# turistikalokobb.sk — Zulien Score 54/100 (Grade D)
> Free e-commerce audit: 54/100 overall score. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).
- **Audited:** https://www.turistikalokobb.sk/
- **Scan date:** 2026-07-01
- **Full report:** https://score.zulien.sk/de/r/turistikalokobb.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/turistikalokobb.sk
## Score by category
| Category | Score |
|---|---|
| SEO | 54/100 |
| Security | 52/100 |
| Mobile | 35/100 |
| AI Readiness | 42/100 |
| GDPR | 69/100 |
| Vulnerability | 71/100 |
## Detailed findings
### Performance
- **[PENDING]** Performance — Measuring — Google PageSpeed running in background…
### SEO — 54/100
- **[FAIL]** XML Sitemap
- Fix: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.
- Evidence: file-probe
- **[WARN]** Canonical URL
- Fix: Add a tag pointing to the preferred URL. For a single-page site this is a one-line addition in .
- Evidence: HTML-heuristic
- **[WARN]** robots.txt
- Fix: Create a robots.txt file at your domain root. Include a Sitemap directive pointing to your XML sitemap.
- Evidence: file-probe
- **[WARN]** HTML Language Attribute
- Fix: Add lang attribute to your tag, e.g., or .
- Evidence: HTML-heuristic
- **[WARN]** Favicon
- Fix: Add a favicon: . Include multiple sizes for different devices (16x16, 32x32, 180x180).
- Evidence: file-probe
- **[INFO]** Meta Description — SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** H1 Heading — SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Content Structure (H2 Headings) — SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Open Graph Tags — SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Twitter/X Cards — SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Structured Data (JSON-LD) — SPA detected — see note below
- Evidence: schema
- **[INFO]** Image Alt Attributes — No images found · SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 5% — low content density (4 words) · SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Semantic HTML Structure — 0/6 semantic elements — poor structure · SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Content Depth — Only 4 words — very thin content · SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Internal Linking — No internal links found · SPA detected — see note below
- Evidence: HTML-heuristic
- **[INFO]** Accessibility Fundamentals — No accessibility signals found · SPA detected — see note below
- Evidence: HTML-heuristic
- **[PASS]** Meta Title — 30 chars — "KST Lokomot�va Bansk� Bystrica"
- Evidence: HTML-heuristic
### Security — 52/100
- **[FAIL]** HSTS (Strict-Transport-Security)
- Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
- Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
- Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
- Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
- Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
- Evidence: HTTP-header
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
- Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
- Evidence: DNS
- **[WARN]** HTTP → HTTPS Redirect
- Fix: Configure a 301 redirect from http:// to https:// for all pages. In Apache: RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
- Evidence: HTTP-header
- **[WARN]** X-Content-Type-Options
- Fix: Add header: X-Content-Type-Options: nosniff
- Evidence: HTTP-header
- **[WARN]** Referrer-Policy
- Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
- Evidence: HTTP-header
- **[WARN]** Permissions-Policy
- Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
- Evidence: HTTP-header
- **[WARN]** security.txt (RFC 9116)
- Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
- Evidence: file-probe
- **[WARN]** CDN / WAF Protection
- Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
- Evidence: HTTP-header
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
- Evidence: SSL
- **[PASS]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
- Evidence: DNS
- **[PASS]** Cookie Security Flags — No cookies set on initial response
- Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: openresty (no version)
- Evidence: HTTP-header
- **[PASS]** Server Version Disclosure — openresty — version hidden
- Evidence: HTTP-header
### Mobile — 35/100
- **[FAIL]** Viewport Configuration
- Fix: Add to your . This is the absolute minimum for mobile compatibility.
- Evidence: HTML-heuristic
- **[WARN]** Responsive Design Techniques
- Fix: Implement responsive CSS with @media queries for key breakpoints: 480px (small mobile), 768px (tablet), 1024px (laptop). Use Flexbox and CSS Grid for fluid layouts.
- Evidence: HTML-heuristic
- **[WARN]** Theme Color
- Fix: Add to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
- Evidence: HTML-heuristic
- **[WARN]** Mobile Navigation (Semantic)
- Fix: Wrap your navigation in a