shops we benchmarked (140)
  - Fix: Bundle CSS/JS that always loads together, serve icons as a sprite or font rather than individual files, and lazy-load below-fold images so they aren't requested on load.
  - Evidence: PSI-lab · 120 requests · confidence: high
- **[WARN]** Unused Code (CSS + JS) — 94 KB unused (CSS: 59 KB, JS: 36 KB)
  - Fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
  - Evidence: PSI-lab
- **[WARN]** Resource Hints (Preload/Preconnect)
  - Fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
  - Evidence: HTML-heuristic
- **[WARN]** Lazy Loading — 7 images without lazy loading
  - Fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
  - Evidence: HTML-heuristic
- **[WARN]** Font Loading Strategy — Google Fonts detected without font-display
  - Fix: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.
  - Evidence: HTML-heuristic
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 28 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Cache-Control Strategy — Not measured — no Cache-Control on the HTML document; static-asset caching was not sampled
  - Evidence: HTTP-header
- **[PASS]** Server Response Time (TTFB) — 28ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.92s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 1.20s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 14ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.000 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 1.66s
  - Evidence: PSI-lab
- **[PASS]** Total Page Weight — 784 KB (120 requests)
  - Evidence: PSI-lab
- **[PASS]** JavaScript Budget — 428 KB — within the 600 KB budget
  - Evidence: PSI-lab · 428 KB JavaScript · confidence: high
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header

### SEO — 66/100

- **[FAIL]** Meta Description
  - Fix: Write a compelling meta description (120-160 chars) with a call-to-action. Include your target keyword naturally.
  - Evidence: HTML-heuristic
- **[FAIL]** Text-to-HTML Ratio — 0% — very thin content (33 words)
  - Fix: Your page is almost entirely HTML/CSS/JS with very little actual content. Add substantial product descriptions, content blocks, and informational text.
  - Evidence: HTML-heuristic
- **[FAIL]** Content Depth — Only 33 words — very thin content
  - Fix: This page has almost no text content. Add detailed product descriptions, buying guides, FAQs, or informational content. Search engines need text to understand and rank your page.
  - Evidence: HTML-heuristic
- **[FAIL]** Internal Linking — No internal links found
  - Fix: Add internal links to other pages on your site. Every page should link to related content, categories, and key landing pages.
  - Evidence: HTML-heuristic
- **[FAIL]** Robots Noindex Warning — meta robots="noindex, nofollow" — page excluded from search!
  - Fix: Your page has 'noindex' which blocks it from Google entirely. Remove 'noindex' unless this page is intentionally hidden (staging, duplicates).
  - Evidence: HTML-heuristic
- **[WARN]** Content Structure (H2 Headings) — Only 1 H2 subheading
  - Fix: Add more H2 subheadings to break content into scannable sections. Include secondary keywords in H2 tags.
  - Evidence: HTML-heuristic
- **[WARN]** Open Graph Tags — Missing: og:description, og:image
  - Fix: Add the missing OG tags: og:description, og:image. Use high-quality 1200×630px images for og:image.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL — og:url present (https://dev.proenergy.sk/prihlasenie/) but <link rel=canonical> missing
  - Fix: Add <link rel='canonical' href='https://dev.proenergy.sk/prihlasenie/'> to <head>. og:url covers social sharing; canonical covers Google + AI crawlers explicitly.
  - Evidence: HTML-heuristic
- **[WARN]** Meta Robots Tag — "noindex, nofollow" — page is set to noindex (hidden from search)
  - Fix: If this is your live public page, remove 'noindex' from the meta robots tag immediately — it removes the page from Google. If this is intentional (staging, thank-you, or filtered page), you can ignore this.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — 0% next-gen formats — 0 JPEG, 3 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Evidence: HTML-heuristic
- **[WARN]** Excessive Resource Requests — 41 JS + 28 CSS = 69 external requests
  - Fix: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 30 chars — "Prihlásenie - PROENERGY PORTAL"
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "Prihlásenie"
  - Evidence: HTML-heuristic
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 1 block(s): WebPage, ReadAction, BreadcrumbList, ListItem
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 1 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Sitemap index with 6 child sitemaps
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Hreflang Tags (Multilingual) — 3 language(s): sk, cs, en
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 100% of 7 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Semantic HTML Structure — 6/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>, <aside>
  - Evidence: HTML-heuristic
- **[PASS]** Empty/Dead Links — 2 minor dead link(s) — acceptable
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 4/4 a11y signals: 11 ARIA roles, 5 ARIA labels, skip link, lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 146 day(s) ago
  - Evidence: HTML-heuristic

