# kelo.sk — Zulien Score 64/100 (Grade C)

> Free e-commerce audit: 64/100 overall score. Platform: WooCommerce (WP 7.0.2). Company: jachta.sk s.r.o.. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://kelo.sk/
- **Platform:** WooCommerce (WP 7.0.2)
- **Company:** jachta.sk s.r.o.
- **Scan date:** 2026-08-03
- **Full report:** https://score.zulien.sk/de/r/kelo.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/kelo.sk

## Audit summary

Your store works but has significant room for improvement. Start by adding meta descriptions and H1 headings to all product pages—they're essential for search engines and customers. Your security foundation is solid and your server setup is functional.

## Score by category

| Category | Score |
|---|---|
| Performance | 71/100 |
| SEO | 64/100 |
| Security | 59/100 |
| Mobile | 67/100 |
| AI Readiness | 49/100 |
| GDPR | 60/100 |
| Vulnerability | 70/100 |

## Detailed findings

### Performance — 71/100

- **[FAIL]** Total Page Weight — 4.7 MB, 80 requests — too heavy!
  - Fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Evidence: PSI-lab
- **[FAIL]** JavaScript Budget — 1414 KB — more than double the 600 KB budget
  - Fix: Audit what ships on a product page: split the bundle by route, defer every third-party tag until interaction or consent, and remove plugins whose bundle you cannot account for. Measure again after each removal.
  - Evidence: PSI-lab · 1414 KB JavaScript · confidence: high
- **[FAIL]** Unused Code (CSS + JS) — 897 KB wasted on unused code!
  - Fix: You're loading 897 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[FAIL]** Script Loading Strategy — Only 24% of 37 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
  - Evidence: HTML-heuristic
- **[FAIL]** CSS File Count — 19 CSS files — too many!
  - Fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Evidence: HTML-heuristic
- **[WARN]** Total Blocking Time (TBT) — 370ms (good: <200ms)
  - Fix: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.
  - Evidence: PSI-lab
- **[WARN]** Resource Hints (Preload/Preconnect)
  - Fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
  - Evidence: HTML-heuristic
- **[WARN]** Font Loading Strategy — Google Fonts detected without font-display
  - Fix: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.
  - Evidence: HTML-heuristic
- **[WARN]** Cache-Control Strategy — max-age=0, no-cache, no-store, must-revalidate
  - Fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
  - Evidence: HTTP-header
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 19 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 47ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.79s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 1.80s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.013 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 1.65s
  - Evidence: PSI-lab
- **[PASS]** Request Budget — 80 requests — within the budget of 80
  - Evidence: PSI-lab · 80 requests · confidence: high
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Lazy Loading — 48% of images use native lazy loading (14/29)
  - Evidence: HTML-heuristic
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header

### SEO — 64/100

- **[FAIL]** Meta Description
  - Fix: Write a compelling meta description (120-160 chars) with a call-to-action. Include your target keyword naturally.
  - Evidence: HTML-heuristic
- **[FAIL]** H1 Heading
  - Fix: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
  - Evidence: HTML-heuristic
- **[FAIL]** Open Graph Tags
  - Fix: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
  - Evidence: HTML-heuristic
- **[FAIL]** Structured Data (JSON-LD)
  - Fix: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
  - Evidence: schema
- **[WARN]** Meta Title — 7 chars (optimal: 30-60)
  - Fix: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.
  - Evidence: HTML-heuristic
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — Only 14% next-gen formats — 10 legacy images remain
  - Fix: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.
  - Evidence: HTML-heuristic
- **[WARN]** Empty/Dead Links — 9 dead links (1 empty, 8 hash-only, 0 javascript:void)
  - Fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Evidence: HTML-heuristic
- **[WARN]** Product Schema Richness — Missing recommended: brand, aggregateRating, review, gtin
  - Fix: Add brand, aggregateRating, review, gtin to your Product schema. These fields enable rich snippets with star ratings, price, availability, and brand in search results.
  - Evidence: schema · https://kelo.sk/produkt/damsky-unisuit-x-tmavozeleny · confidence: medium
- **[WARN]** Excessive Resource Requests — 37 JS + 19 CSS = 56 external requests
  - Fix: Reduce to under 50 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 2% ratio but 665 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 10 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://kelo.sk/
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with ~7+ URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 100% of 29 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — max-image-preview:large
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <article>, <header>, <footer>, <aside>
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth — 665 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 10, H3: 17 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 19 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 54 ARIA roles, 18 ARIA labels, lang="sk-SK"
  - Evidence: HTML-heuristic

### Security — 59/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Evidence: HTTP-header
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
  - Evidence: DNS
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** Cookie Security Flags — No cookies set on initial response
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: openresty (no version)
  - Evidence: HTTP-header
- **[PASS]** Subresource Integrity (SRI) — All cross-origin scripts are auto-updating provider scripts where SRI does not apply
  - Evidence: HTML-heuristic
- **[PASS]** Server Version Disclosure — openresty — version hidden
  - Evidence: HTTP-header

### Mobile — 67/100

- **[WARN]** Mobile Performance Score — 61/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[WARN]** PWA Features
  - Fix: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Navigation (Semantic)
  - Fix: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').
  - Evidence: HTML-heuristic
- **[WARN]** Apple Mobile Web App — Missing: apple-mobile-web-app-capable, status-bar-style
  - Fix: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Sticky CTA — Add-to-cart button found but no sticky/fixed positioning detected
  - Fix: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.
  - Evidence: HTML-heuristic
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Evidence: HTML-heuristic
- **[WARN]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h2→h4, h2→h5
  - Fix: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
  - Evidence: HTML-heuristic
- **[INFO]** Payment Methods Detected — Žiadna známa platobná brána nedetekovaná na homepage
  - Evidence: HTML-heuristic
- **[INFO]** Express Checkout (Apple Pay + Google Pay) — Apple Pay / Google Pay nedetekované na homepage — express checkout sa zvyčajne zobrazí až v košíku/checkoute
  - Evidence: HTML-heuristic
- **[INFO]** SK/CZ Local Payment Methods — Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Images (srcset) — 26 image(s) use srcset for responsive sizing
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Types — Optimized: 4 search
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Labels (WCAG 3.3.2) — 4/4 inputs majú label
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Evidence: HTML-heuristic

### AI Readiness — 49/100

- **[FAIL]** Structured Data Foundation
  - Fix: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
  - Evidence: schema
- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Heading Hierarchy for AI — 0 H1, 10 H2, 17 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Entity Clarity & Brand Signals
  - Fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Evidence: HTML-heuristic
- **[FAIL]** Common Question Coverage — Answers only 1/5 key shopper questions: shipping
  - Fix: Your page barely addresses core shopper questions. Add sections covering price, shipping (options + cost), returns/refunds, availability, and payment methods — as visible text, not just in schema. Link to a dedicated FAQ, Shipping, and Returns page.
  - Evidence: HTML-heuristic
- **[FAIL]** Knowledge Graph Readiness
  - Fix: Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 0% quality alt text — 0 missing, 2 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[FAIL]** Content-to-Boilerplate Ratio — Only 20% in main content — mostly boilerplate
  - Fix: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
  - Evidence: HTML-heuristic
- **[WARN]** Product Schema Completeness — 71% complete — missing: brand, aggregateRating, itemCondition, gtin/mpn (sampled product page: https://kelo.sk/produkt/damsky-unisuit-x-tmavozeleny)
  - Fix: Add missing Product schema fields: brand, aggregateRating, itemCondition, gtin/mpn. Each field improves how AI presents your products. Especially add aggregateRating, since products with ratings show more prominently in AI shopping results.
  - Evidence: schema · https://kelo.sk/produkt/damsky-unisuit-x-tmavozeleny · confidence: medium
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Breadcrumb Schema
  - Fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
  - Evidence: schema
- **[WARN]** Site Search Schema (SearchAction)
  - Fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
  - Evidence: schema
- **[WARN]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Product Feed (AI Commerce)
  - Fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
  - Evidence: file-probe · probed /feed/products.xml, /google-shopping.xml, /export/google-shopping.xml — none returned a product feed
- **[WARN]** Heureka XML Feed
  - Fix: Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).
  - Evidence: file-probe
- **[WARN]** Extractable Answer Blocks — 3 paragraphs, avg 6 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 101 words — only 0% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Return Policy Schema
  - Fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
  - Evidence: schema
- **[WARN]** Shipping Details Schema
  - Fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
  - Evidence: schema
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Trust Widget — Žiaden trust widget (Heureka / Trustpilot / AggregateRating) nedetekovaný
  - Fix: Pre SK/CZ shopy: inštaluj Heureka Ověřeno zákazníky widget (zadarmo pre overených predajcov — https://sluzby.heureka.sk). Alternatívne: Trustpilot, Google Reviews s AggregateRating schema. Trust widget na product + kategória + footer.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** Variant Modelling (ProductGroup) — Variant selectors visible on the page — check whether variants are modelled as a ProductGroup
  - Evidence: schema · https://kelo.sk/produkt/damsky-unisuit-x-tmavozeleny · confidence: medium
- **[INFO]** Reviews & Ratings Schema — No review schema on this homepage — review/rating schema typically lives on product pages
  - Evidence: schema
- **[INFO]** AI Plugin Manifest — Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
  - Evidence: file-probe
- **[INFO]** GTIN/EAN Coverage — No product feed was sampled — GTIN/EAN coverage could not be verified
  - Evidence: HTML-heuristic
- **[INFO]** Speakable Content (Voice AI) — Not present — optional; SpeakableSpecification has limited assistant adoption
  - Evidence: HTML-heuristic
- **[INFO]** Delivery Promise — No delivery timing was found in the text of the sampled product page
  - Evidence: HTML-heuristic · https://kelo.sk/produkt/damsky-unisuit-x-tmavozeleny · confidence: low
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[INFO]** Agent-Commerce Readiness — 54/100 — čiastočne pripravené (Prístup 100 · Porozumenie 17 · Objaviteľnosť 50 · Transakcia 50)
- **[INFO]** Agent: Prístup — dostane sa agent dnu — 100/100 (2 signály/-ov)
- **[INFO]** Agent: Porozumenie — rozumie produktom — 17/100 (3 signály/-ov)
- **[INFO]** Agent: Objaviteľnosť — nájde celý katalóg — 50/100 (3 signály/-ov)
- **[INFO]** Agent: Transakcia — vie konať (kôš/podmienky) — 50/100 (3 signály/-ov)
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 665 words in raw HTML (2.2% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth for AI — 665 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <article>, <header>, <footer>, <aside>
  - Evidence: HTML-heuristic
- **[PASS]** Structured Content (Lists & Tables) — 10 lists + 10 tables — AI-friendly structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 29 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Canonical Tag for AI Deduplication — Self-referencing canonical — clean signal for AI
  - Evidence: HTML-heuristic
- **[PASS]** Content Readability for AI — Flesch-Kincaid Grade 8 — appropriate for technical/B2B audience
  - Evidence: HTML-heuristic

### GDPR — 60/100

- **[FAIL]** Cookie Consent Banner (CMP)
  - Fix: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
  - Evidence: HTML-heuristic
- **[FAIL]** Consumer Dispute Resolution Links — No EU ODR platform or supervisory-authority link found
  - Fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Data Encryption (No Mixed Content)
  - Fix: Replace all http:// resource URLs with https://. Check images, scripts, stylesheets, and iframes. GDPR Article 32 requires 'appropriate technical measures' including encryption.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal of Consent Mechanism
  - Fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal & Complaints Policy — Missing: right of withdrawal (odstúpenie od zmluvy)
  - Fix: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Online Withdrawal Function — No online withdrawal function or withdrawal information detected
  - Fix: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** GPSR Manufacturer Info — No manufacturer/importer identification found on the sampled product page
  - Fix: On every product page state the manufacturer's name, postal address and an electronic contact (email or web form). For goods made outside the EU, also name the EU importer. Structured `manufacturer` in Product schema satisfies this cleanly and is machine-readable.
  - Evidence: HTML-heuristic · https://kelo.sk/produkt/damsky-unisuit-x-tmavozeleny · confidence: low
- **[PASS]** Tracking Scripts & Consent — No tracking scripts detected
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — https://kelo.sk/zasady-osobnych-udajov-a-cookies
  - Evidence: HTML-heuristic
- **[PASS]** Cookie Policy — Separate cookie policy detected
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — https://kelo.sk/o-nas
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 1 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic

### Vulnerability — 70/100

- **[FAIL]** CMS Version Disclosure — "WordPress 7.0.2" exposed in meta generator
  - Fix: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.
  - Evidence: HTML-heuristic
- **[FAIL]** Form CSRF Protection — 4 form(s) without CSRF tokens
  - Fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Evidence: HTML-heuristic · confidence: low
- **[FAIL]** Suspicious Inline Script Patterns — Detected: Dynamic script injection
  - Fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
  - Evidence: file-probe
- **[WARN]** CMS Information Files — readme.html accessible — reveals version details
  - Fix: Delete or block access to readme.html. These files reveal your exact CMS version and update history.
  - Evidence: file-probe
- **[WARN]** Open Redirect Detection — URL redirect parameter found in page links
  - Fix: Validate all redirect URLs server-side against a whitelist. Never allow user-controlled redirect targets without validation.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** WordPress User Enumeration — /wp-json/wp/v2/users exposes user accounts
  - Fix: Restrict the REST API users endpoint. Add to functions.php: add_filter('rest_endpoints', function($endpoints) { unset($endpoints['/wp/v2/users']); return $endpoints; }); Or use a security plugin.
  - Evidence: file-probe
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[WARN]** Mixed Content Resources — 1 HTTP resource(s) on HTTPS page
  - Fix: Replace HTTP URLs with HTTPS: http://gmpg.org/xfn/11
  - Evidence: file-probe
- **[INFO]** BIMI Brand Indicators
  - Evidence: file-probe
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 a mx include:_spf.m1.websupport.sk -all
  - Evidence: DNS
- **[PASS]** DMARC Policy (Email Auth) — DMARC enforced: p=quarantine
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: selector1, selector2, mail)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).

### Accessibility

- **[INFO]** EAA Scope — Not legally required yet — the European Accessibility Act (SK 351/2022 Z. z. § 2 ods. 3, CZ 424/2023 Sb., Dir. 2019/882) exempts micro-enterprises (< 10 staff & ≤ €2M). Your registry data indicates a micro-enterprise, so accessibility is optional for now — but it still lifts SEO, conversions, and reaches the ~15% of shoppers with a disability.

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/de/r/kelo.sk)
