# imitrade.cz — Zulien Score 73/100 (Grade B)

> Free e-commerce audit: 73/100 overall score. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://imitrade.cz
- **Scan date:** 2026-10-08
- **Full report:** https://score.zulien.sk/de/r/imitrade.cz
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/imitrade.cz

## Audit summary

Your site performs adequately but needs improvements in security and AI readability. Prioritize adding HSTS security protocol to protect customer data. Strong work on accessibility for visually impaired users.

## Score by category

| Category | Score |
|---|---|
| Performance | 94/100 |
| SEO | 75/100 |
| Security | 57/100 |
| Mobile | 64/100 |
| AI Readiness | 45/100 |
| GDPR | 61/100 |
| Vulnerability | 57/100 |
| Accessibility | 100/100 |

## Detailed findings

### Performance — 94/100

- **[FAIL]** Unused Code (CSS + JS) — 315 KB wasted on unused code!
  - Fix: You're loading 315 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[WARN]** Lazy Loading — 5 images without lazy loading
  - Fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
  - Evidence: HTML-heuristic
- **[WARN]** Cache-Control Strategy — no-store, no-cache, must-revalidate, no-cache, private
  - Fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
  - Evidence: HTTP-header
- **[WARN]** Script Loading Strategy — Only 50% of 6 scripts use async/defer
  - Fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
  - Evidence: HTML-heuristic
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 5ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.81s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 1.00s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 8ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.003 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 0.81s
  - Evidence: PSI-lab
- **[PASS]** Total Page Weight — 739 KB (22 requests)
  - Evidence: PSI-lab
- **[PASS]** JavaScript Budget — 533 KB — within the 600 KB budget
  - Evidence: PSI-lab · 533 KB JavaScript · confidence: high
- **[PASS]** Request Budget — 22 requests — within the budget of 80
  - Evidence: PSI-lab · 22 requests · confidence: high
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 1 preload, 1 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header
- **[PASS]** CSS File Count — 3 CSS file(s) — well consolidated
  - Evidence: HTML-heuristic

### SEO — 75/100

- **[FAIL]** Structured Data (JSON-LD)
  - Fix: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
  - Evidence: schema
- **[FAIL]** Text-to-HTML Ratio — 3% — very thin content (190 words)
  - Fix: Your page is almost entirely HTML/CSS/JS with very little actual content. Add substantial product descriptions, content blocks, and informational text.
  - Evidence: HTML-heuristic
- **[FAIL]** Internal Linking — Only 2 internal link(s) — orphaned page
  - Fix: This page has very few internal links. Add links to related products, categories, guides, and your main navigation. Orphaned pages rank poorly.
  - Evidence: HTML-heuristic
- **[WARN]** Meta Title — 66 chars (optimal: 30-60)
  - Fix: Shorten your title to under 60 characters. Google truncates longer titles with '…', which cuts off your message.
  - Evidence: HTML-heuristic
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — 0% next-gen formats — 4 JPEG, 0 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL Consistency — Canonical points to different URL: https://www.imitrade.cz/
  - Fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Evidence: HTML-heuristic
- **[WARN]** Content Depth — Only 190 words — thin content
  - Fix: Add more unique, valuable content. Product pages should have 150+ word descriptions. Category pages benefit from 200+ word introductions. Blog posts need 800+ words to rank.
  - Evidence: HTML-heuristic
- **[PASS]** Meta Description — 145 chars
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "SLAVÍME 33 LET NA TRHU - JSME VÝROBCI - NE PŘEKUPNÍCI!"
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 6 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://www.imitrade.cz/
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with 63 URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="cs"
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 100% of 5 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — index,follow
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Semantic HTML Structure — 5/6 semantic elements: <nav>, <main>, <header>, <footer>, <aside>
  - Evidence: HTML-heuristic
- **[PASS]** Empty/Dead Links — 2 minor dead link(s) — acceptable
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 4/4 a11y signals: 46 ARIA roles, 4 ARIA labels, skip link, lang="cs"
  - Evidence: HTML-heuristic

### Security — 57/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** HTTP → HTTPS Redirect
  - Fix: Configure a 301 redirect from http:// to https:// for all pages. In Apache: RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Cookie Security Flags — 3 cookie(s): 2 missing HttpOnly, 2 missing SameSite
  - Fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Evidence: HTTP-header
- **[WARN]** Subresource Integrity (SRI) — Only 0/4 SRI-eligible third-party scripts have integrity hashes (2 auto-updating provider script(s) excluded — SRI not applicable)
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Evidence: HTML-heuristic
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[INFO]** Cookie Prefix Security — 1 session cookie(s) already have Secure + HttpOnly + SameSite; adding the __Host- prefix is a cosmetic hardening nicety
  - Evidence: HTTP-header · 1 session cookie(s), all with Secure+HttpOnly+SameSite · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN, SAMEORIGIN
  - Evidence: HTTP-header
- **[PASS]** X-Content-Type-Options — nosniff
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: openresty (no version)
  - Evidence: HTTP-header
- **[PASS]** security.txt (RFC 9116) — Present at /.well-known/security.txt
  - Evidence: file-probe
- **[PASS]** Server Version Disclosure — openresty — version hidden
  - Evidence: HTTP-header
- **[PASS]** Password Field Security — 1 password field(s) — allow password manager autofill
  - Evidence: HTTP-header

### Mobile — 64/100

- **[WARN]** Mobile Performance Score — 59/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Desktop/Mobile Performance Gap — Desktop: 98 vs Mobile: 59 (39 point gap)
  - Fix: Your desktop experience is significantly better than mobile. Focus on: reducing JavaScript (mobile CPUs are slower), serving responsive images (smaller files for smaller screens), and minimizing main-thread work.
  - Evidence: HTML-heuristic
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[WARN]** Responsive Design Techniques
  - Fix: Implement responsive CSS with @media queries for key breakpoints: 480px (small mobile), 768px (tablet), 1024px (laptop). Use Flexbox and CSS Grid for fluid layouts.
  - Evidence: HTML-heuristic
- **[WARN]** PWA Features
  - Fix: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Responsive Images (srcset) — 5 images without responsive sizing
  - Fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Sticky CTA — Add-to-cart button found but no sticky/fixed positioning detected
  - Fix: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.
  - Evidence: HTML-heuristic
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Evidence: HTML-heuristic
- **[INFO]** Payment Methods Detected — No known payment gateway detected on the homepage
  - Evidence: HTML-heuristic
- **[INFO]** Express Checkout (Apple Pay + Google Pay) — Apple Pay / Google Pay not detected on the homepage — express checkout usually appears only in the cart or checkout
  - Evidence: HTML-heuristic
- **[INFO]** SK/CZ Local Payment Methods — No SK/CZ local payment method detected on the homepage — bank buttons and QR payment usually appear only in checkout
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Types — Optimized: 1 email, 1 search
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Labels (WCAG 3.3.2) — 4/4 inputs have a label
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy (WCAG 1.3.1) — No skipped heading levels
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — All links have descriptive text
  - Evidence: HTML-heuristic

### AI Readiness — 45/100

- **[FAIL]** Content Accessibility for AI — Only 190 words visible in HTML — content may be JS-dependent
  - Fix: Your page has very little content in the HTML source. If you're using a JavaScript framework (React, Vue, Angular), implement Server-Side Rendering (SSR) or Static Site Generation (SSG).
  - Evidence: HTML-heuristic
- **[FAIL]** Structured Data Foundation
  - Fix: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
  - Evidence: schema
- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Content Depth for AI — Only 190 words — too thin for AI citation
  - Fix: Your page has critically low content. Add: comprehensive product descriptions, feature lists, FAQs, buying guides, comparison tables, and trust signals (reviews, certifications, guarantees).
  - Evidence: HTML-heuristic
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Entity Clarity & Brand Signals
  - Fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Evidence: HTML-heuristic
- **[FAIL]** Common Question Coverage — Answers only 0/5 key shopper questions
  - Fix: Your page barely addresses core shopper questions. Add sections covering price, shipping (options + cost), returns/refunds, availability, and payment methods — as visible text, not just in schema. Link to a dedicated FAQ, Shipping, and Returns page.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 0% quality alt text — 0 missing, 5 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[FAIL]** Content-to-Boilerplate Ratio — Only 17% in main content — mostly boilerplate
  - Fix: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
  - Evidence: HTML-heuristic
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Breadcrumb Schema
  - Fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
  - Evidence: schema
- **[WARN]** Site Search Schema (SearchAction)
  - Fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
  - Evidence: schema
- **[WARN]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — 3 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Product Feed (AI Commerce)
  - Fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
  - Evidence: file-probe · probed /feed/products.xml, /google-shopping.xml, /export/google-shopping.xml — none returned a product feed
- **[WARN]** Heureka XML Feed
  - Fix: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).
  - Evidence: file-probe
- **[WARN]** Zbozi.cz XML Feed
  - Fix: Generate a Zbozi.cz XML feed at /feed/zbozi.xml (or /export/zbozi.xml). Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/DESCRIPTION/URL/PRICE_VAT/DELIVERY_DATE/CATEGORYTEXT/IMGURL (required, stricter than Heureka) + EAN/PRODUCT/MANUFACTURER (for master-catalog matching).
  - Evidence: HTML-heuristic
- **[WARN]** Extractable Answer Blocks — 2 paragraphs, avg 14 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 176 words — only 0% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings — 1 question heading(s) — add more
  - Fix: Phrase H2/H3 headings as questions: 'How does...?', 'What is...?', 'Why should...?' followed by a direct 1-2 sentence answer. This is a leading format AI assistants use to generate responses.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.imitrade.cz/
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Evidence: HTML-heuristic
- **[WARN]** Return Policy Schema
  - Fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
  - Evidence: schema
- **[WARN]** Shipping Details Schema
  - Fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
  - Evidence: schema
- **[WARN]** Knowledge Graph Readiness — 1/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema
  - Fix: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 20 — too complex for broad AI citation
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Trust Widget — No trust widget (Heureka / Trustpilot / AggregateRating) detected
  - Fix: For SK/CZ shops: install the Heureka Ověřeno zákazníky widget (free for verified sellers — https://sluzby.heureka.sk). Alternatives: Trustpilot, Google Reviews with AggregateRating schema. Place the trust widget on product + category + footer.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** Product Schema Completeness — No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit
  - Evidence: schema
- **[INFO]** Search Typo Handling (measurement) — A correctly spelled query and the same query with a typo return similarly sized pages (41547 B vs 41547 B) — consistent with typo tolerance
  - Evidence: HTML-heuristic · 41547 B response · https://imitrade.cz/action/ProductSearch/prepareString/?string=xyzqwerty-nezmysel · confidence: low
- **[INFO]** Reviews & Ratings Schema — No review schema on this homepage — review/rating schema typically lives on product pages
  - Evidence: schema
- **[INFO]** AI Plugin Manifest — Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
  - Evidence: file-probe
- **[INFO]** GTIN/EAN Coverage — No product feed was sampled — GTIN/EAN coverage could not be verified
  - Evidence: HTML-heuristic
- **[INFO]** Speakable Content (Voice AI) — Not present — optional; SpeakableSpecification has limited assistant adoption
  - Evidence: HTML-heuristic
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[INFO]** Agent-Commerce Readiness — 38/100 — not reachable for AI agents (Access 50 · Understand 0 · Discover 50 · Transact 50)
- **[INFO]** Agent: Access — can an agent get in — 50/100 (2 signals)
- **[INFO]** Agent: Understand — can it read the products — 0/100 (2 signals)
- **[INFO]** Agent: Discover — can it find the whole catalogue — 50/100 (4 signals)
- **[INFO]** Agent: Transact — can it act (cart, terms) — 50/100 (3 signals)
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** AI agent access (live) — ChatGPT-User and PerplexityBot get the same page as a browser
  - Evidence: file-probe · ChatGPT-User, PerplexityBot: same page as a browser · https://imitrade.cz
- **[PASS]** Zero-results Recovery — A search with no matches still offers products, suggestions or a way to get help
  - Evidence: HTML-heuristic · 41547 B response · https://imitrade.cz/action/ProductSearch/prepareString/?string=xyzqwerty-nezmysel · confidence: low
- **[PASS]** Heading Hierarchy for AI — Proper structure: 1 H1 → 6 H2s → 1 H3s — clear content outline
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 5/6 semantic elements: <nav>, <main>, <header>, <footer>, <aside>
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 11 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic

### GDPR — 61/100

- **[FAIL]** Privacy Policy Page
  - Fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).
  - Evidence: HTML-heuristic
- **[FAIL]** Consumer Dispute Resolution Links — No EU ODR platform or supervisory-authority link found
  - Fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Legal Contact / Imprint Page
  - Fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Forms Without Privacy Notice — 2 form(s) on page with no privacy policy link
  - Fix: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal of Consent Mechanism
  - Fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal & Complaints Policy — Missing: right of withdrawal (odstúpenie od zmluvy), complaints procedure (reklamačný poriadok)
  - Fix: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Online Withdrawal Function — No online withdrawal function or withdrawal information detected
  - Fix: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** Legal guarantee notice — No harmonised notice on the legal guarantee was found on the pages we scanned — it may be on a page this scan does not open. Verify it is shown.
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Cookie Consent Banner (CMP) — Cookiebot detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — 1 tracker(s) detected with CMP: Google Analytics/GTM
  - Evidence: HTML-heuristic
- **[PASS]** Google Consent Mode v2 — Consent mode signals detected (ad_storage, analytics_storage)
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 3 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic

### Vulnerability — 57/100

- **[FAIL]** Known Vulnerabilities (CVE) — 5 CVEs associated with 1 detected component version
  - Fix: Update jQuery 1.11.3 → 3.7.1 (CVE-2011-4969, CVE-2012-6708, CVE-2015-9251, CVE-2020-11022, CVE-2020-11023). Verify each before acting — a host or distro can backport a security patch while the version string still reads as vulnerable, so a detected CVE is not proof your install is affected. CVE details: CVE-2011-4969: https://nvd.nist.gov/vuln/detail/CVE-2011-4969 · CVE-2012-6708: https://nvd.nist.gov/vuln/detail/CVE-2012-6708 · CVE-2015-9251: https://nvd.nist.gov/vuln/detail/CVE-2015-9251 · CVE-2020-11022: https://nvd.nist.gov/vuln/detail/CVE-2020-11022 · CVE-2020-11023: https://nvd.nist.gov/vuln/detail/CVE-2020-11023
  - Evidence: file-probe · confidence: low
- **[FAIL]** Admin Panel at Default URL — Accessible at: /admin
  - Fix: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).
  - Evidence: file-probe
- **[FAIL]** jQuery Version — jQuery 1.11.3 — critically outdated!
  - Fix: jQuery 1.11.3 is associated with multiple known security vulnerabilities. Upgrade to 3.7.x. If your plugins require jQuery 1.x/2.x, use jquery-migrate as a temporary bridge.
  - Evidence: file-probe · confidence: low
- **[FAIL]** DMARC Policy (Email Auth)
  - Fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
  - Evidence: DNS
- **[FAIL]** Payment Page Security — Payment page missing: No HSTS, No CSP
  - Fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Evidence: file-probe
- **[WARN]** Form CSRF Protection — 1/2 forms have CSRF tokens
  - Fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** DKIM Signing (Email Auth)
  - Fix: Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.
  - Evidence: file-probe
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[WARN]** Login Form Security — Login form blocks password manager autofill
  - Fix: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
  - Evidence: file-probe
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 include:_spf.myshoptet.com ~all
  - Evidence: DNS

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Accessibility — 100/100

- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="cs"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Text — All 5 images have alt attributes
  - Evidence: HTML-heuristic
- **[PASS]** Form Labels — All 4 form inputs are labelled
  - Evidence: HTML-heuristic
- **[PASS]** Heading Structure — Single <h1> with a consistent heading outline
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Evidence: HTML-heuristic
- **[PASS]** Zoom & Scaling — Pinch-zoom is not disabled
  - Evidence: HTML-heuristic
- **[PASS]** Skip Link — A skip-to-content link is present
  - Evidence: HTML-heuristic · confidence: low

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/de/r/imitrade.cz)