### Security — 60/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Cookie Security Flags — 1 cookie(s): 1 missing HttpOnly
  - Fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Evidence: HTTP-header
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: openresty (no version)
  - Evidence: HTTP-header
- **[PASS]** Subresource Integrity (SRI) — All cross-origin scripts are auto-updating provider scripts where SRI does not apply
  - Evidence: HTML-heuristic
- **[PASS]** Server Version Disclosure — openresty — version hidden
  - Evidence: HTTP-header
- **[PASS]** Password Field Security — 1 password field(s) — allow password manager autofill
  - Evidence: HTTP-header

### Mobile — 72/100

- **[WARN]** Mobile Performance Score — 71/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Inline CSS Size — 107 KB of inline CSS
  - Fix: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
  - Evidence: HTML-heuristic
- **[WARN]** Responsive Images (srcset) — 7 images without responsive sizing
  - Fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Evidence: HTML-heuristic
- **[WARN]** Apple Mobile Web App — Missing: apple-mobile-web-app-capable, status-bar-style
  - Fix: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Labels (WCAG 3.3.2) — 2/2 inputs have a label
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy (WCAG 1.3.1) — No skipped heading levels
  - Evidence: HTML-heuristic

### AI Readiness — 48/100

- **[FAIL]** Content Accessibility for AI — Only 33 words visible in HTML — content may be JS-dependent
  - Fix: Your page has very little content in the HTML source. If you're using a JavaScript framework (React, Vue, Angular), implement Server-Side Rendering (SSR) or Static Site Generation (SSG).
  - Evidence: HTML-heuristic
- **[FAIL]** Content Depth for AI — Only 33 words — too thin for AI citation
  - Fix: Your page has critically low content. Add: comprehensive product descriptions, feature lists, FAQs, buying guides, comparison tables, and trust signals (reviews, certifications, guarantees).
  - Evidence: HTML-heuristic
- **[FAIL]** Answer-First Content Format — No meaningful opening content for AI to extract
  - Fix: Add a strong opening paragraph (50-100 words) that summarizes what this page offers. AI assistants use the first paragraph as the primary citation source.
  - Evidence: HTML-heuristic
- **[FAIL]** Heading Hierarchy for AI — 1 H1, 1 H2, 0 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Entity Clarity & Brand Signals
  - Fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Evidence: HTML-heuristic
- **[FAIL]** Canonical Tag for AI Deduplication
  - Fix: Add <link rel='canonical' href='https://your-absolute-url'> to every page. This tells AI engines which URL is the authoritative version of this content.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 0% quality alt text — 0 missing, 5 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** Organization Schema + Entity Linking — Organization schema found but no sameAs links
  - Fix: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.
  - Evidence: schema
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Structured Content (Lists & Tables) — 2 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Freshness Signals — Schema dates found but no visible date on page
  - Fix: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Extractable Answer Blocks — 3 paragraphs, avg 6 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Content-to-Boilerplate Ratio — 32% in main content area — too much boilerplate
  - Fix: Move more content into <main> or <article> elements. Reduce navigation text, footer content, and sidebar noise. AI crawlers extract content from semantic containers and discard the rest.
  - Evidence: HTML-heuristic
- **[WARN]** Social Proof (Testimonials / Case Studies)
  - Fix: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is a leading credibility lever.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** AI agent access (live) — ChatGPT-User and PerplexityBot get the same page as a browser
  - Evidence: file-probe · ChatGPT-User, PerplexityBot: same page as a browser · https://dev.proenergy.sk
- **[PASS]** Structured Data Foundation — 1 JSON-LD blocks with 4 distinct schema types: WebPage, BreadcrumbList, WebSite, BusinessEntity
  - Evidence: schema
- **[PASS]** Breadcrumb Schema — BreadcrumbList structured data found — clear navigation hierarchy
  - Evidence: schema
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Evidence: schema
- **[PASS]** Semantic HTML Structure — 6/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>, <aside>
  - Evidence: HTML-heuristic
- **[PASS]** Knowledge Graph Readiness — 3/4 entity signals — strong Knowledge Graph presence
  - Evidence: HTML-heuristic

