Average

Score Report

bcommerce.sk

Scanned on October 8, 2026

Unknown
openresty
Last scanned: October 8, 2026
AI verdict

Your site has solid foundations but needs improvements in security and online visibility. Priority: enable HTTPS and configure security headers immediately. Positive: your site is highly accessible to all users.

Action plan

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

How we rank →

Quick wins

6

High impact, little work. Do these first.

+1 more

Bigger projects

8

High impact, but the fix needs planning.

+3 more

Small fixes

12

Lower impact, quick to do.

+7 more

Later

34

Lower impact and more work. Plan them once the rest is done.

+29 more

Performance

Weight: 25% · 14 passed · 3 warnings · 0 failed · 2 SPA (verify manually)

What we found: 7 images without lazy loading

Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.

How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: no-cache, must-revalidate

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Evidence:HTTP-header· Confidence: high
Request quote for speed audit

What we found: Custom fonts detected without preload hints

Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

3 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Full e-commerce audit — 50+ checks across 7 categories
74/100
Grade C
bcommerce.sk
Audit date: October 8, 2026
Online report: https://score.zulien.sk/r/bcommerce.sk
Generated · score.zulien.sk · by Zulien

Executive summary

16
Failures
44
Warnings
57
OK
124
Checks total

Scores by category

CategoryScoreWeightFailuresWarningsOK
Performance97/10025%0314
SEO70/10020%3611
Security57/10015%366
Mobile80/10010%065
AI Readiness49/10010%6165
Legal & Compliance50/10010%244
Vulnerability91/10010%118
Accessibility / EAA71/10010%124

Critical findings

Open Graph Tags· SEO
Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
Structured Data (JSON-LD)· SEO
Pages with structured data can earn rich snippets in Google — star ratings, prices, availability — which lift click-through.
robots.txt· SEO
A misconfigured robots.txt can completely deindex your site from Google within days.
HSTS (Strict-Transport-Security)· Security
Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Content-Security-Policy (CSP)· Security
CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
Clickjacking Protection· Security
Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
AI Bot Access Policy· AI Readiness
AI search is a fast-growing product-discovery channel. Blocking the major AI crawlers cuts your store out of it entirely.
Structured Data Foundation· AI Readiness
Without structured data, your store is invisible to AI commerce. Google AI Overviews, ChatGPT Shopping, Perplexity, and Bing Copilot all rely on schema markup to understand and recommend products.
Organization Schema + Entity Linking· AI Readiness
Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
Content Freshness Signals· AI Readiness
With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
Entity Clarity & Brand Signals· AI Readiness
AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.
Image Alt Text Quality for AI· AI Readiness
Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

Quick wins (6)

High impact, little work. Do these first.

FindingCategoryEffort
Open Graph TagsSEOquick fix
robots.txtSEOquick fix
HSTS (Strict-Transport-Security)Securityquick fix
Clickjacking ProtectionSecurityquick fix
AI Bot Access PolicyAI Readinessquick fix
DMARC Policy (Email Auth)Vulnerabilityquick fix

Bigger projects (8)

High impact, but the fix needs planning.

FindingCategoryEffort
Cookie Consent Banner (CMP)Legal & Complianceabout a day
Privacy Policy PageLegal & Complianceabout a day
Structured Data (JSON-LD)SEOabout a day
Content-Security-Policy (CSP)Securityabout a day
Structured Data FoundationAI Readinessabout a day
Organization Schema + Entity LinkingAI Readinessabout a day
Image Alt Text Quality for AIAI Readinessabout a day
Landmark RegionsAccessibility / EAAabout a day

Small fixes (12)

Lower impact, quick to do.

FindingCategoryEffort
Cache-Control StrategyPerformancequick fix
Twitter/X CardsSEOquick fix
Image Dimension AttributesSEOquick fix
CAA DNS RecordSecurityquick fix
X-Content-Type-OptionsSecurityquick fix
Referrer-PolicySecurityquick fix
Permissions-PolicySecurityquick fix
security.txt (RFC 9116)Securityquick fix
Theme ColorMobilequick fix
Cross-Origin IsolationVulnerabilityquick fix
Skip LinkAccessibility / EAAquick fix
Font PreloadingPerformancequick fix

Later (34)

Lower impact and more work. Plan them once the rest is done.

FindingCategoryEffort
Lazy LoadingPerformanceabout a day
Image Format OptimizationSEOabout a day
Semantic HTML StructureSEOabout a day
Accessibility FundamentalsSEOabout a day
CDN / WAF ProtectionSecurityabout a day
Touch Target SizeMobileabout a day
Font Size ReadabilityMobileabout a day
Responsive Images (srcset)Mobileabout a day
Heading Hierarchy (WCAG 1.3.1)Mobileabout a day
FAQ Schema (Direct AI Answers)AI Readinessabout a day
Heading Hierarchy for AIAI Readinessabout a day
Semantic HTML StructureAI Readinessabout a day

+22 more

Performance

97/100
Weight: 25% · 14 OK · 3 warnings · 0 failures · 19 total
Lazy LoadingWarning
7 images without lazy loading
Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.
How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
Cache-Control StrategyWarning
no-cache, must-revalidate
Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.
How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Font PreloadingWarning
Custom fonts detected without preload hints
Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Server Response Time (TTFB)Passed
8ms
First Contentful Paint (FCP)Passed
0.73s
Largest Contentful Paint (LCP)Passed
0.73s — Core Web Vital ✓
Total Blocking Time (TBT)Passed
0ms
Cumulative Layout Shift (CLS)Passed
0.032 — Core Web Vital ✓
Speed IndexPassed
0.82s
Total Page WeightPassed
170 KB (10 requests)
Request BudgetPassed
10 requests — within the budget of 80
Why it matters: Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed.
Unused Code (CSS + JS)Passed
Only 0 KB of unused code — well optimized
Text Compression (gzip/brotli)Passed
All text resources properly compressed
Resource Hints (Preload/Preconnect)Passed
0 preload, 2 preconnect hint(s)
Font Loading StrategyPassed
font-display: swap
HTTP/3 (QUIC) SupportPassed
HTTP/3 enabled via Alt-Svc header
CSS File CountPassed
1 CSS file(s) — well consolidated
Third-party ServicesInfo
Not measured — PageSpeed did not return the third-party audit for this URL
Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.
How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Category 1 / 8 · bcommerce.sk · Zulien Score

SEO

70/100
Weight: 20% · 11 OK · 6 warnings · 3 failures · 20 total
Open Graph TagsFailed
Why it matters: Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
How to fix: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
Structured Data (JSON-LD)Failed
Why it matters: Pages with structured data can earn rich snippets in Google — star ratings, prices, availability — which lift click-through.
How to fix: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
robots.txtFailed
Blocks all crawlers!
Why it matters: A misconfigured robots.txt can completely deindex your site from Google within days.
How to fix: Your robots.txt blocks all search engines with 'Disallow: /'. Remove this line unless the site is intentionally hidden from search.
Twitter/X CardsWarning
Why it matters: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.
How to fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
Text-to-HTML RatioWarning
7% — low content density (376 words)
Why it matters: A low text-to-HTML ratio signals thin content to Google. Pages with more useful text rank higher and convert better.
How to fix: Add more unique text content. Write detailed product descriptions, buying guides, and FAQ sections.
Image Format OptimizationWarning
0% next-gen formats — 0 JPEG, 0 PNG images
Why it matters: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.
How to fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
Semantic HTML StructureWarning
Only 2/6 semantic elements — missing: <article>, <main>, <header>, <aside>
Why it matters: Semantic HTML gives search engines clear signals about content structure. Pages with proper semantic markup earn more featured snippets and knowledge panel appearances.
How to fix: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
Accessibility FundamentalsWarning
2/4 a11y signals — missing: ARIA roles, skip navigation link
Why it matters: The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO, as Google treats it as a ranking signal.
How to fix: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
Image Dimension AttributesWarning
Only 0% of images have width/height attributes
Why it matters: Missing image dimensions are a leading cause of Cumulative Layout Shift. Google uses CLS as a Core Web Vital ranking factor.
How to fix: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
Meta TitlePassed
42 chars — "B-commerce — E-commerce & distribúcia v EÚ"
Meta DescriptionPassed
131 chars
H1 HeadingPassed
"Distribúciaa e-commercev celej Európe"
Content Structure (H2 Headings)Passed
5 H2 subheadings found
Canonical URLPassed
https://bcommerce.sk/
XML SitemapPassed
Found with 6 URLs
HTML Language AttributePassed
lang="sk"
Image Alt AttributesPassed
100% of 7 images have alt text
FaviconPassed
Favicon detected
Content DepthPassed
376 words — sufficient content
Internal LinkingPassed
13 internal links — strong site navigation
Category 2 / 8 · bcommerce.sk · Zulien Score

Security

57/100
Weight: 15% · 6 OK · 6 warnings · 3 failures · 15 total
HSTS (Strict-Transport-Security)Failed
Why it matters: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
How to fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
Content-Security-Policy (CSP)Failed
Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
Clickjacking ProtectionFailed
Why it matters: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
How to fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
CAA DNS RecordWarning
No CAA records — any CA can issue certificates for this domain
Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
X-Content-Type-OptionsWarning
Why it matters: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.
How to fix: Add header: X-Content-Type-Options: nosniff
Referrer-PolicyWarning
Why it matters: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.
How to fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
Permissions-PolicyWarning
Why it matters: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.
How to fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
security.txt (RFC 9116)Warning
Why it matters: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.
How to fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
CDN / WAF ProtectionWarning
Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.
How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
SSL/TLS CertificatePassed
Valid HTTPS connection established
DNSSECPassed
Zone is DNSSEC-signed (DNSKEY published)
Why it matters: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.
HTTP → HTTPS RedirectPassed
HTTP properly redirects to HTTPS
Cookie Security FlagsPassed
No cookies set on initial response
Technology DisclosurePassed
Server: openresty (no version)
Server Version DisclosurePassed
openresty — version hidden
Category 3 / 8 · bcommerce.sk · Zulien Score

Mobile

80/100
Weight: 10% · 5 OK · 6 warnings · 0 failures · 11 total
Mobile Performance ScoreWarning
87/100 (target: 90+)
Why it matters: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.
How to fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
Touch Target SizeWarning
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityWarning
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
Theme ColorWarning
Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Responsive Images (srcset)Warning
7 images without responsive sizing
Why it matters: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.
How to fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
Heading Hierarchy (WCAG 1.3.1)Warning
Skipped levels: h2→h4
Why it matters: Skipped heading levels (h1 straight to h3) break screen-reader navigation and signal poor document structure to Google. SEO suffers too.
How to fix: Keep headings in order h1 → h2 → h3 → h4 with no skipped levels. Screen readers use the heading hierarchy to navigate. If you want smaller text at the same level, use a CSS class rather than a lower heading tag.
Viewport ConfigurationPassed
width=device-width, initial-scale=1
Content Fits ViewportPassed
No horizontal scrolling needed
Responsive Design TechniquesPassed
Flexbox, CSS Grid, Media queries detected
Mobile Navigation (Semantic)Passed
<nav> element present — proper navigation landmark
Link Text Quality (WCAG 2.4.4)Passed
All links have descriptive text
Category 4 / 8 · bcommerce.sk · Zulien Score

AI Readiness

49/100
Weight: 10% · 5 OK · 16 warnings · 6 failures · 30 total
AI Bot Access PolicyFailed
Major AI bots BLOCKED: All bots
Why it matters: AI search is a fast-growing product-discovery channel. Blocking the major AI crawlers cuts your store out of it entirely.
How to fix: Remove Disallow rules for All bots in robots.txt. These are the primary crawlers for ChatGPT Search, Claude, Perplexity, and Google AI Overviews. Without access, your store is invisible to AI-powered search.
Structured Data FoundationFailed
Why it matters: Without structured data, your store is invisible to AI commerce. Google AI Overviews, ChatGPT Shopping, Perplexity, and Bing Copilot all rely on schema markup to understand and recommend products.
How to fix: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
Organization Schema + Entity LinkingFailed
Why it matters: Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
How to fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
Content Freshness SignalsFailed
Why it matters: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
How to fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
Entity Clarity & Brand SignalsFailed
Why it matters: AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.
How to fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
Image Alt Text Quality for AIFailed
Only 0% quality alt text — 0 missing, 7 poor
Why it matters: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.
How to fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
FAQ Schema (Direct AI Answers)Warning
Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Content Depth for AIWarning
376 words — add more for better AI citations
Why it matters: AI assistants skip thin pages in favor of content-rich competitors. Aim for the depth that makes your page the definitive resource.
How to fix: Expand to 500+ words: add detailed product descriptions, use cases, benefits, specifications, comparison info, and buying guides. AI needs substantial content to summarize and cite.
Answer-First Content FormatWarning
Content doesn't start with a strong summary paragraph
Why it matters: AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often.
How to fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
Heading Hierarchy for AIWarning
Good: 1 H1 + 5 H2s, but no H3 subsections
Why it matters: AI assistants use heading hierarchy to understand content structure. A well-organized H1→H2→H3 structure is parsed more accurately than flat text.
How to fix: Add H3 subheadings under your H2 sections for deeper content structure. AI models use heading hierarchy as a table of contents to navigate and extract information.
Semantic HTML StructureWarning
2/6 elements — missing: <article>, <main>, <header>, <aside>
Why it matters: AI crawlers don't see your CSS. They rely on semantic HTML to distinguish main content from navigation, ads, and boilerplate.
How to fix: Add: <article>, <main>, <header>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
Structured Content (Lists & Tables)Warning
8 lists found — consider adding comparison tables
Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.
How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
Author Expertise Signals (E-E-A-T)Warning
Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.
How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Statistics & Data PresenceWarning
Only 1 data point(s) — add more
Why it matters: AI assistants prefer content with verifiable data points and quantified claims — they're the most quotable parts of a page.
How to fix: Add specific statistics, percentages, dollar amounts, and quantified claims. E.g., '93% of customers report...', 'saves an average of €200/year', '3x faster than...' Data makes content citable.
Section Length OptimizationWarning
Avg section: 71 words — only 25% in 80-200 word optimal range
Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsWarning
Why it matters: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.
How to fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
Knowledge Graph ReadinessWarning
1/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema
Why it matters: @id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity.
How to fix: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
Content Readability for AIWarning
Grade 19 — too complex for broad AI citation
Why it matters: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.
How to fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Expert Quotations & CitationsWarning
Why it matters: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.
How to fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
WebMCP Agentic ReadinessWarning
Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
Content-to-Boilerplate RatioWarning
No <main> or <article> elements — AI can't isolate content from boilerplate
Why it matters: Without semantic containers, AI crawlers must guess where content starts and navigation ends. This leads to poor content extraction and fewer citations.
How to fix: Add <main> around your primary content and <article> around self-contained content blocks. This creates clear boundaries for AI content extraction.
Social Proof (Testimonials / Case Studies)Warning
Only case studies / portfolio detected
Why it matters: The B2B consultancy buying cycle starts with trust verification. Testimonials, case studies, and client logos reinforce credibility, and AI summaries weight social proof when ranking expertise.
How to fix: Add visible client testimonials (<blockquote> with name/role/company), case study links, and a 'Trusted by' client logo strip. B2B buyers evaluate credibility before contact — multiple social proof signals reinforce expertise.
AI agent access (live)Passed
ChatGPT-User and PerplexityBot get the same page as a browser
Content Accessibility for AIPassed
376 words in raw HTML (6.7% text ratio) — readable by AI crawlers without executing JS
Extractable Answer BlocksPassed
9 paragraphs, avg 32 words — optimal for AI extraction
Internal Link DensityPassed
35 contextual internal links per 1,000 words — strong knowledge graph signal
Canonical Tag for AI DeduplicationPassed
Self-referencing canonical — clean signal for AI
llms.txt (AI Site Descriptor)Info
Not present — not required for AI visibility
Why it matters: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.
How to fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Category 5 / 8 · bcommerce.sk · Zulien Score

Legal & Compliance

50/100
Weight: 10% · 4 OK · 4 warnings · 2 failures · 10 total
Cookie Consent Banner (CMP)Failed
Why it matters: Since 2024, EU regulators actively enforce cookie consent. A non-compliant cookie banner is one of the most frequently fined GDPR offences.
How to fix: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
GDPR Art. 6(1)(a) · GDPR Art. 7 · SK 18/2018 § 14
Privacy Policy PageFailed
Why it matters: A missing privacy policy is one of the most frequently cited GDPR violations. Every EU data protection authority considers it a basic requirement.
How to fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).
GDPR Art. 12 · GDPR Art. 13 · GDPR Art. 14 · SK 18/2018 § 19 · SK 18/2018 § 20
Cookie PolicyWarning
Why it matters: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
How to fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
Terms & Conditions PageWarning
Why it matters: EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights.
How to fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
Right to Erasure (Data Deletion)Warning
Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Withdrawal of Consent MechanismWarning
Why it matters: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.
How to fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
Tracking Scripts & ConsentPassed
No tracking scripts detected
Legal Contact / Imprint PagePassed
/o-nas/
Data Encryption (No Mixed Content)Passed
All resources loaded over HTTPS
Data Protection Officer ContactPassed
DPO / data protection contact found
Category 6 / 8 · bcommerce.sk · Zulien Score

Vulnerability

91/100
Weight: 10% · 8 OK · 1 warnings · 1 failures · 10 total
DMARC Policy (Email Auth)Failed
Why it matters: Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.
How to fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
Cross-Origin IsolationWarning
Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
CMS Version DisclosurePassed
No generator tag — CMS identity hidden
Sensitive Files ExposedPassed
.env, .git, composer.json — all properly blocked
Install Script ExposedPassed
No /install/ or /setup/ paths accessible
Directory ListingPassed
Disabled — file structure hidden
Admin Panel at Default URLPassed
Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
Debug Mode / Error ExposurePassed
No debug indicators found in page output
SPF Record (Email Security)Passed
SPF configured: v=spf1 a mx include:_spf.m1.websupport.sk ?all
DKIM Signing (Email Auth)Passed
DKIM configured (selectors: mail)
Category 7 / 8 · bcommerce.sk · Zulien Score

Accessibility / EAA

71/100
Weight: 10% · 4 OK · 2 warnings · 1 failures · 9 total
Landmark RegionsFailed
No <main> landmark region found
Why it matters: Landmarks let assistive-tech users jump straight to the main content and skip repeated navigation. EN 301 549 § 9.1.3.1 (WCAG 1.3.1).
How to fix: Wrap the primary content in <main> and use <nav>, <header>, <footer> for regions.
SK § 4 zák. 351/2022 · CZ § 4 zák. 424/2023
Heading StructureWarning
Heading outline issue (h1 count: 1h2→h4)
Why it matters: A clean heading hierarchy is the primary way assistive-tech users skim a page (WCAG 1.3.1 / 2.4.6).
How to fix: Use a single <h1> and don't jump heading levels (e.g. <h2> straight to <h4>).
Skip LinkWarning
No skip-to-content link detected
Why it matters: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).
How to fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
Page LanguagePassed
<html lang="sk"> is set
Image Alt TextPassed
All 7 images have alt attributes
Link TextPassed
Links use descriptive text
Zoom & ScalingPassed
Pinch-zoom is not disabled
Form LabelsInfo
No form inputs found on the homepage
EAA Legal BasisInfo
In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
Category 8 / 8 · bcommerce.sk · Zulien Score

Next steps

  1. Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
  2. Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
  3. Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
  4. Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/bcommerce.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk