Below Average

Score Report

andreashop.sk

Scanned on July 28, 2026

Unknown
jQuery
Font Awesome
Swiper
reCAPTCHA
Nginx
Last scanned: July 28, 2026
AI verdict

Your site has fundamental security and accessibility issues. Prioritize adding HTTPS protection (HSTS) across all pages. On the bright side, your SEO and GDPR compliance are solid.

Action plan

Fix these 3 things first

Sorted by score impact — each fix moves your overall grade up.

+18potential gain

Performance

Weight: 25% · 4 passed · 10 warnings · 2 failed · 1 SPA (verify manually)

What we found: 4.1 MB, 334 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Evidence:PSI-lab· Confidence: high
Get Performance Optimization →

What we found: 1109 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 1109 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Evidence:PSI-lab· Confidence: low

What we found: 2.61s (good: <2.5s) — Core Web Vital

Why it matters: LCP is a Core Web Vital that directly impacts Google rankings. Sites failing LCP are demoted in search results. The most common cause of slow LCP is unoptimized hero images.

How to fix: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: 560ms (good: <200ms)

Why it matters: TBT measures how long the main thread is blocked. During this time, clicks and taps don't respond — your store feels frozen. This directly impacts perceived quality.

How to fix: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: 3.56s (good: <3.4s)

Why it matters: Speed Index captures the overall visual loading experience. A slow Speed Index means users watch content load piece by piece instead of seeing a complete page.

How to fix: Speed Index measures visual completeness over time. Improve it by: prioritizing above-fold content, preloading critical resources, and minimizing render-blocking assets.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: 606 images without lazy loading

Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.

How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: no-store, no-cache, must-revalidate

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Evidence:HTTP-header· Confidence: high
Request quote for speed audit

What we found: Only 43% of 7 scripts use async/defer

Why it matters: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.

How to fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
Evidence:HTML-heuristic· Confidence: high

What we found: 7 CSS files loaded

Why it matters: Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load.

How to fix: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
Evidence:HTML-heuristic· Confidence: high

What we found: 7 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: 4 external domains without preconnect

Why it matters: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

How to fix: Add <link rel='preconnect'> for key third-party domains: sub3.tpd.sk, www.google.com, cdn.luigisbox.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Evidence:PSI-lab· Confidence: high

12 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Your store is losing customers every day. The issues above are costing you sales.

Critical score — request an expert audit

Hands-on review by our team: we identify root causes, prioritize fixes, and hand you an action plan. We'll send a tailored quote within 48h.

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách
59/100
Grade D
andreashop.sk
Dátum auditu: July 28, 2026
Online report: https://score.zulien.sk/r/andreashop.sk
Vygenerované 29. 7. 2026 11:11:23 · score.zulien.sk · by Zulien

Executive summary

22
Chýb
63
Upozornení
53
OK
154
Spolu kontrol

Skóre po kategóriách

KategóriaSkóreVáhaChybyUpozorneniaOK
Performance58/10025%2104
SEO73/10020%3614
Security53/10015%396
Mobile58/10010%2114
AI Readiness58/10010%61410
GDPR74/10010%055
Vulnerability59/10010%358
Accessibility33/100—332

Kritické zistenia

Total Page Weight· Performance
Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
Unused Code (CSS + JS)· Performance
Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
H1 Heading· SEO
The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords.
Open Graph Tags· SEO
Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
Semantic HTML Structure· SEO
Without semantic structure, search engines treat your page as an undifferentiated blob of content. Semantic HTML is essential for featured snippets, voice search, and AI-powered search.
HSTS (Strict-Transport-Security)· Security
Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Content-Security-Policy (CSP)· Security
CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
Clickjacking Protection· Security
Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
Form Input Labels (WCAG 3.3.2)· Mobile
EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.
Link Text Quality (WCAG 2.4.4)· Mobile
Nadmerný počet vágnych odkazov porušuje WCAG 2.4.4 (accessibility) aj SEO best practices (Google používa anchor text pre pochopenie cieľovej stránky). EAA 2026 compliance riziko.
Organization Schema + Entity Linking· AI Readiness
Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
Heading Hierarchy for AI· AI Readiness
AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Performance

58/100
Váha: 25% · 4 OK · 10 upozornení · 2 chýb · spolu 17
Total Page WeightZlyhalo
4.1 MB, 334 requests — too heavy!
Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Unused Code (CSS + JS)Zlyhalo
1109 KB wasted on unused code!
Prečo je to dôležité: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
Ako opraviť: You're loading 1109 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Largest Contentful Paint (LCP)Upozornenie
2.61s (good: <2.5s) — Core Web Vital
Prečo je to dôležité: LCP is a Core Web Vital that directly impacts Google rankings. Sites failing LCP are demoted in search results. The most common cause of slow LCP is unoptimized hero images.
Ako opraviť: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.
Total Blocking Time (TBT)Upozornenie
560ms (good: <200ms)
Prečo je to dôležité: TBT measures how long the main thread is blocked. During this time, clicks and taps don't respond — your store feels frozen. This directly impacts perceived quality.
Ako opraviť: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.
Speed IndexUpozornenie
3.56s (good: <3.4s)
Prečo je to dôležité: Speed Index captures the overall visual loading experience. A slow Speed Index means users watch content load piece by piece instead of seeing a complete page.
Ako opraviť: Speed Index measures visual completeness over time. Improve it by: prioritizing above-fold content, preloading critical resources, and minimizing render-blocking assets.
Resource Hints (Preload/Preconnect)Upozornenie
Prečo je to dôležité: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.
Ako opraviť: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
Lazy LoadingUpozornenie
606 images without lazy loading
Prečo je to dôležité: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.
Ako opraviť: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
Cache-Control StrategyUpozornenie
no-store, no-cache, must-revalidate
Prečo je to dôležité: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.
Ako opraviť: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Script Loading StrategyUpozornenie
Only 43% of 7 scripts use async/defer
Prečo je to dôležité: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.
Ako opraviť: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
CSS File CountUpozornenie
7 CSS files loaded
Prečo je to dôležité: Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load.
Ako opraviť: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
Critical CSS StrategyUpozornenie
7 CSS files without critical CSS extraction
Prečo je to dôležité: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.
Ako opraviť: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Connection Hint CoverageUpozornenie
4 external domains without preconnect
Prečo je to dôležité: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.
Ako opraviť: Add <link rel='preconnect'> for key third-party domains: sub3.tpd.sk, www.google.com, cdn.luigisbox.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Server Response Time (TTFB)Prešlo
127ms
First Contentful Paint (FCP)Prešlo
1.03s
Cumulative Layout Shift (CLS)Prešlo
0.000 — Core Web Vital ✓
Text Compression (gzip/brotli)Prešlo
All text resources properly compressed
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Kategória 1 / 8 · andreashop.sk · Zulien Score

SEO

73/100
Váha: 20% · 14 OK · 6 upozornení · 3 chýb · spolu 24
H1 HeadingZlyhalo
Prečo je to dôležité: The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords.
Ako opraviť: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
Open Graph TagsZlyhalo
Prečo je to dôležité: Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
Ako opraviť: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
Semantic HTML StructureZlyhalo
1/6 semantic elements — poor structure
Prečo je to dôležité: Without semantic structure, search engines treat your page as an undifferentiated blob of content. Semantic HTML is essential for featured snippets, voice search, and AI-powered search.
Ako opraviť: Your page lacks semantic HTML5 elements. Replace generic <div> wrappers with <header>, <nav>, <main>, <article>, <aside>, and <footer> to give search engines and screen readers proper content signals.
Image Format OptimizationUpozornenie
0% next-gen formats — 215 JPEG, 105 PNG images
Prečo je to dôležité: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.
Ako opraviť: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
Canonical URL ConsistencyUpozornenie
Canonical points to different URL: https://www.andreashop.sk/
Prečo je to dôležité: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.
Ako opraviť: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
Deep Heading HierarchyUpozornenie
No H3 subheadings for long content
Prečo je to dôležité: Deep heading hierarchies (H2→H3→H4) help Google build a content outline. Pages with three or more heading levels rank for more keywords than flat-structured pages.
Ako opraviť: Add H3 subheadings under your H2 sections to create a deeper content hierarchy. This helps search engines understand sub-topics and improves featured snippet eligibility.
Empty/Dead LinksUpozornenie
22 dead links (14 empty, 6 hash-only, 2 javascript:void)
Prečo je to dôležité: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.
Ako opraviť: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
Accessibility FundamentalsUpozornenie
2/4 a11y signals — missing: ARIA labels, skip navigation link
Prečo je to dôležité: The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO, as Google treats it as a ranking signal.
Ako opraviť: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
Image Dimension AttributesUpozornenie
Only 0% of images have width/height attributes
Prečo je to dôležité: Missing image dimensions are a leading cause of Cumulative Layout Shift. Google uses CLS as a Core Web Vital ranking factor.
Ako opraviť: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
Meta TitlePrešlo
50 chars — "Andreashop - Internetový obchod pre Vašu domácnosť"
Meta DescriptionPrešlo
158 chars
Content Structure (H2 Headings)Prešlo
2 H2 subheadings found
Twitter/X CardsPrešlo
Card type: summary_large_image
Canonical URLPrešlo
https://www.andreashop.sk/
Structured Data (JSON-LD)Prešlo
3 block(s): WebSite, SearchAction, BreadcrumbList
JSON-LD ValidityPrešlo
3 block(s) parse cleanly
robots.txtPrešlo
Present, references sitemap
XML SitemapPrešlo
Found with ~10+ URLs
HTML Language AttributePrešlo
lang="sk"
Image Alt AttributesPrešlo
99% of 606 images have alt text
FaviconPrešlo
Favicon detected
Content DepthPrešlo
2685 words — sufficient content
Internal LinkingPrešlo
133 internal links — strong site navigation
Text-to-HTML RatioInfo
3% ratio but 2685 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.
Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.
Kategória 2 / 8 · andreashop.sk · Zulien Score

Security

53/100
Váha: 15% · 6 OK · 9 upozornení · 3 chýb · spolu 18
HSTS (Strict-Transport-Security)Zlyhalo
Prečo je to dôležité: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Ako opraviť: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
Content-Security-Policy (CSP)Zlyhalo
Prečo je to dôležité: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
Ako opraviť: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
Clickjacking ProtectionZlyhalo
Prečo je to dôležité: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
Ako opraviť: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
DNSSECUpozornenie
No DNSKEY records — zone is unsigned
Prečo je to dôležité: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.
Ako opraviť: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
CAA DNS RecordUpozornenie
No CAA records — any CA can issue certificates for this domain
Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
X-Content-Type-OptionsUpozornenie
Prečo je to dôležité: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.
Ako opraviť: Add header: X-Content-Type-Options: nosniff
Permissions-PolicyUpozornenie
Prečo je to dôležité: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.
Ako opraviť: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
Cookie Security FlagsUpozornenie
1 cookie(s): 1 missing Secure, 1 missing SameSite
Prečo je to dôležité: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.
Ako opraviť: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
Subresource Integrity (SRI)Upozornenie
Only 0/6 SRI-eligible third-party scripts have integrity hashes (1 auto-updating provider script(s) excluded — SRI not applicable)
Prečo je to dôležité: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.
Ako opraviť: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
security.txt (RFC 9116)Upozornenie
Prečo je to dôležité: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.
Ako opraviť: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
CDN / WAF ProtectionUpozornenie
Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.
Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
Iframe SandboxingUpozornenie
15/15 unknown iframe(s) without sandbox attribute
Prečo je to dôležité: Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS.
Ako opraviť: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
SSL/TLS CertificatePrešlo
Valid HTTPS connection established
HTTP → HTTPS RedirectPrešlo
HTTP properly redirects to HTTPS
Referrer-PolicyPrešlo
no-referrer-when-downgrade
Technology DisclosurePrešlo
Server: nginx (no version)
Server Version DisclosurePrešlo
Nginx — version hidden
Password Field SecurityPrešlo
1 password field(s) — allow password manager autofill
Kategória 3 / 8 · andreashop.sk · Zulien Score

Mobile

58/100
Váha: 10% · 4 OK · 11 upozornení · 2 chýb · spolu 17
Form Input Labels (WCAG 3.3.2)Zlyhalo
Iba 1/7 inputs má label (14%)
Prečo je to dôležité: EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.
Ako opraviť: 6 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
Link Text Quality (WCAG 2.4.4)Zlyhalo
220/992 odkazov (22%) má vágny text
Prečo je to dôležité: Nadmerný počet vágnych odkazov porušuje WCAG 2.4.4 (accessibility) aj SEO best practices (Google používa anchor text pre pochopenie cieľovej stránky). EAA 2026 compliance riziko.
Ako opraviť: Vysoké % generických odkazov ('click here', 'read more', 'tu', 'viac'). Každý odkaz musí byť pochopiteľný mimo kontextu — 'Detail produktu Zimná bunda' namiesto len 'Detail'.
Mobile Performance ScoreUpozornenie
53/100 (target: 90+)
Prečo je to dôležité: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.
Ako opraviť: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
Touch Target SizeUpozornenie
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Prečo je to dôležité: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityUpozornenie
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
Theme ColorUpozornenie
Prečo je to dôležité: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
Ako opraviť: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Mobile Navigation (Semantic)Upozornenie
Prečo je to dôležité: Semantic <nav> elements are essential for mobile accessibility. Screen readers use them to let users jump directly to navigation — critical on small screens where content is long.
Ako opraviť: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').
Responsive Images (srcset)Upozornenie
606 images without responsive sizing
Prečo je to dôležité: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.
Ako opraviť: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
Form Input TypesUpozornenie
phone fields use type='text' instead of type='tel'
Prečo je to dôležité: Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors and speeds up form completion.
Ako opraviť: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
Mobile Sticky CTAUpozornenie
Add-to-cart button found but no sticky/fixed positioning detected
Prečo je to dôležité: Mobile users scroll extensively. A sticky add-to-cart bar keeps the primary action visible. Without it, users must scroll back up to purchase — many won't.
Ako opraviť: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.
Text Overflow HandlingUpozornenie
No word-break/overflow-wrap CSS detected
Prečo je to dôležité: Long strings without word-break cause horizontal overflow on mobile — a common cause of 'content wider than viewport' failures. Compound words and URLs are frequent culprits.
Ako opraviť: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
Express Checkout (Apple Pay + Google Pay)Upozornenie
Iba Apple Pay detekovaný — chýba Google Pay
Prečo je to dôležité: iOS/Android majú 50/50 share. Jeden bez druhého znamená stratený revenue na polovici mobilných používateľov.
Ako opraviť: Pridaj Google Pay cez Stripe, Adyen alebo Mollie. Mobile conversion rate rastie keď je express checkout dostupný.
Heading Hierarchy (WCAG 1.3.1)Upozornenie
Preskočené úrovne: h2→h4
Prečo je to dôležité: Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené.
Ako opraviť: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
Viewport ConfigurationPrešlo
width=device-width, initial-scale=1
Content Fits ViewportPrešlo
No horizontal scrolling needed
Responsive Design TechniquesPrešlo
Media queries detected
Payment Methods DetectedPrešlo
1 method(s): Apple Pay
Kategória 4 / 8 · andreashop.sk · Zulien Score

AI Readiness

58/100
Váha: 10% · 10 OK · 14 upozornení · 6 chýb · spolu 39
Organization Schema + Entity LinkingZlyhalo
Prečo je to dôležité: Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
Ako opraviť: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
Heading Hierarchy for AIZlyhalo
0 H1, 2 H2, 0 H3 — poor structure
Prečo je to dôležité: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.
Ako opraviť: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
Semantic HTML StructureZlyhalo
Prečo je to dôležité: Without semantic HTML, AI must guess content boundaries. This leads to navigation text mixed into product descriptions, footer content cited as main content, and overall poor AI understanding of your pages.
Ako opraviť: Replace <div> wrappers with: <header> (site header), <nav> (navigation), <main> (primary content), <article> (self-contained content), <aside> (sidebar), <footer>. This is the foundation of AI-readable HTML.
Content Freshness SignalsZlyhalo
Prečo je to dôležité: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
Ako opraviť: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
Entity Clarity & Brand SignalsZlyhalo
Prečo je to dôležité: AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.
Ako opraviť: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
Image Alt Text Quality for AIZlyhalo
Only 45% quality alt text — 3 missing, 330 poor
Prečo je to dôležité: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.
Ako opraviť: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
Structured Data FoundationUpozornenie
2 distinct schema types (WebSite, BreadcrumbList) — add more for comprehensive AI coverage
Prečo je to dôležité: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite.
Ako opraviť: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
FAQ Schema (Direct AI Answers)Upozornenie
Prečo je to dôležité: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Answer-First Content FormatUpozornenie
Content doesn't start with a strong summary paragraph
Prečo je to dôležité: AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often.
Ako opraviť: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
Structured Content (Lists & Tables)Upozornenie
25 lists found — consider adding comparison tables
Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.
Ako opraviť: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
Author Expertise Signals (E-E-A-T)Upozornenie
Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.
Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Extractable Answer BlocksUpozornenie
4 paragraphs, avg 8 words — too short for citation
Prečo je to dôležité: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.
Ako opraviť: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
Section Length OptimizationUpozornenie
Avg section: 437 words — only 0% in 80-200 word optimal range
Prečo je to dôležité: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsUpozornenie
Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.
Ako opraviť: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
Canonical Tag for AI DeduplicationUpozornenie
Canonical points to different URL: https://www.andreashop.sk/
Prečo je to dôležité: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.
Ako opraviť: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
Knowledge Graph ReadinessUpozornenie
1/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema
Prečo je to dôležité: @id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity.
Ako opraviť: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
Content Readability for AIUpozornenie
Grade 15 — too complex for broad AI citation (technical threshold: 14)
Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.
Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Expert Quotations & CitationsUpozornenie
Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.
Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
WebMCP Agentic ReadinessUpozornenie
Prečo je to dôležité: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
Content-to-Boilerplate RatioUpozornenie
No <main> or <article> elements — AI can't isolate content from boilerplate
Prečo je to dôležité: Without semantic containers, AI crawlers must guess where content starts and navigation ends. This leads to poor content extraction and fewer citations.
Ako opraviť: Add <main> around your primary content and <article> around self-contained content blocks. This creates clear boundaries for AI content extraction.
AI Bot Access PolicyPrešlo
No AI bot restrictions (allowed by default)
Content Accessibility for AIPrešlo
2685 words in raw HTML (2.9% text ratio) — readable by AI crawlers without executing JS
Breadcrumb SchemaPrešlo
BreadcrumbList structured data found — clear navigation hierarchy
Site Search Schema (SearchAction)Prešlo
WebSite SearchAction configured — AI can search your store
Content Depth for AIPrešlo
2685 words — rich content for AI analysis and citation
Heureka XML FeedPrešlo
775+ items at /heureka.xml — all required fields present
Heureka Feed Quality (sampled)Prešlo
EAN 100% · IMG 100% · DESC 100% · 31 cat · 0.1–699 € (n=50)
Prečo je to dôležité: Heureka uses EAN to match items to its master catalog. 90%+ EAN and image coverage means your items rank in price comparisons rather than as orphan listings.
Statistics & Data PresencePrešlo
17 data points found — strong citation magnet
Common Question CoveragePrešlo
Answers 5/5 key shopper questions: price, shipping, returns/refunds, availability, payment
Internal Link DensityPrešlo
50 contextual internal links per 1,000 words — strong knowledge graph signal
llms.txt (AI Site Descriptor)Info
Not present — not required for AI visibility
Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.
Ako opraviť: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Prečo je to dôležité: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Social Proof (Testimonials / Case Studies)Info
None detected. For a non-commercial/informational site, testimonials and case studies are optional
Prečo je to dôležité: Client testimonials and 'trusted by' logos are a B2B sales-cycle lever. A non-profit, club, or informational site isn't selling a service, so their absence isn't a credibility gap — hence informational, not scored.
Ako opraviť: Optional: member stories, event photos/recaps, partner logos, or press mentions build trust and give AI assistants more to cite about your organisation — but they don't gate credibility the way they do for a B2B vendor.
Agent-Commerce ReadinessInfo
69/100 — čiastočne pripravené (Prístup 100 · Porozumenie 25 · Objaviteľnosť 100 · Transakcia 50)
Prečo je to dôležité: Či dokáže autonómny nákupný AI agent (ChatGPT operator, Perplexity, budúce agentické asistenty) na vašom obchode: prísť dnu, prečítať a porozumieť produktom, objaviť celý katalóg a konať (kôš, podmienky). Toto meria málokto — a pre SK/CZ shopy nikto. Skóre spája AI-bot prístup, Product schema, produktové feedy (Merchant/Heureka/Zboží), WebMCP a nákupné podmienky do jedného agent-first pohľadu. Nadväzuje na pripravovaný verejný MCP konektor ("naskenuj tento obchod").
Agent: Prístup — dostane sa agent dnuInfo
100/100 (2 signály/-ov)
Agent: Porozumenie — rozumie produktomInfo
25/100 (2 signály/-ov)
Agent: Objaviteľnosť — nájde celý katalógInfo
100/100 (3 signály/-ov)
Agent: Transakcia — vie konať (kôš/podmienky)Info
50/100 (1 signál)
Kategória 5 / 8 · andreashop.sk · Zulien Score

GDPR

74/100
Váha: 10% · 5 OK · 5 upozornení · 0 chýb · spolu 13
Cookie PolicyUpozornenie
Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
Legal Contact / Imprint PageUpozornenie
Prečo je to dôležité: In DACH countries, a missing Impressum can trigger fines and competitor cease-and-desist letters. For all EU stores, identifying the data controller is a GDPR Article 13 requirement.
Ako opraviť: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
International Data TransfersUpozornenie
1 US-based tracker(s) without consent: Google Analytics/GTM
Prečo je to dôležité: The EU-US Data Privacy Framework covers some transfers, but loading US trackers without consent remains a violation. Austrian and French DPAs have ruled Google Analytics non-compliant without proper safeguards.
Ako opraviť: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
Right to Erasure (Data Deletion)Upozornenie
Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Withdrawal of Consent MechanismUpozornenie
Prečo je to dôležité: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.
Ako opraviť: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
Privacy Policy PagePrešlo
https://policies.google.com/privacy?hl=sk
Terms & Conditions PagePrešlo
/obchodne-podmienky-a274
Data Encryption (No Mixed Content)Prešlo
All resources loaded over HTTPS
Third-party Data SharingPrešlo
4 third-party domain(s)
Data Protection Officer ContactPrešlo
DPO / data protection contact found
Cookie Consent Banner (CMP)Info
No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)
Prečo je to dôležité: EU regulators enforce cookie consent (CNIL fined Google €150M). If the CMP is GTM-injected this scan can't confirm it — verify manually.
Ako opraviť: Confirm a consent management platform actually loads and blocks non-essential cookies until opt-in. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Tracking Scripts & ConsentInfo
1 tracker(s) detected (Google Analytics/GTM); no CMP visible in server HTML but GTM is present
Prečo je to dôležité: Loading tracking before consent is a direct GDPR/ePrivacy violation, but GTM-managed consent gating isn't visible server-side — verify in the browser.
Ako opraviť: Confirm these trackers are gated behind consent (GTM consent mode / CMP script blocking) before they fire. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Google Consent Mode v2Info
No Consent Mode signals in server HTML, but GTM is present — Consent Mode is commonly configured inside GTM
Prečo je to dôležité: Google requires Consent Mode v2 for EU traffic since March 2024, but GTM-side configuration is invisible to a server-side HTML scan — verify manually.
Ako opraviť: Confirm Google Consent Mode v2 default state (ad_storage/analytics_storage denied) is set in your GTM container. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Kategória 6 / 8 · andreashop.sk · Zulien Score

Vulnerability

59/100
Váha: 10% · 8 OK · 5 upozornení · 3 chýb · spolu 17
Admin Panel at Default URLZlyhalo
Accessible at: /admin
Prečo je to dôležité: Default admin URLs receive thousands of automated brute-force attempts daily. Botnets target /admin, /wp-admin, /administrator relentlessly. A renamed path blocks 99% of automated attacks.
Ako opraviť: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).
Payment Page SecurityZlyhalo
Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection
Prečo je to dôležité: Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.
Ako opraviť: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
Clickjacking on Sensitive PageZlyhalo
Login/payment page without X-Frame-Options or CSP frame-ancestors
Prečo je to dôležité: Clickjacking on payment/login pages is a high-severity vulnerability. Users unknowingly submit credentials or payments through invisible iframes. PCI DSS requires frame-busting on payment pages.
Ako opraviť: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
Form CSRF ProtectionUpozornenie
37/39 forms have CSRF tokens
Prečo je to dôležité: Forms without CSRF tokens allow cross-site request forgery — an attacker's site can submit orders, change settings, or modify data on behalf of your logged-in users.
Ako opraviť: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
Cross-Origin IsolationUpozornenie
Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
Mixed Content ResourcesUpozornenie
1 HTTP resource(s) on HTTPS page
Prečo je to dôležité: Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site.
Ako opraviť: Replace HTTP URLs with HTTPS: http://www.riesenia.com/
Inline Event HandlersUpozornenie
37 inline event handlers (onclick, onmouseover, etc.)
Prečo je to dôležité: Inline event handlers are a legacy pattern that prevents Content Security Policy enforcement. They also make XSS attacks easier — injected HTML attributes can execute JavaScript immediately.
Ako opraviť: Move inline event handlers to external JavaScript files using addEventListener(). Inline handlers prevent proper CSP implementation (require 'unsafe-inline') and increase XSS attack surface.
Login Form SecurityUpozornenie
Login form blocks password manager autofill
Prečo je to dôležité: NIST guidelines recommend allowing password autofill. Blocking it forces users to choose weak, memorable passwords — a leading cause of credential compromise.
Ako opraviť: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
CMS Version DisclosurePrešlo
No generator tag — CMS identity hidden
Sensitive Files ExposedPrešlo
.env, .git, composer.json — all properly blocked
Install Script ExposedPrešlo
No /install/ or /setup/ paths accessible
Directory ListingPrešlo
Disabled — file structure hidden
Debug Mode / Error ExposurePrešlo
No debug indicators found in page output
SPF Record (Email Security)Prešlo
SPF configured: v=spf1 mx include:mailgun.org include:_spf.vshosting.cloud ip4:93.185.102.135 ip
DMARC Policy (Email Auth)Prešlo
DMARC enforced: p=quarantine
DKIM Signing (Email Auth)Prešlo
DKIM configured (selectors: default)
BIMI Brand IndicatorsInfo
Prečo je to dôležité: BIMI requires a VMC (Verified Mark Certificate) but adds your brand logo to recipient inboxes as a trust signal. Optional but high-impact for brand-focused shops.
Ako opraviť: Once DMARC is set to p=quarantine or p=reject with 100% enforcement, publish a BIMI record: v=BIMI1; l=https://yourdomain.com/logo.svg — adds your brand logo to recipient inboxes in Gmail and Yahoo.
Kategória 7 / 8 · andreashop.sk · Zulien Score

Accessibility

33/100
Váha: — · 2 OK · 3 upozornení · 3 chýb · spolu 9
Form LabelsZlyhalo
6 of 7 form inputs have no associated label
Prečo je to dôležité: Unlabelled fields leave screen-reader users guessing — search, newsletter and checkout forms become unusable. EN 301 549 § 9.1.3.1 / 9.4.1.2 (WCAG 1.3.1 / 4.1.2).
Ako opraviť: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.
Heading StructureZlyhalo
The page has no <h1> heading
Prečo je to dôležité: Screen-reader users navigate by headings; a missing outline forces linear reading. EN 301 549 § 9.1.3.1 / 9.2.4.6 (WCAG 1.3.1 / 2.4.6).
Ako opraviť: Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.
Landmark RegionsZlyhalo
No <main> landmark region found
Prečo je to dôležité: Landmarks let assistive-tech users jump straight to the main content and skip repeated navigation. EN 301 549 § 9.1.3.1 (WCAG 1.3.1).
Ako opraviť: Wrap the primary content in <main> and use <nav>, <header>, <footer> for regions.
Image Alt TextUpozornenie
7 of 606 images missing alt text
Prečo je to dôležité: Every image missing alt text is content a screen-reader user cannot access (WCAG 1.1.1 / EN 301 549 § 9.1.1.1).
Ako opraviť: Add alt text to the remaining images (alt="" for decorative ones).
Link TextUpozornenie
220 of 992 links use vague text ("click here", "read more")
Prečo je to dôležité: Screen-reader users pull links into a list; "click here" ×20 tells them nothing. EN 301 549 § 9.2.4.4 (WCAG 2.4.4).
Ako opraviť: Rewrite links to describe their destination ("View delivery options" not "click here").
Skip LinkUpozornenie
No skip-to-content link detected
Prečo je to dôležité: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).
Ako opraviť: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
Page LanguagePrešlo
<html lang="sk"> is set
Zoom & ScalingPrešlo
Pinch-zoom is not disabled
EAA Legal BasisInfo
In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
Kategória 8 / 8 · andreashop.sk · Zulien Score

Ďalšie kroky

  1. Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
  2. Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
  3. Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
  4. Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/andreashop.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk