Last scanned: July 29, 2026

D0/100

Below Average

Score Report

4home.sk

Scanned on July 29, 2026

Unknown

jQuery

Microsoft-IIS/10.0

Last scanned: July 29, 2026

AI verdict

Your site needs improvements in security and accessibility. Add HSTS security headers to your server immediately. Good news: your SEO foundation is solid and you're ready for AI.

Action plan

Fix these 3 things first

Sorted by score impact — each fix moves your overall grade up.

+15potential gain

53/100

Performance

Weight: 25% · 5 passed · 4 warnings · 5 failed · 1 SPA (verify manually)

What we found: 3.54s (good: <1.8s)

Why it matters: FCP over 3s means users stare at a blank screen for 3+ seconds. Most mobile users abandon sites that take over 3 seconds to show content.

How to fix: Critical: enable full-page caching, eliminate render-blocking resources, preload critical CSS, defer all non-essential JS, and compress images.

Evidence:PSI-lab· Confidence: high

Get Store Optimization →

What we found: 8.08s (good: <3.4s)

Why it matters: Speed Index over 5.8s means users watch a near-blank page for almost 6 seconds. At this speed you lose a large share of potential customers to competitors.

How to fix: Your page loads very slowly visually. Prioritize critical rendering path: inline critical CSS, defer non-essential JS, preload hero image, and use a CDN.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

What we found: 4.5 MB, 204 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Evidence:PSI-lab· Confidence: high

Get Performance Optimization →

What we found: 737 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 737 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Evidence:PSI-lab· Confidence: low

What we found: Only 18% of 11 scripts optimized — most are render-blocking

Why it matters: 9 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Evidence:HTML-heuristic· Confidence: high

Get Performance Optimization →

What we found: 246ms (optimal: <200ms)

Why it matters: TTFB is the foundation — every other metric is delayed by a slow server. A 200ms vs 600ms TTFB means 400ms added to FCP, LCP, and everything else.

How to fix: Optimize server response: enable opcode caching (OPcache), add Redis/Memcached for database caching, use a CDN. Check slow database queries.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

What we found: 3.84s (good: <2.5s) — Core Web Vital

Why it matters: LCP is a Core Web Vital that directly impacts Google rankings. Sites failing LCP are demoted in search results. The most common cause of slow LCP is unoptimized hero images.

How to fix: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

What we found: 584ms (good: <200ms)

Why it matters: TBT measures how long the main thread is blocked. During this time, clicks and taps don't respond — your store feels frozen. This directly impacts perceived quality.

How to fix: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

9 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

I agree to the Privacy Policy. We'll send your report and optional re-scan notifications.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Your store is losing customers every day. The issues above are costing you sales.

Critical score — request an expert audit

Hands-on review by our team: we identify root causes, prioritize fixes, and hand you an action plan. We'll send a tailored quote within 48h.

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report

Zulien Score

Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách

58/100

Grade D

4home.sk

Dátum auditu: July 29, 2026

Online report: https://score.zulien.sk/r/4home.sk

Executive summary

Chýb

Upozornení

165

Spolu kontrol

Skóre po kategóriách

Kategória	Skóre	Váha	Chyby	Upozornenia	OK
Performance	53/100	25%	5	4	5
SEO	65/100	20%	4	7	13
Security	55/100	15%	3	9	6
Mobile	64/100	10%	0	13	6
AI Readiness	66/100	10%	4	17	13
GDPR	63/100	10%	1	9	6
Vulnerability	62/100	10%	3	5	7
Accessibility	36/100	—	3	2	3

Kritické zistenia

First Contentful Paint (FCP)· Performance

FCP over 3s means users stare at a blank screen for 3+ seconds. Most mobile users abandon sites that take over 3 seconds to show content.

Speed Index· Performance

Speed Index over 5.8s means users watch a near-blank page for almost 6 seconds. At this speed you lose a large share of potential customers to competitors.

Total Page Weight· Performance

Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

Unused Code (CSS + JS)· Performance

Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Script Loading Strategy· Performance

9 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

H1 Heading· SEO

The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords.

Open Graph Image Format· SEO

Social scrapers expect an image at the og:image URL. If they get HTML/JSON instead, no preview renders.

Image Alt Attributes· SEO

Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA.

Internal Linking· SEO

Pages with fewer than 3 internal links are effectively orphaned — search engines may not discover or prioritize them. Google uses internal link structure as a primary crawl and ranking signal.

HSTS (Strict-Transport-Security)· Security

Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.

Content-Security-Policy (CSP)· Security

CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

Clickjacking Protection· Security

Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Performance

53/100

Váha: 25% · 5 OK · 4 upozornení · 5 chýb · spolu 15

First Contentful Paint (FCP)Zlyhalo

3.54s (good: <1.8s)

Prečo je to dôležité: FCP over 3s means users stare at a blank screen for 3+ seconds. Most mobile users abandon sites that take over 3 seconds to show content.

Ako opraviť: Critical: enable full-page caching, eliminate render-blocking resources, preload critical CSS, defer all non-essential JS, and compress images.

Speed IndexZlyhalo

8.08s (good: <3.4s)

Prečo je to dôležité: Speed Index over 5.8s means users watch a near-blank page for almost 6 seconds. At this speed you lose a large share of potential customers to competitors.

Ako opraviť: Your page loads very slowly visually. Prioritize critical rendering path: inline critical CSS, defer non-essential JS, preload hero image, and use a CDN.

Total Page WeightZlyhalo

4.5 MB, 204 requests — too heavy!

Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Unused Code (CSS + JS)Zlyhalo

737 KB wasted on unused code!

Prečo je to dôležité: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Ako opraviť: You're loading 737 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Script Loading StrategyZlyhalo

Only 18% of 11 scripts optimized — most are render-blocking

Prečo je to dôležité: 9 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

Ako opraviť: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Server Response Time (TTFB)Upozornenie

246ms (optimal: <200ms)

Prečo je to dôležité: TTFB is the foundation — every other metric is delayed by a slow server. A 200ms vs 600ms TTFB means 400ms added to FCP, LCP, and everything else.

Ako opraviť: Optimize server response: enable opcode caching (OPcache), add Redis/Memcached for database caching, use a CDN. Check slow database queries.

Largest Contentful Paint (LCP)Upozornenie

3.84s (good: <2.5s) — Core Web Vital

Prečo je to dôležité: LCP is a Core Web Vital that directly impacts Google rankings. Sites failing LCP are demoted in search results. The most common cause of slow LCP is unoptimized hero images.

Ako opraviť: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.

Total Blocking Time (TBT)Upozornenie

584ms (good: <200ms)

Prečo je to dôležité: TBT measures how long the main thread is blocked. During this time, clicks and taps don't respond — your store feels frozen. This directly impacts perceived quality.

Ako opraviť: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.

Resource Hints (Preload/Preconnect)Upozornenie

Prečo je to dôležité: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

Ako opraviť: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.

Cumulative Layout Shift (CLS)Prešlo

0.000 — Core Web Vital ✓

Text Compression (gzip/brotli)Prešlo

All text resources properly compressed

Lazy LoadingPrešlo

0% of images use native lazy loading (5/1307)

CSS File CountPrešlo

3 CSS file(s) — well consolidated

Critical CSS StrategyPrešlo

Critical CSS / async CSS loading detected

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

SEO

65/100

Váha: 20% · 13 OK · 7 upozornení · 4 chýb · spolu 25

H1 HeadingZlyhalo

Prečo je to dôležité: The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords.

Ako opraviť: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.

Open Graph Image FormatZlyhalo

og:image returned text/html

Prečo je to dôležité: Social scrapers expect an image at the og:image URL. If they get HTML/JSON instead, no preview renders.

Ako opraviť: Make sure the og:image URL returns an image (Content-Type: image/png or image/jpeg). Common cause: returning HTML or JSON from a broken redirect.

Image Alt AttributesZlyhalo

Only 18% of 1307 images have alt text

Prečo je to dôležité: Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA.

Ako opraviť: 1077 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.

Internal LinkingZlyhalo

Only 2 internal link(s) — orphaned page

Prečo je to dôležité: Pages with fewer than 3 internal links are effectively orphaned — search engines may not discover or prioritize them. Google uses internal link structure as a primary crawl and ranking signal.

Ako opraviť: This page has very few internal links. Add links to related products, categories, guides, and your main navigation. Orphaned pages rank poorly.

Meta TitleUpozornenie

23 chars (optimal: 30-60)

Prečo je to dôležité: Short titles waste valuable ranking real estate in search results.

Ako opraviť: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.

Meta DescriptionUpozornenie

185 chars (optimal: 120-160)

Prečo je to dôležité: Google truncates descriptions over 160 chars. Mobile shows even less (~120 chars).

Ako opraviť: Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.

Twitter/X CardsUpozornenie

Prečo je to dôležité: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.

Ako opraviť: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.

Image Format OptimizationUpozornenie

0% next-gen formats — 1231 JPEG, 26 PNG images

Prečo je to dôležité: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.

Ako opraviť: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.

Canonical URL ConsistencyUpozornenie

Canonical points to different URL: https://www.4home.sk

Prečo je to dôležité: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.

Ako opraviť: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.

Accessibility FundamentalsUpozornenie

1/4 a11y signals — missing: ARIA roles, ARIA labels, skip navigation link

Prečo je to dôležité: The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO, as Google treats it as a ranking signal.

Ako opraviť: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.

Color Contrast SignalUpozornenie

6 very light text colors found — potential contrast issues

Prečo je to dôležité: Low contrast text is the most common accessibility issue found on home pages. It affects users with color vision deficiency and everyone in bright sunlight.

Ako opraviť: Ensure text has a minimum 4.5:1 contrast ratio against its background (WCAG AA). Use tools like WebAIM Contrast Checker. Light gray text on white is the most common violation.

Content Structure (H2 Headings)Prešlo

14 H2 subheadings found

Open Graph TagsPrešlo

og:title, og:description, og:image

Canonical URLPrešlo

https://www.4home.sk

Structured Data (JSON-LD)Prešlo

1 block(s): Organization, WebSite, SearchAction, EntryPoint

JSON-LD ValidityPrešlo

1 block(s) parse cleanly

robots.txtPrešlo

Present, references sitemap

XML SitemapPrešlo

Found with ~35+ URLs

HTML Language AttributePrešlo

lang="sk"

FaviconPrešlo

Favicon detected

Semantic HTML StructurePrešlo

4/6 semantic elements: <article>, <nav>, <header>, <footer>

Content DepthPrešlo

5532 words — sufficient content

Deep Heading HierarchyPrešlo

H2: 14, H3: 28 — well-structured content

Empty/Dead LinksPrešlo

1 minor dead link(s) — acceptable

Text-to-HTML RatioInfo

3% ratio but 5532 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content

Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.

Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.

Security

55/100

Váha: 15% · 6 OK · 9 upozornení · 3 chýb · spolu 18

HSTS (Strict-Transport-Security)Zlyhalo

Prečo je to dôležité: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.

Ako opraviť: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.

Content-Security-Policy (CSP)Zlyhalo

Prečo je to dôležité: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

Ako opraviť: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

Clickjacking ProtectionZlyhalo

Prečo je to dôležité: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Ako opraviť: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.

CAA DNS RecordUpozornenie

No CAA records — any CA can issue certificates for this domain

Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

X-Content-Type-OptionsUpozornenie

Prečo je to dôležité: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.

Ako opraviť: Add header: X-Content-Type-Options: nosniff

Permissions-PolicyUpozornenie

Prečo je to dôležité: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.

Ako opraviť: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.

Cookie Security FlagsUpozornenie

3 cookie(s): 3 missing Secure, 3 missing HttpOnly, 3 missing SameSite

Prečo je to dôležité: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.

Ako opraviť: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.

Technology DisclosureUpozornenie

Server: Microsoft-IIS/10.0, X-Powered-By: ASP.NET

Prečo je to dôležité: Exposing exact server/PHP versions lets attackers search CVE databases for specific exploits. This is the first step in most automated attacks.

Ako opraviť: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.

Subresource Integrity (SRI)Upozornenie

Only 0/2 SRI-eligible third-party scripts have integrity hashes

Prečo je to dôležité: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.

Ako opraviť: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.

security.txt (RFC 9116)Upozornenie

Prečo je to dôležité: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.

Ako opraviť: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.

CDN / WAF ProtectionUpozornenie

Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.

Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

Iframe SandboxingUpozornenie

1/1 unknown iframe(s) without sandbox attribute

Prečo je to dôležité: Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS.

Ako opraviť: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.

SSL/TLS CertificatePrešlo

Valid HTTPS connection established

DNSSECPrešlo

Zone is DNSSEC-signed (DNSKEY published)

Prečo je to dôležité: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.

HTTP → HTTPS RedirectPrešlo

HTTP properly redirects to HTTPS

Referrer-PolicyPrešlo

no-referrer-when-downgrade

Server Version DisclosurePrešlo

Microsoft-IIS/10.0 — version hidden

Password Field SecurityPrešlo

1 password field(s) — allow password manager autofill

Mobile

64/100

Váha: 10% · 6 OK · 13 upozornení · 0 chýb · spolu 20

Mobile Performance ScoreUpozornenie

59/100 (target: 90+)

Prečo je to dôležité: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.

Ako opraviť: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.

Touch Target SizeUpozornenie

Some tappable targets are too small or too close together (Lighthouse tap-targets audit)

Prečo je to dôležité: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityUpozornenie

Some text renders below the 12px legibility threshold (Lighthouse font-size audit)

Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.

Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

Responsive Design TechniquesUpozornenie

Prečo je to dôležité: Non-responsive sites are automatically penalized by Google in mobile search results. With mobile-first indexing, this is a critical ranking factor.

Ako opraviť: Implement responsive CSS with @media queries for key breakpoints: 480px (small mobile), 768px (tablet), 1024px (laptop). Use Flexbox and CSS Grid for fluid layouts.

PWA FeaturesUpozornenie

Prečo je to dôležité: PWAs combine the best of web and native apps. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access.

Ako opraviť: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.

Form Input TypesUpozornenie

phone fields use type='text' instead of type='tel'

Prečo je to dôležité: Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors and speeds up form completion.

Ako opraviť: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.

Mobile Sticky CTAUpozornenie

Add-to-cart button found but no sticky/fixed positioning detected

Prečo je to dôležité: Mobile users scroll extensively. A sticky add-to-cart bar keeps the primary action visible. Without it, users must scroll back up to purchase — many won't.

Ako opraviť: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.

Text Overflow HandlingUpozornenie

No word-break/overflow-wrap CSS detected

Prečo je to dôležité: Long strings without word-break cause horizontal overflow on mobile — a common cause of 'content wider than viewport' failures. Compound words and URLs are frequent culprits.

Ako opraviť: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.

Print StylesheetUpozornenie

Order/invoice page without print styles

Prečo je to dôležité: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.

Ako opraviť: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.

Express Checkout (Apple Pay + Google Pay)Upozornenie

Iba Apple Pay detekovaný — chýba Google Pay

Prečo je to dôležité: iOS/Android majú 50/50 share. Jeden bez druhého znamená stratený revenue na polovici mobilných používateľov.

Ako opraviť: Pridaj Google Pay cez Stripe, Adyen alebo Mollie. Mobile conversion rate rastie keď je express checkout dostupný.

Form Input Labels (WCAG 3.3.2)Upozornenie

220/225 inputs má label (98%)

Prečo je to dôležité: Formulárové inputy bez labelov sú nedostupné pre screen reader používateľov a zhoršujú konverziu aj pre bežných používateľov (neviditeľné placeholder texty, stratená informácia pri fokusovaní).

Ako opraviť: 5 input elementov nemá <label for="id">, aria-label, aria-labelledby alebo title. Placeholder nie je dostatočný (WCAG 3.3.2). Pridaj <label for="email">Email</label><input id="email"> alebo <input aria-label="Email">.

Heading Hierarchy (WCAG 1.3.1)Upozornenie

Preskočené úrovne: h2→h4

Prečo je to dôležité: Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené.

Ako opraviť: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.

Link Text Quality (WCAG 2.4.4)Upozornenie

1 odkazov má generický text ("click here", "more", "tu"...)

Prečo je to dôležité: WCAG 2.4.4: Účel odkazu musí byť zrejmý z textu. Vágne odkazy zhoršujú UX, konverziu aj SEO (Google anchor text relevancia).

Ako opraviť: Nahraď 'Click here' / 'Read more' / 'Viac' popisným textom: 'Prečítaj si viac o GDPR', 'Pozri cenník modulov'. Screen readers čítajú odkazy mimo kontextu — samostatné 'viac' nemá význam.

Viewport ConfigurationPrešlo

width=device-width, initial-scale=1

Content Fits ViewportPrešlo

No horizontal scrolling needed

Theme ColorPrešlo

theme-color meta tag present

Mobile Navigation (Semantic)Prešlo

<nav> element present — proper navigation landmark

Responsive Images (srcset)Prešlo

27 image(s) use srcset for responsive sizing

Payment Methods DetectedPrešlo

1 method(s): Apple Pay

SK/CZ Local Payment MethodsInfo

Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute

Prečo je to dôležité: SK/CZ shop bez bankových tlačidiel a QR platby = masívny cart abandonment. Priemerný SK e-shop má viacero payment metód. (Sken vidí iba homepage — over manuálne v checkoute.)

Ako opraviť: Ak SK/CZ local platby nemáš, integruj GoPay alebo ComGate — obe podporujú Tatra Pay, VÚB Pay, ČSOB Pay, Raiffeisen, QR platba v jednom API. Alternatívne Barion pre CZ trh.

AI Readiness

66/100

Váha: 10% · 13 OK · 17 upozornení · 4 chýb · spolu 46

Heading Hierarchy for AIZlyhalo

0 H1, 14 H2, 28 H3 — poor structure

Prečo je to dôležité: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Ako opraviť: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).

Content Freshness SignalsZlyhalo

Prečo je to dôležité: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

Ako opraviť: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.

Internal Link DensityZlyhalo

Almost no internal links in content

Prečo je to dôležité: Without internal links, AI crawlers treat each page as isolated content. Internal linking creates a semantic web that helps AI understand your product catalog, categories, and content relationships.

Ako opraviť: Add contextual internal links throughout your content: link to related products, categories, guides, and FAQs. Use descriptive anchor text (not 'click here'). Target 3-5 links per 1,000 words.

Image Alt Text Quality for AIZlyhalo

Only 3% quality alt text — 1077 missing, 190 poor

Prečo je to dôležité: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

Ako opraviť: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.

Structured Data FoundationUpozornenie

2 distinct schema types (BusinessEntity, WebSite) — add more for comprehensive AI coverage

Prečo je to dôležité: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite.

Ako opraviť: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.

FAQ Schema (Direct AI Answers)Upozornenie

Prečo je to dôležité: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.

Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Breadcrumb SchemaUpozornenie

Prečo je to dôležité: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.

Ako opraviť: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.

Structured Content (Lists & Tables)Upozornenie

222 lists found — consider adding comparison tables

Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.

Ako opraviť: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.

Author Expertise Signals (E-E-A-T)Upozornenie

Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.

Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Product Feed (AI Commerce)Upozornenie

Prečo je to dôležité: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.

Ako opraviť: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.

Heureka XML FeedUpozornenie

Prečo je to dôležité: Heureka.sk and Heureka.cz are the dominant price comparison engines on the SK/CZ market. Without an XML feed you're not visible on the main marketplace. No generic audit tool checks this.

Ako opraviť: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).

Extractable Answer BlocksUpozornenie

21 paragraphs, avg 251 words — too long for AI snippets

Prečo je to dôležité: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.

Ako opraviť: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.

Section Length OptimizationUpozornenie

Avg section: 197 words — only 0% in 80-200 word optimal range

Prečo je to dôležité: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.

Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Q&A Format HeadingsUpozornenie

Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

Ako opraviť: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.

Canonical Tag for AI DeduplicationUpozornenie

Canonical points to different URL: https://www.4home.sk

Prečo je to dôležité: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.

Ako opraviť: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.

Return Policy SchemaUpozornenie

Prečo je to dôležité: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.

Ako opraviť: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.

Shipping Details SchemaUpozornenie

Prečo je to dôležité: Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver.

Ako opraviť: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.

Content Readability for AIUpozornenie

Grade 20 — too complex for broad AI citation

Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.

Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Expert Quotations & CitationsUpozornenie

Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

WebMCP Agentic ReadinessUpozornenie

Prečo je to dôležité: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

Customer Reviews — AggregateUpozornenie

1 source: Heureka Ověřeno

Prečo je to dôležité: Without a second review source and a machine-readable reviewCount, AI assistants can't verify scale of social proof — single-source ratings are routinely deweighted as potentially curated.

Ako opraviť: Single review source detected without published reviewCount. Add AggregateRating JSON-LD (ratingValue + reviewCount + bestRating) so the count is machine-readable, and add a second source (Heureka Ověřeno + Trustpilot is the SK/CZ standard).

AI Bot Access PolicyPrešlo

No AI bot restrictions (allowed by default)

Content Accessibility for AIPrešlo

5532 words in raw HTML (2.8% text ratio) — readable by AI crawlers without executing JS

Organization Schema + Entity LinkingPrešlo

Organization found with 2 sameAs links — strong entity identity

Site Search Schema (SearchAction)Prešlo

WebSite SearchAction configured — AI can search your store

Content Depth for AIPrešlo

5532 words — rich content for AI analysis and citation

Answer-First Content FormatPrešlo

First paragraph: 59 words — good content density above the fold

Semantic HTML StructurePrešlo

4/6 semantic elements: <article>, <nav>, <header>, <footer>

Entity Clarity & Brand SignalsPrešlo

OG tags complete + 2 sameAs links: Facebook, YouTube

Statistics & Data PresencePrešlo

45 data points found — strong citation magnet

Common Question CoveragePrešlo

Answers 4/5 key shopper questions: price, shipping, availability, payment

Knowledge Graph ReadinessPrešlo

3/4 entity signals — strong Knowledge Graph presence

Content-to-Boilerplate RatioPrešlo

Semantic content containers found

Heureka Ověřeno WidgetPrešlo

Heureka trust widget detected

Prečo je to dôležité: Heureka Ověřeno is the dominant SK/CZ social-proof program. Verified shops with a public obchody.heureka.* profile show stronger long-term provenance than just a widget script.

llms.txt (AI Site Descriptor)Info

Not present — not required for AI visibility

Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.

Ako opraviť: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

llms-full.txt (Complete AI Content)Info

Not present — not required for AI visibility

Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

Product Schema CompletenessInfo

No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit

Prečo je to dôležité: Product schema only belongs on product pages, so its absence on this page is expected — not a defect. Scan a product URL to evaluate it.

Ako opraviť: To audit Product schema, run the scan on a product detail URL. On product pages add: name, description, image, offers (price, priceCurrency, availability), brand, sku, aggregateRating.

Reviews & Ratings SchemaInfo

No review schema on this homepage — review/rating schema typically lives on product pages

Prečo je to dôležité: Review schema is product-page-specific, so its absence here is expected, not a defect.

Ako opraviť: Scan a product URL to audit review schema. On product pages add AggregateRating (ratingValue, reviewCount, bestRating) and individual Review schemas.

AI Plugin ManifestInfo

Not present — not required (the ChatGPT-plugins manifest was retired in 2024)

Prečo je to dôležité: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.

Speakable Content (Voice AI)Info

Not present — optional; SpeakableSpecification has limited assistant adoption

ai.txt (AI Permissions)Info

Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt

Prečo je to dôležité: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.

Agent-Commerce ReadinessInfo

73/100 — čiastočne pripravené (Prístup 100 · Porozumenie 75 · Objaviteľnosť 67 · Transakcia 50)

Prečo je to dôležité: Či dokáže autonómny nákupný AI agent (ChatGPT operator, Perplexity, budúce agentické asistenty) na vašom obchode: prísť dnu, prečítať a porozumieť produktom, objaviť celý katalóg a konať (kôš, podmienky). Toto meria málokto — a pre SK/CZ shopy nikto. Skóre spája AI-bot prístup, Product schema, produktové feedy (Merchant/Heureka/Zboží), WebMCP a nákupné podmienky do jedného agent-first pohľadu. Nadväzuje na pripravovaný verejný MCP konektor ("naskenuj tento obchod").

Agent: Prístup — dostane sa agent dnuInfo

100/100 (2 signály/-ov)

Agent: Porozumenie — rozumie produktomInfo

75/100 (2 signály/-ov)

Agent: Objaviteľnosť — nájde celý katalógInfo

67/100 (3 signály/-ov)

Agent: Transakcia — vie konať (kôš/podmienky)Info

50/100 (3 signály/-ov)

GDPR

63/100

Váha: 10% · 6 OK · 9 upozornení · 1 chýb · spolu 17

Consumer Dispute Resolution LinksZlyhalo

No EU ODR platform or supervisory-authority link found

Prečo je to dôležité: EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach.

Ako opraviť: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.

Nariadenie (EÚ) 524/2013 (ODR) · Smernica 2013/11/EÚ (ADR) · SK zák. 391/2015 Z.z. · CZ zák. 634/1992 Sb. § 14

Cookie PolicyUpozornenie

Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.

Data Encryption (No Mixed Content)Upozornenie

Prečo je to dôležité: Mixed content means some data is transmitted unencrypted. This violates GDPR's data security requirements and triggers browser 'Not Secure' warnings that hurt conversions.

Ako opraviť: Replace all http:// resource URLs with https://. Check images, scripts, stylesheets, and iframes. GDPR Article 32 requires 'appropriate technical measures' including encryption.

Right to Erasure (Data Deletion)Upozornenie

Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.

Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Newsletter ConsentUpozornenie

Newsletter signup found without visible consent checkbox

Prečo je to dôležité: GDPR requires 'freely given, specific, informed' consent for marketing emails. A newsletter form without explicit opt-in violates Article 7, and pre-checked boxes are not valid consent.

Ako opraviť: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.

Withdrawal of Consent MechanismUpozornenie

Prečo je to dôležité: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.

Ako opraviť: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.

Age VerificationUpozornenie

Age-restricted content detected without age gate

Prečo je to dôležité: EU member states require age verification for age-restricted products. German JuSchG (Youth Protection Act) and similar laws mandate age gates. Missing them risks regulatory action and marketplace delisting.

Ako opraviť: Implement age verification for alcohol, tobacco, gambling, or adult content. Use a date-of-birth check or age confirmation modal before accessing the site.

Omnibus Price Disclosure (30-day low)Upozornenie

Discounts shown without a visible 'lowest price in last 30 days' reference

Prečo je to dôležité: The EU Omnibus Directive (2019/2161), enacted in SK as zák. 108/2024 and CZ via zák. 634/1992, makes the 30-day reference price MANDATORY on every advertised discount. ŠOI/ČOI actively inspect for missing disclosures — and a '−40%' off an inflated base is exactly what they target.

Ako opraviť: Whenever you advertise a price reduction, display the lowest price applied in the 30 days before the discount, next to the new price. In PrestaShop add a 30-day price-history anchor (e.g. our zu_pricehistory module) so every sale label is compliant automatically.

Withdrawal & Complaints PolicyUpozornenie

Missing: right of withdrawal (odstúpenie od zmluvy)

Prečo je to dôležité: The Consumer Rights Directive (2011/83/EU) and SK zák. 108/2024 / CZ zák. 89/2012 require pre-contractual disclosure of the 14-day withdrawal right and an accessible complaints procedure. Missing them extends customers' cancellation rights and is a standard ŠOI/ČOI finding.

Ako opraviť: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.

Online Withdrawal FunctionUpozornenie

No online withdrawal function or withdrawal information detected

Prečo je to dôležité: Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually.

Ako opraviť: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.

Tracking Scripts & ConsentPrešlo

No tracking scripts detected

Privacy Policy PagePrešlo

/clanky/ochrana-osobnych-udajov/

Legal Contact / Imprint PagePrešlo

/clanky/o-nas/

Terms & Conditions PagePrešlo

/clanky/hlavne-obchodne-podmienky/

Third-party Data SharingPrešlo

2 third-party domain(s)

Data Protection Officer ContactPrešlo

DPO / data protection contact found

Cookie Consent Banner (CMP)Info

No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)

Prečo je to dôležité: EU regulators enforce cookie consent (CNIL fined Google €150M). If the CMP is GTM-injected this scan can't confirm it — verify manually.

Ako opraviť: Confirm a consent management platform actually loads and blocks non-essential cookies until opt-in. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.

Vulnerability

62/100

Váha: 10% · 7 OK · 5 upozornení · 3 chýb · spolu 15

Form CSRF ProtectionZlyhalo

6 form(s) without CSRF tokens

Prečo je to dôležité: CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.

Ako opraviť: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.

Payment Page SecurityZlyhalo

Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection

Prečo je to dôležité: Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.

Ako opraviť: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.

Clickjacking on Sensitive PageZlyhalo

Prečo je to dôležité: Clickjacking on payment/login pages is a high-severity vulnerability. Users unknowingly submit credentials or payments through invisible iframes. PCI DSS requires frame-busting on payment pages.

Ako opraviť: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.

X-Powered-By HeaderUpozornenie

ASP.NET

Prečo je to dôležité: "ASP.NET" reveals your server technology and version. Attackers use this to find matching CVEs.

Ako opraviť: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').

DMARC Policy (Email Auth)Upozornenie

DMARC set to p=none (monitoring only, no enforcement)

Prečo je to dôležité: DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes.

Ako opraviť: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.

DKIM Signing (Email Auth)Upozornenie

Prečo je to dôležité: DKIM cryptographically signs outgoing email to prove it comes from your domain. Without DKIM, email providers downgrade trust score — transactional emails land in spam. Gmail and Yahoo require DKIM since 2024 for bulk senders.

Ako opraviť: Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.

Mixed Content ResourcesUpozornenie

2 HTTP resource(s) on HTTPS page

Prečo je to dôležité: Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site.

Ako opraviť: Replace HTTP URLs with HTTPS: http://cdn.4home.cz/8885b095-2506-4278-8f4c-c19ade2f7604/b2b.png, http://obchody.heureka.sk/4home-sk/recenze

Login Form SecurityUpozornenie

Prečo je to dôležité: NIST guidelines recommend allowing password autofill. Blocking it forces users to choose weak, memorable passwords — a leading cause of credential compromise.

Ako opraviť: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.

CMS Version DisclosurePrešlo

No generator tag — CMS identity hidden

Sensitive Files ExposedPrešlo

.env, .git, composer.json — all properly blocked

Install Script ExposedPrešlo

No /install/ or /setup/ paths accessible

Directory ListingPrešlo

Disabled — file structure hidden

Admin Panel at Default URLPrešlo

Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)

Debug Mode / Error ExposurePrešlo

No debug indicators found in page output

SPF Record (Email Security)Prešlo

SPF configured: v=spf1 a mx include:_spf.mail4eshop.com include:_spf.quanti.cz include:Spf.prote

Accessibility

36/100

Váha: — · 3 OK · 2 upozornení · 3 chýb · spolu 9

Image Alt TextZlyhalo

1077 of 1307 images have no alt attribute

Prečo je to dôležité: Images without alt text are invisible to blind users and to Google Images. EN 301 549 § 9.1.1.1 (WCAG 1.1.1) requires a text alternative.

Ako opraviť: Add descriptive alt text to every meaningful image; use alt="" for decorative ones.

Heading StructureZlyhalo

The page has no <h1> heading

Prečo je to dôležité: Screen-reader users navigate by headings; a missing outline forces linear reading. EN 301 549 § 9.1.3.1 / 9.2.4.6 (WCAG 1.3.1 / 2.4.6).

Ako opraviť: Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.

Landmark RegionsZlyhalo

No <main> landmark region found

Prečo je to dôležité: Landmarks let assistive-tech users jump straight to the main content and skip repeated navigation. EN 301 549 § 9.1.3.1 (WCAG 1.3.1).

Ako opraviť: Wrap the primary content in <main> and use <nav>, <header>, <footer> for regions.

Form LabelsUpozornenie

5 of 225 form inputs missing a label

Prečo je to dôležité: Inputs without a programmatic label are inaccessible to assistive technology (WCAG 1.3.1 / EN 301 549 § 9.1.3.1).

Ako opraviť: Add a <label for> or aria-label to the remaining inputs.

Skip LinkUpozornenie

No skip-to-content link detected

Prečo je to dôležité: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).

Ako opraviť: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.

Page LanguagePrešlo

<html lang="sk"> is set

Link TextPrešlo

Links use descriptive text

Zoom & ScalingPrešlo

Pinch-zoom is not disabled

EAA Legal BasisInfo

In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.

Ďalšie kroky

Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/4home.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk