How Zulien Score is calculated
Zulien Score checks e-shops in up to nine categories. This page shows exactly how the score is computed. The weights below are the same constants the scanner uses (a test fails the build if they differ), and we list what we deliberately leave out of the score and why.
Category weights
The share of each category in the overall score (0-100). The number of checks depends on the platform and on what the scanner finds (a product page, a feed, …), so we show the range observed in recent scans.
| Category | Weight | Checks |
|---|---|---|
Performance Speed from Google PageSpeed (lab) and Chrome UX Report field data where available: LCP, INP, CLS, TTFB, page weight. | 25 % | 17–23 |
SEO Indexability and on-page basics: title, description, headings, canonical URL, sitemap, robots.txt, structured data. | 20 % | 18–27 |
Security TLS certificate, HTTPS redirect, security headers (HSTS, CSP, clickjacking protection), cookie flags, DNSSEC and CAA records. | 15 % | 14–19 |
Mobile Viewport, mobile performance, tap target size, font size, responsive images. | 10 % | 5–22 |
AI Readiness Whether AI crawlers can reach and understand the shop: bot access, server-rendered content, schema, product feeds, citable content. | 10 % | 26–52 |
Legal & Compliance Consent and legal basics: cookie banner, tracking before consent, Consent Mode, privacy and cookie policies, consumer-law disclosures (Omnibus, ODR, withdrawal). | 10 % | 10–21 |
Vulnerability Exposed files and admin tools, outdated CMS, PHP and libraries with known CVEs, debug output, email authentication (SPF, DMARC). | 10 % | 11–18 |
NIS2 NIS2 Article 21 measures visible from outside: TLS, HSTS, CSP, DMARC, security.txt, handling of known vulnerabilities. Scored only when the company falls under NIS2 by sector and size. Otherwise it is left out and the other weights are rescaled. | 10 % | 7 |
Accessibility / EAA Structural accessibility signals readable from the HTML: page language, alt text, form labels, headings, landmarks, zoom. Not scored for micro-enterprises (under 10 staff and up to €2M turnover), which the European Accessibility Act exempts. Everyone else is scored. | 10 % | 7–9 |
Range of checks across the 20 most recent leaderboard scans.
How the score is computed
- Each check earns 100 points when it passes, 50 for a warning (also while a measurement is still running) and 0 when it fails.
- Checks weigh 1 to 3: critical regulatory checks and Core Web Vitals weigh 3, nice-to-haves 1. A category score is the weighted average of its checks.
- Heuristic findings with low confidence count at 0.5× their weight, so a guess cannot sink a category the way a measured fact can.
- Checks shown as information (for example llms.txt) and offers of our services never count toward the score.
- On JavaScript-rendered sites, content checks that our HTML scanner cannot see are switched to information instead of failing.
- The overall score is the weighted average of the categories above. A category without a score (performance data still loading, NIS2 or accessibility not applicable, a site blocked by a firewall) is left out and the remaining weights are rescaled, so the number is never pulled down by something we could not measure.
What we deliberately do not score
These are signals we measure, or could measure, but keep out of the score on purpose:
llms.txt and other AI descriptor files
We report llms.txt, llms-full.txt, ai.txt and the AI plugin manifest as information only. No answer engine (ChatGPT, Perplexity, Gemini) uses llms.txt for citations today. Access for AI crawlers and server-rendered content matter far more, and those are scored.
Agentic checkout (ACP, Instant Checkout)
We do not score whether an AI agent can complete a purchase in your shop. These standards change quickly and shopping results in ChatGPT rely on product feeds, so we check the feeds instead (Google Merchant, Heureka, Zboží.cz, GTIN). The Agent-Commerce Readiness summary in the report is for information only.
AI visibility (citations in AI answers)
How often AI assistants mention or cite your shop depends on the questions asked and changes from day to day. When a report includes this measurement, it is a separate panel and never enters the score.
Colour contrast
A real contrast ratio needs the rendered page (fonts, backgrounds, the CSS cascade). Our scanner reads the HTML without rendering it, so we do not guess contrast from inline colours: a guess would raise false alarms.
Deep accessibility audit
The accessibility audit in a real browser (axe-core at two screen sizes) is a separate service and does not change the score. The Accessibility category above uses only signals readable from the HTML.
Deeper audit for verified owners
After you verify ownership of the domain with a DNS TXT record, scans started with your owner key run extra active checks: forgotten sibling hosts (staging or development subdomains with exposed tools) and how the shop handles malformed input. These results are private, visible only to the verified owner, and do not change the public score.
Anonymous scans of any domain stay passive: the requests a visitor or a search bot would make, plus checks of well-known public paths (for example whether a PHP error on a not-found page reveals server file paths).
Verify your shop →The action plan in the report
Every failed or warning check is placed in an impact × effort matrix. Impact follows the severity of the finding. Effort is our estimate of a typical fix: quick (a header, a DNS record, deleting a file), about a day (a policy page, a consent banner, schema) or a project (a platform upgrade, performance work, new content). Start with the quick wins.
How our scanner identifies itself and how to allow or block it: /scanner-info