### GDPR — 65/100

- **[FAIL]** Privacy Policy Page
  - Fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Legal Contact / Imprint Page
  - Fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Forms Without Privacy Notice — 1 form(s) on page with no privacy policy link
  - Fix: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal of Consent Mechanism
  - Fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Evidence: HTML-heuristic
- **[PASS]** Cookie Consent Banner (CMP) — Cookiebot detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — No tracking scripts detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 1 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic

### Vulnerability — 76/100

- **[FAIL]** Known Vulnerabilities (CVE) — 3 CVEs associated with 1 detected component version
  - Fix: Update WordPress 6.1.1 → 6.7 (CVE-2024-31210, CVE-2023-39999, CVE-2023-2745). Verify each before acting — a host or distro can backport a security patch while the version string still reads as vulnerable, so a detected CVE is not proof your install is affected. CVE details: CVE-2024-31210: https://nvd.nist.gov/vuln/detail/CVE-2024-31210 · CVE-2023-39999: https://nvd.nist.gov/vuln/detail/CVE-2023-39999 · CVE-2023-2745: https://nvd.nist.gov/vuln/detail/CVE-2023-2745
  - Evidence: file-probe · confidence: low
- **[FAIL]** CMS Version Disclosure — "WordPress 6.1.1" exposed in meta generator
  - Fix: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.
  - Evidence: HTML-heuristic
- **[WARN]** CMS Information Files — readme.html accessible — reveals version details
  - Fix: Delete or block access to readme.html. These files reveal your exact CMS version and update history.
  - Evidence: file-probe
- **[WARN]** CMS Version — WordPress 6.1.1 — update available
  - Fix: Update WordPress to the latest version for security patches, performance improvements, and new features.
  - Evidence: file-probe
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[INFO]** SPF Record (Email Security) — No SPF record, and no MX — this domain doesn't send/receive email, so deliverability isn't affected
  - Evidence: DNS · confidence: low
- **[INFO]** DMARC Policy (Email Auth) — No DMARC record, and no MX — this domain doesn't handle email, so deliverability isn't affected
  - Evidence: DNS · confidence: low
- **[INFO]** Email Infrastructure — No MX records — domain does not receive email
  - Evidence: DNS
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** Form CSRF Protection — 1 form(s) — all have CSRF tokens
  - Evidence: HTML-heuristic

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Accessibility — 100/100

- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="sk-SK"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Text — All 7 images have alt attributes
  - Evidence: HTML-heuristic
- **[PASS]** Form Labels — All 2 form inputs are labelled
  - Evidence: HTML-heuristic
- **[PASS]** Heading Structure — Single <h1> with a consistent heading outline
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Evidence: HTML-heuristic
- **[PASS]** Zoom & Scaling — Pinch-zoom is not disabled
  - Evidence: HTML-heuristic
- **[PASS]** Skip Link — A skip-to-content link is present
  - Evidence: HTML-heuristic · confidence: low

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/de/r/dev.proenergy.sk)