# php.net — Zulien Score 70/100 (Grade B)

> Free e-commerce audit: 70/100 overall score. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://www.php.net
- **Scan date:** 2026-07-16
- **Full report:** https://score.zulien.sk/de/r/php.net
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/php.net

## Audit summary

Your site has basic web health but is missing critical elements. Add an H1 heading to every page immediately. Your SEO foundation is relatively strong, giving you a solid base to build on.

## Score by category

| Category | Score |
|---|---|
| Performance | 91/100 |
| SEO | 70/100 |
| Security | 66/100 |
| Mobile | 88/100 |
| AI Readiness | 49/100 |
| GDPR | 48/100 |
| Vulnerability | 68/100 |
| Accessibility | 53/100 |

## Detailed findings

### Performance — 91/100

- **[FAIL]** Script Loading Strategy — Only 14% of 7 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
  - Evidence: HTML-heuristic
- **[FAIL]** CSS File Count — 10 CSS files — too many!
  - Fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Evidence: HTML-heuristic
- **[WARN]** Resource Hints (Preload/Preconnect)
  - Fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
  - Evidence: HTML-heuristic
- **[WARN]** Lazy Loading — 4 images without lazy loading
  - Fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 10 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 8ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.26s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 0.48s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 142ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.002 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 0.94s
  - Evidence: PSI-lab
- **[PASS]** Total Page Weight — 925 KB (26 requests)
  - Evidence: PSI-lab
- **[PASS]** Unused Code (CSS + JS) — Only 34 KB of unused code — well optimized
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header

### SEO — 70/100

- **[FAIL]** H1 Heading
  - Fix: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
  - Evidence: HTML-heuristic
- **[FAIL]** Structured Data (JSON-LD)
  - Fix: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
  - Evidence: schema
- **[WARN]** Meta Title — 3 chars (optimal: 30-60)
  - Fix: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.
  - Evidence: HTML-heuristic
- **[WARN]** Open Graph Tags — Missing: og:title
  - Fix: Add the missing OG tags: og:title. Use high-quality 1200×630px images for og:image.
  - Evidence: HTML-heuristic
- **[WARN]** Image Alt Attributes — Only 75% of 4 images have alt text
  - Fix: 1 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — 0% next-gen formats — 0 JPEG, 1 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL Consistency — Canonical points to different URL: https://www.php.net/index.php
  - Fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Evidence: HTML-heuristic
- **[WARN]** Sitemap in robots.txt — robots.txt exists but doesn't reference your sitemap
  - Fix: Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.
  - Evidence: HTML-heuristic
- **[WARN]** Deep Heading Hierarchy — No H3 subheadings for long content
  - Fix: Add H3 subheadings under your H2 sections to create a deeper content hierarchy. This helps search engines understand sub-topics and improves featured snippet eligibility.
  - Evidence: HTML-heuristic
- **[WARN]** Internal Linking — Only 4 internal links
  - Fix: Add more internal links to related content. Target 5+ internal links per page for strong site crawlability.
  - Evidence: HTML-heuristic
- **[PASS]** Meta Description — 132 chars
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 25 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Image Format — image/png
  - Evidence: HTML-heuristic
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://www.php.net/index.php
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with ~39+ URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="en"
  - Evidence: HTML-heuristic
- **[PASS]** Hreflang Tags (Multilingual) — 1 language(s): x-default
  - Evidence: HTML-heuristic
- **[PASS]** Text-to-HTML Ratio — 27% (2001 words)
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <header>, <footer>, <aside>
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth — 2001 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 3 ARIA roles, 11 ARIA labels, lang="en"
  - Evidence: HTML-heuristic

### Security — 66/100

- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** HSTS (Strict-Transport-Security) — max-age too short (15768000s, need 31536000), missing includeSubDomains
  - Fix: Set: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org for browser preloading.
  - Evidence: HTTP-header
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Cookie Security Flags — 1 cookie(s): 1 missing Secure, 1 missing HttpOnly, 1 missing SameSite
  - Fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Evidence: HTTP-header
- **[WARN]** Technology Disclosure — Server: BunnyCDN-DE1-1331
  - Fix: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Evidence: HTTP-header
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN
  - Evidence: HTTP-header
- **[PASS]** Permissions-Policy — interest-cohort=()
  - Evidence: HTTP-header
- **[PASS]** Subresource Integrity (SRI) — No SRI-eligible third-party scripts loaded
  - Evidence: HTML-heuristic
- **[PASS]** security.txt (RFC 9116) — Present at /.well-known/security.txt
  - Evidence: file-probe
- **[PASS]** Server Version Disclosure — BunnyCDN-DE1-1331 — version hidden
  - Evidence: HTTP-header

### Mobile — 88/100

- **[WARN]** Touch Target Size
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: HTML-heuristic
- **[WARN]** Font Size Readability
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: HTML-heuristic
- **[WARN]** Responsive Design Techniques
  - Fix: Implement responsive CSS with @media queries for key breakpoints: 480px (small mobile), 768px (tablet), 1024px (laptop). Use Flexbox and CSS Grid for fluid layouts.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Responsive Images (srcset) — 4 images without responsive sizing
  - Fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Evidence: HTML-heuristic
- **[WARN]** Text Overflow Handling — No word-break/overflow-wrap CSS detected
  - Fix: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Performance Score — 99/100 — excellent
  - Evidence: PSI-lab
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Types — Optimized: 2 search
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Labels (WCAG 3.3.2) — 2/2 inputs majú label
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Evidence: HTML-heuristic

### AI Readiness — 49/100

- **[FAIL]** Structured Data Foundation
  - Fix: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
  - Evidence: schema
- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Heading Hierarchy for AI — 0 H1, 25 H2, 0 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Entity Clarity & Brand Signals
  - Fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Evidence: HTML-heuristic
- **[FAIL]** Common Question Coverage — Answers only 1/5 key shopper questions: availability
  - Fix: Your page barely addresses core shopper questions. Add sections covering price, shipping (options + cost), returns/refunds, availability, and payment methods — as visible text, not just in schema. Link to a dedicated FAQ, Shipping, and Returns page.
  - Evidence: HTML-heuristic
- **[FAIL]** Knowledge Graph Readiness
  - Fix: Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 0% quality alt text — 1 missing, 3 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[FAIL]** Content-to-Boilerplate Ratio — Only 3% in main content — mostly boilerplate
  - Fix: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
  - Evidence: HTML-heuristic
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Structured Content (Lists & Tables) — 7 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Freshness Signals — Visible date found but not in structured data
  - Fix: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Extractable Answer Blocks — 82 paragraphs, avg 21 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 69 words — only 8% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Internal Link Density — only 2/1000w (target: 3-5)
  - Fix: Add 3-5 contextual internal links per 1,000 words using descriptive anchor text. Link to related products, categories, and guides. Replace generic anchors ('click here', 'read more') with descriptive text.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.php.net/index.php
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Social Proof (Testimonials / Case Studies)
  - Fix: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is a leading credibility lever.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[INFO]** Agent-Commerce Readiness — 50/100 — čiastočne pripravené (Prístup 100 · Porozumenie 0 · Transakcia 50)
- **[INFO]** Agent: Prístup — dostane sa agent dnu — 100/100 (2 signály/-ov)
- **[INFO]** Agent: Porozumenie — rozumie produktom — 0/100 (2 signály/-ov)
- **[INFO]** Agent: Transakcia — vie konať (kôš/podmienky) — 50/100 (1 signál)
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 2001 words in raw HTML (26.8% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth for AI — 2001 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 249 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <header>, <footer>, <aside>
  - Evidence: HTML-heuristic
- **[PASS]** Content Readability for AI — Flesch-Kincaid Grade 8 — accessible and clear
  - Evidence: HTML-heuristic

### GDPR — 48/100

- **[FAIL]** Cookie Consent Banner (CMP)
  - Fix: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
  - Evidence: HTML-heuristic
- **[FAIL]** Tracking Scripts Without Consent — 1 tracker(s) loading without consent: Matomo
  - Fix: These tracking scripts fire before user consent: Matomo. Configure your CMP to block them until explicit opt-in. Use Tag Manager's consent mode or CMP script blocking.
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Legal Contact / Imprint Page
  - Fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Personal Data Exposure in Source — 1 personal email(s) in page source: php@fosstodon.org
  - Fix: Remove person-named email addresses (e.g. firstname.lastname@) from the public HTML. Use role mailboxes (info@, sales@) or a contact form instead.
  - Evidence: HTML-heuristic · php@fosstodon.org · confidence: low
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Data Protection Officer Contact
  - Fix: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal of Consent Mechanism
  - Fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — /privacy.php
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic

### Vulnerability — 68/100

- **[FAIL]** Sensitive Files Exposed — composer.json (dependency map) — CRITICAL!
  - Fix: URGENT: Block these files immediately! Apache: add to .htaccess: <FilesMatch '\.(env\|git\|json)$'>Require all denied</FilesMatch>. Nginx: location ~ /\. { deny all; }
  - Evidence: file-probe
- **[FAIL]** Install Script Exposed — /install/, /install.php or /setup/ still accessible — CRITICAL!
  - Fix: Delete the install/ and setup/ directories from the web root immediately after CMS installation. Attackers can reset the database or re-run the installer to seize admin access.
  - Evidence: file-probe
- **[FAIL]** Form CSRF Protection — 1 form(s) without CSRF tokens
  - Fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** package.json Exposed — package.json accessible — reveals all dependencies and versions
  - Fix: Block access to package.json via .htaccess or server config. It should never be served to the public.
  - Evidence: file-probe
- **[WARN]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
  - Evidence: DNS
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** jQuery Version — jQuery 3.6.0
  - Evidence: file-probe
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 ip4:140.211.15.143 ip4:45.112.84.5 ip4:142.93.197.176 ip6:2604:a880:400:d
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: mail)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Accessibility — 53/100

- **[FAIL]** Heading Structure — The page has no <h1> heading
  - Fix: Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.
  - Evidence: HTML-heuristic
- **[FAIL]** Landmark Regions — No <main> landmark region found
  - Fix: Wrap the primary content in <main> and use <nav>, <header>, <footer> for the page regions.
  - Evidence: HTML-heuristic
- **[WARN]** Image Alt Text — 1 of 4 images missing alt text
  - Fix: Add alt text to the remaining images (alt="" for decorative ones).
  - Evidence: HTML-heuristic
- **[WARN]** Skip Link — No skip-to-content link detected
  - Fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="en"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Form Labels — All 2 form inputs are labelled
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Zoom & Scaling — Pinch-zoom is not disabled
  - Evidence: HTML-heuristic

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/de/r/php.net)
