Last scanned: October 7, 2026

C0/100

Average

Score Report

ant.sk

Scanned on October 7, 2026

PrestaShop

Nginx 1.24.0

Company:ant s.r.o.· NACE 4712

NIS2: out of scope

Risk:0/100low

Credit:A+

VAT registered

Top 13% in sector

Full company profile →

Last scanned: October 7, 2026

AI verdict

Your site performs solidly but has five critical gaps. Urgently set up DMARC email authentication and secure your payment pages. Congratulations on strong SEO and GDPR compliance.

Not subject to NIS2 cybersecurity duties.Based on NACE sector + company size, Article 21 compliance is not mandatory. Security best practices still recommended.

Supplying a NIS2-regulated company?Even outside direct scope you may inherit supply-chain duties — regulated companies cascade them to suppliers by contract (security, incident reporting, encryption). ICT and managed-service providers are in scope regardless of size.

Check supplier obligations ·Legal basis: NIS2 Art. 21 · SK 366/2024 §21 · NIS2 Art. 21(2)(d)

Action plan

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

How we rank →

Quick wins

High impact, little work. Do these first.

Bigger projects

High impact, but the fix needs planning.

+4 more

Small fixes

Lower impact, quick to do.

+10 more

Later

Lower impact and more work. Plan them once the rest is done.

+16 more

77/100

Performance

Weight: 25% · 12 passed · 3 warnings · 4 failed · 2 SPA (verify manually)

What we found: 0.298 (good: <0.1) — Core Web Vital FAILING

Why it matters: CLS >0.25 fails Core Web Vitals. Users experience constant content jumping — extremely frustrating on mobile where accidental clicks lead to unwanted purchases or page changes.

How to fix: Urgent layout stability issues. 1) Add width/height to all <img> and <video>, 2) Reserve space for ads with min-height, 3) Use font-display: swap for web fonts, 4) Don't dynamically inject content above visible area.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

What we found: 5.5 MB, 43 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Evidence:PSI-lab· Confidence: high

Get Performance Optimization →

What we found: 256 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 256 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Evidence:PSI-lab· Confidence: low

What we found: Only 0% of 1 scripts optimized — most are render-blocking

Why it matters: 1 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Evidence:HTML-heuristic· Confidence: high

Get Performance Optimization →

What we found: no-cache, private

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

Evidence:HTTP-header· Confidence: high

Request quote for speed audit

What we found: 4 CSS files loaded

Why it matters: Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load.

How to fix: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.

Evidence:HTML-heuristic· Confidence: high

What we found: Custom fonts detected without preload hints

Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

7 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

I agree to the Privacy Policy. We'll send your report and optional re-scan notifications.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report

Zulien Score

Full e-commerce audit — 50+ checks across 7 categories

79/100

Grade C

ant.sk

ant s.r.o.

Audit date: October 7, 2026

Platform: PrestaShop

NACE: 4712

Online report: https://score.zulien.sk/r/ant.sk

Executive summary

Failures

Warnings

139

Checks total

Scores by category

Category	Score	Weight	Failures	Warnings	OK
Performance	77/100	25%	4	3	12
SEO	91/100	20%	0	5	19
Security	74/100	15%	1	7	9
Mobile	80/100	10%	1	3	8
AI Readiness	71/100	10%	3	11	13
Legal & Compliance	87/100	10%	0	3	9
Vulnerability	76/100	10%	2	1	8
Accessibility / EAA	72/100	10%	1	1	6

Critical findings

Cumulative Layout Shift (CLS)· Performance

CLS >0.25 fails Core Web Vitals. Users experience constant content jumping — extremely frustrating on mobile where accidental clicks lead to unwanted purchases or page changes.

Total Page Weight· Performance

Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

Unused Code (CSS + JS)· Performance

Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Script Loading Strategy· Performance

1 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

Content-Security-Policy (CSP)· Security

CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

Form Input Labels (WCAG 3.3.2)· Mobile

The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures.

Content Freshness Signals· AI Readiness

With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

Entity Clarity & Brand Signals· AI Readiness

AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.

Image Alt Text Quality for AI· AI Readiness

Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

DMARC Policy (Email Auth)· Vulnerability

Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.

Payment Page Security· Vulnerability

Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.

Form Labels· Accessibility / EAA

Unlabelled fields leave screen-reader users guessing — search, newsletter and checkout forms become unusable. EN 301 549 § 9.1.3.1 / 9.4.1.2 (WCAG 1.3.1 / 4.1.2).

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

Quick wins (1)

High impact, little work. Do these first.

Finding	Category	Effort
DMARC Policy (Email Auth)	Vulnerability	quick fix

Bigger projects (9)

High impact, but the fix needs planning.

Finding	Category	Effort
Script Loading Strategy	Performance	about a day
Content-Security-Policy (CSP)	Security	about a day
Form Input Labels (WCAG 3.3.2)	Mobile	about a day
Image Alt Text Quality for AI	AI Readiness	about a day
Payment Page Security	Vulnerability	about a day
Form Labels	Accessibility / EAA	about a day
Cumulative Layout Shift (CLS)	Performance	project
Total Page Weight	Performance	project
Unused Code (CSS + JS)	Performance	project

Small fixes (15)

Lower impact, quick to do.

Finding	Category	Effort
Cache-Control Strategy	Performance	quick fix
Meta Title	SEO	quick fix
Open Graph Tags	SEO	quick fix
Twitter/X Cards	SEO	quick fix
Empty/Dead Links	SEO	quick fix
Broken Image Sources	SEO	quick fix
CAA DNS Record	Security	quick fix
Cookie Security Flags	Security	quick fix
Technology Disclosure	Security	quick fix
security.txt (RFC 9116)	Security	quick fix
Server Version Disclosure	Security	quick fix
Iframe Sandboxing	Security	quick fix

+3 more

Later (21)

Lower impact and more work. Plan them once the rest is done.

Finding	Category	Effort
CDN / WAF Protection	Security	about a day
Touch Target Size	Mobile	about a day
Font Size Readability	Mobile	about a day
Structured Data Foundation	AI Readiness	about a day
FAQ Schema (Direct AI Answers)	AI Readiness	about a day
Cookie Policy	Legal & Compliance	about a day
Right to Erasure (Data Deletion)	Legal & Compliance	about a day
Withdrawal of Consent Mechanism	Legal & Compliance	about a day
Mobile Performance Score	Mobile	project
Structured Content (Lists & Tables)	AI Readiness	project
Statistics & Data Presence	AI Readiness	project
Section Length Optimization	AI Readiness	project

+9 more

Performance

77/100

Weight: 25% · 12 OK · 3 warnings · 4 failures · 21 total

Cumulative Layout Shift (CLS)Failed

0.298 (good: <0.1) — Core Web Vital FAILING

Why it matters: CLS >0.25 fails Core Web Vitals. Users experience constant content jumping — extremely frustrating on mobile where accidental clicks lead to unwanted purchases or page changes.

How to fix: Urgent layout stability issues. 1) Add width/height to all <img> and <video>, 2) Reserve space for ads with min-height, 3) Use font-display: swap for web fonts, 4) Don't dynamically inject content above visible area.

Total Page WeightFailed

5.5 MB, 43 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Unused Code (CSS + JS)Failed

256 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

How to fix: You're loading 256 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Script Loading StrategyFailed

Only 0% of 1 scripts optimized — most are render-blocking

Why it matters: 1 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Cache-Control StrategyWarning

no-cache, private

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

CSS File CountWarning

4 CSS files loaded

Why it matters: Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load.

How to fix: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.

Font PreloadingWarning

Custom fonts detected without preload hints

Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Server Response Time (TTFB)Passed

24ms

First Contentful Paint (FCP)Passed

0.77s

Largest Contentful Paint (LCP)Passed

1.04s — Core Web Vital ✓

Total Blocking Time (TBT)Passed

32ms

Speed IndexPassed

0.77s

JavaScript BudgetPassed

503 KB — within the 600 KB budget

Why it matters: JavaScript is the most expensive resource on a page: it must be downloaded, parsed and executed before the page responds to input. Staying under 600 KB is what keeps mid-range phones responsive.

Request BudgetPassed

43 requests — within the budget of 80

Why it matters: Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed.

Text Compression (gzip/brotli)Passed

All text resources properly compressed

Resource Hints (Preload/Preconnect)Passed

2 preload, 2 preconnect hint(s)

Lazy LoadingPassed

63% of images use native lazy loading (36/57)

Font Loading StrategyPassed

font-display: swap

Critical CSS StrategyPassed

Critical CSS / async CSS loading detected

Third-party ServicesInfo

Not measured — PageSpeed did not return the third-party audit for this URL

Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.

How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

SEO

91/100

Weight: 20% · 19 OK · 5 warnings · 0 failures · 25 total

Meta TitleWarning

5 chars (optimal: 30-60)

Why it matters: Short titles waste valuable ranking real estate in search results.

How to fix: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.

Open Graph TagsWarning

Missing: og:description, og:image

Why it matters: Incomplete OG tags mean broken social previews. Shared links without an image get far fewer clicks on Facebook and LinkedIn.

How to fix: Add the missing OG tags: og:description, og:image. Use high-quality 1200×630px images for og:image.

Twitter/X CardsWarning

Why it matters: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.

How to fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.

Empty/Dead LinksWarning

9 dead links (8 empty, 1 hash-only, 0 javascript:void)

Why it matters: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.

How to fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.

Broken Image SourcesWarning

2 image(s) with empty src attribute

Why it matters: Empty src attributes cause extra HTTP requests to the page URL, waste bandwidth, and show broken image icons to users.

How to fix: Fix images with empty src=''. Either add proper URLs or use loading='lazy' with valid data-src for lazy-loaded images.

Meta DescriptionPassed

137 chars

H1 HeadingPassed

"Vybavujemeprofesionálov,ktorí to myslia vážne."

Content Structure (H2 Headings)Passed

13 H2 subheadings found

Canonical URLPassed

https://ant.sk

Structured Data (JSON-LD)Passed

1 block(s): Organization, ImageObject, WebSite, SearchAction

JSON-LD ValidityPassed

1 block(s) parse cleanly

robots.txtPassed

Present, references sitemap

XML SitemapPassed

Found with 587 URLs

HTML Language AttributePassed

lang="sk"

Image Alt AttributesPassed

100% of 57 images have alt text

Meta Robots TagPassed

index, follow, max-image-preview:large, max-snippet:-1

FaviconPassed

Favicon detected

Image Format OptimizationPassed

82% next-gen formats (10 WebP, 35 AVIF)

Semantic HTML StructurePassed

5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>

Content DepthPassed

1266 words — sufficient content

Deep Heading HierarchyPassed

H2: 13, H3: 16 — well-structured content

Internal LinkingPassed

36 internal links — strong site navigation

Accessibility FundamentalsPassed

3/4 a11y signals: 1 ARIA roles, 19 ARIA labels, lang="sk"

Sitemap FreshnessPassed

Newest <lastmod> 0 day(s) ago

Text-to-HTML RatioInfo

7% ratio but 1266 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content

Why it matters: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.

How to fix: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.

Security

74/100

Weight: 15% · 9 OK · 7 warnings · 1 failures · 18 total

Content-Security-Policy (CSP)Failed

Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

CAA DNS RecordWarning

No CAA records — any CA can issue certificates for this domain

Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

Cookie Security FlagsWarning

3 cookie(s): 1 missing HttpOnly

Why it matters: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.

How to fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.

Technology DisclosureWarning

Server: nginx/1.24.0 (Ubuntu)

Why it matters: Exposing exact server/PHP versions lets attackers search CVE databases for specific exploits. This is the first step in most automated attacks.

How to fix: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.

security.txt (RFC 9116)Warning

Why it matters: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.

How to fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.

Server Version DisclosureWarning

Nginx 1.24.0 exposed in headers

Why it matters: Exposing "Nginx 1.24.0" lets attackers search for version-specific exploits. Hide it to add a layer of defense.

How to fix: Hide server version. Apache: add 'ServerTokens Prod' and 'ServerSignature Off' to httpd.conf. Nginx: add 'server_tokens off;' to nginx.conf.

CDN / WAF ProtectionWarning

Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.

How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

Iframe SandboxingWarning

1/1 unknown iframe(s) without sandbox attribute

Why it matters: Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS.

How to fix: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.

SSL/TLS CertificatePassed

Valid HTTPS connection established

DNSSECPassed

Zone is DNSSEC-signed (DNSKEY published)

Why it matters: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.

HTTP → HTTPS RedirectPassed

HTTP properly redirects to HTTPS

HSTS (Strict-Transport-Security)Passed

max-age=31536000, includeSubDomains

Clickjacking ProtectionPassed

X-Frame-Options: SAMEORIGIN

X-Content-Type-OptionsPassed

nosniff

Referrer-PolicyPassed

strict-origin-when-cross-origin

Permissions-PolicyPassed

geolocation=(), microphone=(), camera=(), interest-cohort=()

Subresource Integrity (SRI)Passed

No SRI-eligible third-party scripts loaded

Cookie Prefix SecurityInfo

1 session cookie(s) already have Secure + HttpOnly + SameSite; adding the __Host- prefix is a cosmetic hardening nicety

Why it matters: With Secure, HttpOnly and SameSite already set, the prefix adds only host-only enforcement — low marginal benefit.

How to fix: Optional: rename to __Host-session (Secure; Path=/; no Domain) for defence-in-depth against subdomain cookie injection.

Mobile

80/100

Weight: 10% · 8 OK · 3 warnings · 1 failures · 12 total

Form Input Labels (WCAG 3.3.2)Failed

Only 0/1 inputs have a label (0%)

Why it matters: The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures.

How to fix: 1 input elements have no label. Every input needs a matching <label for="id">Text</label> or an aria-label. A placeholder is NOT a label (WCAG 3.3.2). On a checkout or registration form this costs conversion and breaches EN 301 549 (EAA 2026).

Mobile Performance ScoreWarning

80/100 (target: 90+)

Why it matters: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.

How to fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.

Touch Target SizeWarning

Some tappable targets are too small or too close together (Lighthouse tap-targets audit)

Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityWarning

Some text renders below the 12px legibility threshold (Lighthouse font-size audit)

Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.

How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

Viewport ConfigurationPassed

width=device-width, initial-scale=1

Content Fits ViewportPassed

No horizontal scrolling needed

Responsive Design TechniquesPassed

Flexbox, CSS Grid, Media queries detected

Theme ColorPassed

theme-color meta tag present

Mobile Navigation (Semantic)Passed

<nav> element present — proper navigation landmark

Responsive Images (srcset)Passed

80 image(s) use srcset for responsive sizing

Heading Hierarchy (WCAG 1.3.1)Passed

No skipped heading levels

Link Text Quality (WCAG 2.4.4)Passed

All links have descriptive text

AI Readiness

71/100

Weight: 10% · 13 OK · 11 warnings · 3 failures · 31 total

Content Freshness SignalsFailed

Why it matters: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

How to fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.

Entity Clarity & Brand SignalsFailed

Why it matters: AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.

How to fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.

Image Alt Text Quality for AIFailed

Only 42% quality alt text — 0 missing, 28 poor

Why it matters: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

How to fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.

Structured Data FoundationWarning

3 distinct schema types (BusinessEntity, WebSite, BreadcrumbList) — add more for comprehensive AI coverage

Why it matters: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite.

How to fix: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.

FAQ Schema (Direct AI Answers)Warning

Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.

How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Structured Content (Lists & Tables)Warning

4 lists found — consider adding comparison tables

Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.

How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.

Author Expertise Signals (E-E-A-T)Warning

Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.

How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Statistics & Data PresenceWarning

No statistical data found in content

Why it matters: Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics.

How to fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.

Section Length OptimizationWarning

Avg section: 38 words — only 11% in 80-200 word optimal range

Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.

How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Q&A Format HeadingsWarning

Why it matters: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

How to fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.

Knowledge Graph ReadinessWarning

2/4 signals — missing: consistent brand name (title/schema/OG), sameAs links (Wikipedia, LinkedIn)

Why it matters: @id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity.

How to fix: Add: consistent brand name (title/schema/OG), sameAs links (Wikipedia, LinkedIn). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.

Content Readability for AIWarning

Grade 18 — too complex for broad AI citation (technical threshold: 14)

Why it matters: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.

How to fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Expert Quotations & CitationsWarning

1 quotation found — add more for authority

Why it matters: AI assistants weight content with expert quotes and citations higher. Blockquotes signal that your content is backed by authoritative sources — a key E-E-A-T signal.

How to fix: Add expert quotes, customer testimonials, or industry citations using <blockquote> elements.

WebMCP Agentic ReadinessWarning

Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

AI Bot Access PolicyPassed

No AI bot restrictions (allowed by default)

Content Accessibility for AIPassed

1266 words in raw HTML (7.5% text ratio) — readable by AI crawlers without executing JS

Organization Schema + Entity LinkingPassed

Organization found with 1 sameAs links — strong entity identity

Breadcrumb SchemaPassed

BreadcrumbList structured data found — clear navigation hierarchy

Site Search Schema (SearchAction)Passed

WebSite SearchAction configured — AI can search your store

Content Depth for AIPassed

1266 words — rich content for AI analysis and citation

Answer-First Content FormatPassed

First paragraph: 553 words — good content density above the fold

Heading Hierarchy for AIPassed

Proper structure: 1 H1 → 13 H2s → 16 H3s — clear content outline

Semantic HTML StructurePassed

5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>

Extractable Answer BlocksPassed

27 paragraphs, avg 79 words — optimal for AI extraction

Internal Link DensityPassed

28 contextual internal links per 1,000 words — strong knowledge graph signal

Canonical Tag for AI DeduplicationPassed

Self-referencing canonical — clean signal for AI

Content-to-Boilerplate RatioPassed

88% of text in <main>/<article> — clean content signal

llms.txt (AI Site Descriptor)Info

Not present — not required for AI visibility

Why it matters: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.

How to fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

llms-full.txt (Complete AI Content)Info

Not present — not required for AI visibility

Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

ai.txt (AI Permissions)Info

Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt

Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.

Social Proof (Testimonials / Case Studies)Info

Detected: case studies / portfolio. For a non-commercial/informational site, testimonials and case studies are optional

Why it matters: Client testimonials and 'trusted by' logos are a B2B sales-cycle lever. A non-profit, club, or informational site isn't selling a service, so their absence isn't a credibility gap — hence informational, not scored.

How to fix: Optional: member stories, event photos/recaps, partner logos, or press mentions build trust and give AI assistants more to cite about your organisation — but they don't gate credibility the way they do for a B2B vendor.

Legal & Compliance

87/100

Weight: 10% · 9 OK · 3 warnings · 0 failures · 12 total

Cookie PolicyWarning

Why it matters: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

How to fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.

Right to Erasure (Data Deletion)Warning

Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.

How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Withdrawal of Consent MechanismWarning

Why it matters: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.

How to fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.

Cookie Consent Banner (CMP)Passed

Cookiebot detected

Tracking Scripts & ConsentPassed

2 tracker(s) detected with CMP: Google Analytics/GTM, Meta Pixel

Google Consent Mode v2Passed

Consent mode signals detected (ad_storage, analytics_storage)

Privacy Policy PagePassed

/gdpr

Legal Contact / Imprint PagePassed

/o-nas

Terms & Conditions PagePassed

/obchodne-podmienky

Data Encryption (No Mixed Content)Passed

All resources loaded over HTTPS

Newsletter ConsentPassed

Newsletter form with consent mechanism detected

Data Protection Officer ContactPassed

DPO / data protection contact found

Vulnerability

76/100

Weight: 10% · 8 OK · 1 warnings · 2 failures · 11 total

DMARC Policy (Email Auth)Failed

Why it matters: Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.

How to fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.

Payment Page SecurityFailed

Payment page missing: No CSP

Why it matters: Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.

How to fix: CRITICAL: Your payment page is missing security headers: No CSP. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.

Cross-Origin IsolationWarning

Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

CMS Version DisclosurePassed

No generator tag — CMS identity hidden

Sensitive Files ExposedPassed

.env, .git, composer.json — all properly blocked

Install Script ExposedPassed

No /install/ or /setup/ paths accessible

Directory ListingPassed

Disabled — file structure hidden

Admin Panel at Default URLPassed

Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)

Debug Mode / Error ExposurePassed

No debug indicators found in page output

SPF Record (Email Security)Passed

SPF configured: v=spf1 include:_spf.mailersend.net a mx include:_spf.m1.websupport.sk include:sp

DKIM Signing (Email Auth)Passed

DKIM configured (selectors: selector1, selector2)

Accessibility / EAA

72/100

Weight: 10% · 6 OK · 1 warnings · 1 failures · 9 total

Form LabelsFailed

1 of 1 form inputs have no associated label

Why it matters: Unlabelled fields leave screen-reader users guessing — search, newsletter and checkout forms become unusable. EN 301 549 § 9.1.3.1 / 9.4.1.2 (WCAG 1.3.1 / 4.1.2).

How to fix: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.

Skip LinkWarning

No skip-to-content link detected

Why it matters: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).

How to fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.

Page LanguagePassed

<html lang="sk"> is set

Image Alt TextPassed

All 57 images have alt attributes

Heading StructurePassed

Single <h1> with a consistent heading outline

Link TextPassed

Links use descriptive text

Landmark RegionsPassed

Semantic landmarks present (<main>, <nav>/<header>)

Zoom & ScalingPassed

Pinch-zoom is not disabled

EAA Legal BasisInfo

In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.

Next steps

Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/ant.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk