# netky.sk — Zulien Score 78/100 (Grade B)

> Free e-commerce audit: 78/100 overall score. Company: Chronos Sophia s.r.o.. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://www.netky.sk/
- **Company:** Chronos Sophia s.r.o.
- **Scan date:** 2026-07-14
- **Full report:** https://score.zulien.sk/de/r/netky.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/netky.sk

## Score by category

| Category | Score |
|---|---|
| Performance | 100/100 |
| SEO | 77/100 |
| Security | 57/100 |
| Mobile | 83/100 |
| AI Readiness | 51/100 |
| GDPR | 73/100 |
| Vulnerability | 83/100 |

## Detailed findings

### Performance — 100/100

- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Cache-Control Strategy — Not measured — no Cache-Control on the HTML document; static-asset caching was not sampled
  - Evidence: HTTP-header
- **[PASS]** Server Response Time (TTFB) — 13ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.45s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 0.80s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 0ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.060 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 0.73s
  - Evidence: PSI-lab
- **[PASS]** Total Page Weight — 1.1 MB (49 requests)
  - Evidence: PSI-lab
- **[PASS]** Unused Code (CSS + JS) — Only 0 KB of unused code — well optimized
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 3 preload, 1 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** Lazy Loading — 59% of images use native lazy loading (16/27)
  - Evidence: HTML-heuristic
- **[PASS]** Script Loading Strategy — 100% of scripts use async/defer/module (0 async, 1 defer, 0 module)
  - Evidence: HTML-heuristic
- **[PASS]** CSS File Count — 1 CSS file(s) — well consolidated
  - Evidence: HTML-heuristic
- **[PASS]** Font Preloading — 2 font(s) preloaded — faster text rendering
  - Evidence: HTML-heuristic

### SEO — 77/100

- **[FAIL]** Structured Data (JSON-LD)
  - Fix: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
  - Evidence: schema
- **[WARN]** Meta Description — 70 chars (optimal: 120-160)
  - Fix: Expand your description to at least 120 characters. Include benefits, a CTA, and your target keyword.
  - Evidence: HTML-heuristic
- **[WARN]** Content Structure (H2 Headings) — Only 1 H2 subheading
  - Fix: Add more H2 subheadings to break content into scannable sections. Include secondary keywords in H2 tags.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — Only 15% next-gen formats — 0 legacy images remain
  - Fix: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use <picture> element for browser fallback.
  - Evidence: HTML-heuristic
- **[WARN]** Semantic HTML Structure — Only 2/6 semantic elements — missing: <article>, <nav>, <main>, <aside>
  - Fix: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
  - Evidence: HTML-heuristic
- **[WARN]** Empty/Dead Links — 16 dead links (0 empty, 16 hash-only, 0 javascript:void)
  - Fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Evidence: HTML-heuristic
- **[WARN]** Accessibility Fundamentals — 2/4 a11y signals — missing: ARIA roles, skip navigation link
  - Fix: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
  - Evidence: HTML-heuristic
- **[WARN]** Image Dimension Attributes — Only 22% of images have width/height attributes
  - Fix: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
  - Evidence: HTML-heuristic
- **[WARN]** Broken Image Sources — 1 image(s) with empty src attribute
  - Fix: Fix images with empty src=''. Either add proper URLs or use loading='lazy' with valid data-src for lazy-loaded images.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 5% ratio but 652 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 44 chars — "Spravodajstvo zo sveta i z domova \| Netky.sk"
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "Aktuálne spravodajstvo zo sveta a domova \| Netky.sk"
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://www.netky.sk/
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with ~21+ URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk"
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 100% of 27 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Content Depth — 652 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 1, H3: 13 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 63 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 13 day(s) ago
  - Evidence: HTML-heuristic

### Security — 57/100

- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Evidence: HTTP-header
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** HSTS (Strict-Transport-Security) — max-age too short (2592000s, need 31536000), missing includeSubDomains
  - Fix: Set: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org for browser preloading.
  - Evidence: HTTP-header
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Technology Disclosure — Server: Microsoft-IIS/10.0, X-Powered-By: RedHat, PHP
  - Fix: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Evidence: HTTP-header
- **[WARN]** Subresource Integrity (SRI) — Only 0/1 SRI-eligible third-party scripts have integrity hashes
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Evidence: HTML-heuristic
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** Cookie Security Flags — No cookies set on initial response
  - Evidence: HTTP-header
- **[PASS]** Server Version Disclosure — Microsoft-IIS/10.0 — version hidden
  - Evidence: HTTP-header

### Mobile — 83/100

- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Iba 0/1 inputs má label (0%)
  - Fix: 1 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
  - Evidence: HTML-heuristic
- **[WARN]** Touch Target Size
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: HTML-heuristic
- **[WARN]** Font Size Readability
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Navigation (Semantic)
  - Fix: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').
  - Evidence: HTML-heuristic
- **[WARN]** Responsive Images (srcset) — 27 images without responsive sizing
  - Fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Evidence: HTML-heuristic
- **[WARN]** Form Input Types — email fields use type='text' instead of type='email'; phone fields use type='text' instead of type='tel'
  - Fix: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
  - Evidence: HTML-heuristic
- **[WARN]** Text Overflow Handling — No word-break/overflow-wrap CSS detected
  - Fix: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
  - Evidence: HTML-heuristic
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Evidence: HTML-heuristic
- **[WARN]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h1→h3
  - Fix: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
  - Evidence: HTML-heuristic
- **[WARN]** Link Text Quality (WCAG 2.4.4) — 1 odkazov má generický text ("click here", "more", "tu"...)
  - Fix: Nahraď 'Click here' / 'Read more' / 'Viac' popisným textom: 'Prečítaj si viac o GDPR', 'Pozri cenník modulov'. Screen readers čítajú odkazy mimo kontextu — samostatné 'viac' nemá význam.
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Performance Score — 95/100 — excellent
  - Evidence: PSI-lab
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Theme Color — theme-color meta tag present
  - Evidence: HTML-heuristic

### AI Readiness — 51/100

- **[FAIL]** llms.txt (AI Site Descriptor)
  - Fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
  - Evidence: file-probe
- **[FAIL]** Structured Data Foundation
  - Fix: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
  - Evidence: schema
- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Heading Hierarchy for AI — 1 H1, 1 H2, 13 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Common Question Coverage — Answers only 1/5 key shopper questions: price
  - Fix: Your page barely addresses core shopper questions. Add sections covering price, shipping (options + cost), returns/refunds, availability, and payment methods — as visible text, not just in schema. Link to a dedicated FAQ, Shipping, and Returns page.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 7% quality alt text — 0 missing, 25 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** llms-full.txt (Complete AI Content)
  - Fix: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
  - Evidence: file-probe
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Semantic HTML Structure — 2/6 elements — missing: <article>, <nav>, <main>, <aside>
  - Fix: Add: <article>, <nav>, <main>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — 9 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Entity Clarity & Brand Signals — OG tags complete but no sameAs entity links
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 66 words — only 11% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Knowledge Graph Readiness — 1/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema
  - Fix: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 16 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** ai.txt (AI Permissions)
  - Fix: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
  - Evidence: file-probe
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Content-to-Boilerplate Ratio — No <main> or <article> elements — AI can't isolate content from boilerplate
  - Fix: Add <main> around your primary content and <article> around self-contained content blocks. This creates clear boundaries for AI content extraction.
  - Evidence: HTML-heuristic
- **[WARN]** Social Proof (Testimonials / Case Studies)
  - Fix: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is the #1 credibility lever.
  - Evidence: HTML-heuristic
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 652 words in raw HTML (5.2% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth for AI — 652 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 33 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Extractable Answer Blocks — 9 paragraphs, avg 36 words — optimal for AI extraction
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 97 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Canonical Tag for AI Deduplication — Self-referencing canonical — clean signal for AI
  - Evidence: HTML-heuristic

### GDPR — 73/100

- **[FAIL]** Cookie Consent Banner (CMP)
  - Fix: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Data Protection Officer Contact
  - Fix: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — No tracking scripts detected
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — /img/icons/widget-icons.svg#gdpr_svg
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — /o-nas
  - Evidence: HTML-heuristic
- **[PASS]** Terms & Conditions Page — /obchodne-podmienky
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 1 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic

### Vulnerability — 83/100

- **[FAIL]** Suspicious Inline Script Patterns — Detected: Dynamic script injection
  - Fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
  - Evidence: file-probe
- **[WARN]** X-Powered-By Header — RedHat, PHP
  - Fix: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').
  - Evidence: file-probe
- **[WARN]** Inline JavaScript Exposure — 83 KB of inline JavaScript
  - Fix: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
  - Evidence: DNS
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[WARN]** Inline Event Handlers — 13 inline event handlers (onclick, onmouseover, etc.)
  - Fix: Move inline event handlers to external JavaScript files using addEventListener(). Inline handlers prevent proper CSP implementation (require 'unsafe-inline') and increase XSS attack surface.
  - Evidence: HTML-heuristic
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 ip4:77.240.183.97 ip4:77.240.183.99 +a +mx +ip4:159.69.139.117 +ip4:159.6
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: default)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/de/r/netky.sk)
