# liveagent.sk — Zulien Score 78/100 (Grade B)

> Free e-commerce audit: 78/100 overall score. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://www.liveagent.sk
- **Scan date:** 2026-10-07
- **Full report:** https://score.zulien.sk/de/r/liveagent.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/liveagent.sk

## Audit summary

Your site performs well overall, but needs refinement in key areas. Priority: add meta descriptions to pages for better search visibility. Strength: your security standards are excellent.

## Score by category

| Category | Score |
|---|---|
| Performance | 91/100 |
| SEO | 85/100 |
| Security | 84/100 |
| Mobile | 62/100 |
| AI Readiness | 71/100 |
| GDPR | 70/100 |
| Vulnerability | 90/100 |
| Accessibility | 41/100 |

## Detailed findings

### Performance — 91/100

- **[FAIL]** Unused Code (CSS + JS) — 285 KB wasted on unused code!
  - Fix: You're loading 285 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[WARN]** Total Page Weight — 2.0 MB, 105 requests (optimal: <1.5 MB, <50 req)
  - Fix: Reduce page weight: compress images to WebP (saves 30-50%), enable text compression (gzip/brotli), lazy load below-fold images, remove unused CSS/JS.
  - Evidence: PSI-lab
- **[WARN]** JavaScript Budget — 1014 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked
  - Fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
  - Evidence: PSI-lab · 1014 KB JavaScript · confidence: high
- **[WARN]** Request Budget — 105 requests — over the budget of 80, but at or below the median of the award-winning shops we benchmarked (140)
  - Fix: Bundle CSS/JS that always loads together, serve icons as a sprite or font rather than individual files, and lazy-load below-fold images so they aren't requested on load.
  - Evidence: PSI-lab · 105 requests · confidence: high
- **[WARN]** Resource Hints (Preload/Preconnect)
  - Fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
  - Evidence: HTML-heuristic
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 8ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.30s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 0.98s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 168ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.000 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 1.29s
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Lazy Loading — 53% of images use native lazy loading (109/207)
  - Evidence: HTML-heuristic
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header
- **[PASS]** Script Loading Strategy — 100% of scripts use async/defer/module (0 async, 13 defer, 0 module)
  - Evidence: HTML-heuristic
- **[PASS]** CSS File Count — 6 CSS file(s) — well consolidated
  - Evidence: HTML-heuristic

### SEO — 85/100

- **[FAIL]** Meta Description
  - Fix: Write a compelling meta description (120-160 chars) with a call-to-action. Include your target keyword naturally.
  - Evidence: HTML-heuristic
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL — og:url present (https://www.liveagent.sk/) but <link rel=canonical> missing
  - Fix: Add <link rel='canonical' href='https://www.liveagent.sk/'> to <head>. og:url covers social sharing; canonical covers Google + AI crawlers explicitly.
  - Evidence: HTML-heuristic
- **[WARN]** HTML Language Attribute
  - Fix: Add lang attribute to your <html> tag, e.g., <html lang='en'> or <html lang='de'>.
  - Evidence: HTML-heuristic
- **[WARN]** Accessibility Fundamentals — 2/4 a11y signals — missing: skip navigation link, lang attribute
  - Fix: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 4% ratio but 1876 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 40 chars — "LiveAgent - Helpdesk Softvér a Live Chat"
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "Poskytujte bezproblémovú podporu s AI helpdeskom"
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 9 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Image Format — image/jpeg
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 1 block(s): Review, Person, SoftwareApplication
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 1 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with 1347 URLs
  - Evidence: file-probe
- **[PASS]** Image Alt Attributes — 99% of 207 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Image Format Optimization — 74% next-gen formats (88 WebP, 0 AVIF)
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth — 1876 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 9, H3: 32 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 29 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 14 day(s) ago
  - Evidence: HTML-heuristic

### Security — 84/100

- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Technology Disclosure — Server: AmazonS3
  - Fix: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Evidence: HTTP-header
- **[WARN]** Subresource Integrity (SRI) — Only 0/3 SRI-eligible third-party scripts have integrity hashes
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Evidence: HTML-heuristic
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[WARN]** Iframe Sandboxing — 1/1 unknown iframe(s) without sandbox attribute
  - Fix: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** CAA DNS Record — 2 CAA records (issuers: amazon.com, letsencrypt.org)
  - Evidence: DNS
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** HSTS (Strict-Transport-Security) — max-age=31536000, preload, includeSubDomains
  - Evidence: HTTP-header
- **[PASS]** Content-Security-Policy (CSP) — Present and reasonably configured
  - Evidence: HTTP-header
- **[PASS]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN
  - Evidence: HTTP-header
- **[PASS]** X-Content-Type-Options — nosniff
  - Evidence: HTTP-header
- **[PASS]** Cookie Security Flags — No cookies set on initial response
  - Evidence: HTTP-header
- **[PASS]** Server Version Disclosure — AmazonS3 — version hidden
  - Evidence: HTTP-header

### Mobile — 62/100

- **[FAIL]** Viewport Configuration
  - Fix: Add <meta name='viewport' content='width=device-width, initial-scale=1'> to your <head>. This is the absolute minimum for mobile compatibility.
  - Evidence: HTML-heuristic
- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Only 0/8 inputs have a label (0%)
  - Fix: 8 input elements have no label. Every input needs a matching <label for="id">Text</label> or an aria-label. A placeholder is NOT a label (WCAG 3.3.2). On a checkout or registration form this costs conversion and breaches EN 301 549 (EAA 2026).
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Performance Score — 68/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[WARN]** Responsive Design Techniques
  - Fix: Implement responsive CSS with @media queries for key breakpoints: 480px (small mobile), 768px (tablet), 1024px (laptop). Use Flexbox and CSS Grid for fluid layouts.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Form Input Types — email fields use type='text' instead of type='email'
  - Fix: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
  - Evidence: HTML-heuristic
- **[WARN]** Link Text Quality (WCAG 2.4.4) — 1 links have generic text ("click here", "more", "here"...)
  - Fix: Replace 'Click here' and 'Read more' with descriptive text: 'Read more about GDPR', 'See module pricing'. Screen readers read links out of context, so a bare 'more' carries no meaning.
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Images (srcset) — 182 image(s) use srcset for responsive sizing
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy (WCAG 1.3.1) — No skipped heading levels
  - Evidence: HTML-heuristic

### AI Readiness — 71/100

- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Canonical Tag for AI Deduplication
  - Fix: Add <link rel='canonical' href='https://your-absolute-url'> to every page. This tells AI engines which URL is the authoritative version of this content.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Data Foundation — Only 1 distinct schema type (Review) — insufficient for AI visibility
  - Fix: One schema type is not enough. Add at minimum: Organization (identity), Product (commerce), BreadcrumbList (navigation), WebSite+SearchAction (discoverability), FAQPage (Q&A answering).
  - Evidence: schema
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Structured Content (Lists & Tables) — 21 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Freshness Signals — Visible date found but not in structured data
  - Fix: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
  - Evidence: HTML-heuristic
- **[WARN]** Entity Clarity & Brand Signals — OG tags complete but no sameAs entity links
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Extractable Answer Blocks — 89 paragraphs, avg 24 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 69 words — only 7% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings — 2 question heading(s) — add more
  - Fix: Phrase H2/H3 headings as questions: 'How does...?', 'What is...?', 'Why should...?' followed by a direct 1-2 sentence answer. This is a leading format AI assistants use to generate responses.
  - Evidence: HTML-heuristic
- **[WARN]** Knowledge Graph Readiness — 2/4 signals — missing: sameAs links (Wikipedia, LinkedIn), Organization schema
  - Fix: Add: sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 20 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Image Alt Text Quality for AI — 76% good, 20 poor, 3 missing
  - Fix: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** AI agent access (live) — ChatGPT-User and PerplexityBot get the same page as a browser
  - Evidence: file-probe · ChatGPT-User, PerplexityBot: same page as a browser · https://www.liveagent.sk
- **[PASS]** Content Accessibility for AI — 1876 words in raw HTML (3.9% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth for AI — 1876 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 45 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy for AI — Proper structure: 1 H1 → 9 H2s → 32 H3s — clear content outline
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Reviews & Ratings Schema — AggregateRating/Review data found — social proof for AI
  - Evidence: schema
- **[PASS]** Statistics & Data Presence — 13 data points found — strong citation magnet
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 15 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Content-to-Boilerplate Ratio — 68% of text in <main>/<article> — clean content signal
  - Evidence: HTML-heuristic
- **[PASS]** Social Proof (Testimonials / Case Studies) — Strong social proof: testimonials, case studies / portfolio
  - Evidence: HTML-heuristic

### GDPR — 70/100

- **[FAIL]** Privacy Policy Page
  - Fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Legal Contact / Imprint Page
  - Fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Evidence: HTML-heuristic
- **[WARN]** Forms Without Privacy Notice — 1 form(s) on page with no privacy policy link
  - Fix: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[INFO]** Terms & Conditions Page — No Terms & Conditions link found — for a non-commercial/informational site this is optional (no purchase or paid service to govern)
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** AI chatbot disclosure — Chat widget detected: LiveAgent. If it answers with AI (e.g. an AI agent or auto-replies), visitors must be told they are talking to an AI.
  - Evidence: HTML-heuristic · LiveAgent · confidence: low
- **[PASS]** Cookie Consent Banner (CMP) — TrustArc detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — No tracking scripts detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 3 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic

### Vulnerability — 90/100

- **[FAIL]** Form CSRF Protection — 1 form(s) without CSRF tokens
  - Fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** CORS Configuration — Access-Control-Allow-Origin: * (allows any domain)
  - Fix: Replace the wildcard CORS header with specific allowed origins. Avoid Access-Control-Allow-Origin: * on pages with authentication or sensitive data.
  - Evidence: file-probe
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[INFO]** Email Infrastructure — No MX records — domain does not receive email
  - Evidence: DNS
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 -all
  - Evidence: DNS
- **[PASS]** DMARC Policy (Email Auth) — DMARC enforced: p=reject
  - Evidence: DNS
- **[PASS]** Payment Page Security — All essential security headers present on payment page
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Accessibility — 41/100

- **[FAIL]** Page Language — The <html> element has no lang attribute
  - Fix: Add a lang attribute to <html>, e.g. <html lang="sk">, matching the primary language.
  - Evidence: HTML-heuristic
- **[FAIL]** Form Labels — 8 of 8 form inputs have no associated label
  - Fix: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.
  - Evidence: HTML-heuristic
- **[WARN]** Image Alt Text — 3 of 207 images missing alt text
  - Fix: Add alt text to the remaining images (alt="" for decorative ones).
  - Evidence: HTML-heuristic
- **[WARN]** Skip Link — No skip-to-content link detected
  - Fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Heading Structure — Single <h1> with a consistent heading outline
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Evidence: HTML-heuristic

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/de/r/liveagent.sk)