Last scanned: October 8, 2026

C0/100

Average

Score Report

bobek.sk

Scanned on October 8, 2026

PrestaShop

jQuery

Nginx

Last scanned: October 8, 2026

AI verdict

Your store is solid overall, but has serious security gaps. Install HSTS protocol to encrypt all communications. On the bright side, accessibility and vulnerability protection are excellent.

Action plan

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

How we rank →

Quick wins

High impact, little work. Do these first.

Bigger projects

High impact, but the fix needs planning.

Small fixes

Lower impact, quick to do.

+13 more

Later

Lower impact and more work. Plan them once the rest is done.

+26 more

91/100

Performance

Weight: 25% · 14 passed · 2 warnings · 2 failed · 2 SPA (verify manually)

What we found: 306 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 306 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Evidence:PSI-lab· Confidence: low

What we found: Only 0% of 5 scripts optimized — most are render-blocking

Why it matters: 5 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Evidence:HTML-heuristic· Confidence: high

Get Performance Optimization →

Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

What we found: no-store, no-cache, must-revalidate

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

Evidence:HTTP-header· Confidence: high

Request quote for speed audit

4 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

I agree to the Privacy Policy. We'll send your report and optional re-scan notifications.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report

Zulien Score

Full e-commerce audit — 50+ checks across 7 categories

78/100

Grade C

bobek.sk

Audit date: October 8, 2026

Platform: PrestaShop

Online report: https://score.zulien.sk/r/bobek.sk

Executive summary

Failures

Warnings

137

Checks total

Scores by category

Category	Score	Weight	Failures	Warnings	OK
Performance	91/100	25%	2	2	14
SEO	73/100	20%	2	7	13
Security	53/100	15%	3	8	5
Mobile	77/100	10%	0	6	7
AI Readiness	63/100	10%	3	16	9
Legal & Compliance	89/100	10%	0	3	9
Vulnerability	89/100	10%	0	4	8
Accessibility / EAA	89/100	10%	0	2	6

Critical findings

Unused Code (CSS + JS)· Performance

Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Script Loading Strategy· Performance

5 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

Meta Description· SEO

The literal 'Powered by PrestaShop' default tells Google — and every shopper in the SERP — that the store was never configured. It signals abandonment, hurts click-through, and is identical across thousands of shops so it carries zero ranking value.

XML Sitemap· SEO

Sitemaps help Google discover and index pages faster, especially for large stores with deep category structures.

HSTS (Strict-Transport-Security)· Security

Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.

Content-Security-Policy (CSP)· Security

CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

Clickjacking Protection· Security

Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Content Freshness Signals· AI Readiness

With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

Entity Clarity & Brand Signals· AI Readiness

AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.

Canonical Tag for AI Deduplication· AI Readiness

Without a canonical tag, AI models may index multiple versions of the same page (with/without trailing slash, with parameters, etc.), diluting your AI visibility across duplicate URLs.

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

Quick wins (5)

High impact, little work. Do these first.

Finding	Category	Effort
Meta Description	SEO	quick fix
XML Sitemap	SEO	quick fix
HSTS (Strict-Transport-Security)	Security	quick fix
Clickjacking Protection	Security	quick fix
Canonical Tag for AI Deduplication	AI Readiness	quick fix

Bigger projects (4)

High impact, but the fix needs planning.

Finding	Category	Effort
Script Loading Strategy	Performance	about a day
Content-Security-Policy (CSP)	Security	about a day
Mixed Content Resources	Vulnerability	about a day
Unused Code (CSS + JS)	Performance	project

Small fixes (18)

Lower impact, quick to do.

Finding	Category	Effort
Cache-Control Strategy	Performance	quick fix
Meta Title	SEO	quick fix
Twitter/X Cards	SEO	quick fix
Canonical URL	SEO	quick fix
Empty/Dead Links	SEO	quick fix
DNSSEC	Security	quick fix
CAA DNS Record	Security	quick fix
X-Content-Type-Options	Security	quick fix
Referrer-Policy	Security	quick fix
Permissions-Policy	Security	quick fix
Subresource Integrity (SRI)	Security	quick fix
security.txt (RFC 9116)	Security	quick fix

+6 more

Later (31)

Lower impact and more work. Plan them once the rest is done.

Finding	Category	Effort
Image Format Optimization	SEO	about a day
CDN / WAF Protection	Security	about a day
Touch Target Size	Mobile	about a day
Font Size Readability	Mobile	about a day
Responsive Images (srcset)	Mobile	about a day
Heading Hierarchy (WCAG 1.3.1)	Mobile	about a day
Structured Data Foundation	AI Readiness	about a day
Organization Schema + Entity Linking	AI Readiness	about a day
FAQ Schema (Direct AI Answers)	AI Readiness	about a day
Image Alt Text Quality for AI	AI Readiness	about a day
Right to Erasure (Data Deletion)	Legal & Compliance	about a day
Withdrawal of Consent Mechanism	Legal & Compliance	about a day

+19 more

Performance

91/100

Weight: 25% · 14 OK · 2 warnings · 2 failures · 20 total

Unused Code (CSS + JS)Failed

306 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

How to fix: You're loading 306 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Script Loading StrategyFailed

Only 0% of 5 scripts optimized — most are render-blocking

Why it matters: 5 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Resource Hints (Preload/Preconnect)Warning

Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.

Cache-Control StrategyWarning

no-store, no-cache, must-revalidate

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

Server Response Time (TTFB)Passed

2ms

First Contentful Paint (FCP)Passed

1.03s

Largest Contentful Paint (LCP)Passed

1.35s — Core Web Vital ✓

Total Blocking Time (TBT)Passed

0ms

Cumulative Layout Shift (CLS)Passed

0.000 — Core Web Vital ✓

Speed IndexPassed

1.12s

Total Page WeightPassed

1.3 MB (39 requests)

JavaScript BudgetPassed

482 KB — within the 600 KB budget

Why it matters: JavaScript is the most expensive resource on a page: it must be downloaded, parsed and executed before the page responds to input. Staying under 600 KB is what keeps mid-range phones responsive.

Request BudgetPassed

39 requests — within the budget of 80

Why it matters: Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed.

Text Compression (gzip/brotli)Passed

All text resources properly compressed

Lazy LoadingPassed

92% of images use native lazy loading (12/13)

Font Loading StrategyPassed

font-display: swap

HTTP/3 (QUIC) SupportPassed

HTTP/3 enabled via Alt-Svc header

CSS File CountPassed

2 CSS file(s) — well consolidated

Third-party ServicesInfo

Not measured — PageSpeed did not return the third-party audit for this URL

Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.

How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

SEO

73/100

Weight: 20% · 13 OK · 7 warnings · 2 failures · 22 total

Meta DescriptionFailed

Default CMS placeholder: "Obchod vytvorený v systéme PrestaShop"

Why it matters: The literal 'Powered by PrestaShop' default tells Google — and every shopper in the SERP — that the store was never configured. It signals abandonment, hurts click-through, and is identical across thousands of shops so it carries zero ranking value.

How to fix: Replace the default CMS meta description with a unique, compelling 120-160 char description per page. In PrestaShop: Shop Parameters → Traffic & SEO (homepage) and per product/category SEO tab. Never ship the install default.

XML SitemapFailed

Why it matters: Sitemaps help Google discover and index pages faster, especially for large stores with deep category structures.

How to fix: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.

Meta TitleWarning

8 chars (optimal: 30-60)

Why it matters: Short titles waste valuable ranking real estate in search results.

How to fix: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.

Twitter/X CardsWarning

Why it matters: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.

How to fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.

Canonical URLWarning

og:url present (https://www.bobek.sk/) but <link rel=canonical> missing

Why it matters: og:url helps social platforms but Google ranks the canonical tag higher. With both present, you avoid any duplicate-content ambiguity.

How to fix: Add <link rel='canonical' href='https://www.bobek.sk/'> to <head>. og:url covers social sharing; canonical covers Google + AI crawlers explicitly.

Text-to-HTML RatioWarning

4% — low content density (291 words)

Why it matters: A low text-to-HTML ratio signals thin content to Google. Pages with more useful text rank higher and convert better.

How to fix: Add more unique text content. Write detailed product descriptions, buying guides, and FAQ sections.

Image Format OptimizationWarning

0% next-gen formats — 13 JPEG, 0 PNG images

Why it matters: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.

How to fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.

Content DepthWarning

Only 291 words — thin content

Why it matters: Google's Helpful Content Update targets thin content pages. Pages with under 300 words rarely rank for competitive keywords. More content means more keyword opportunities.

How to fix: Add more unique, valuable content. Product pages should have 150+ word descriptions. Category pages benefit from 200+ word introductions. Blog posts need 800+ words to rank.

Empty/Dead LinksWarning

8 dead links (0 empty, 8 hash-only, 0 javascript:void)

Why it matters: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.

How to fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.

H1 HeadingPassed

Content Structure (H2 Headings)Passed

4 H2 subheadings found

Open Graph TagsPassed

og:title, og:description, og:type

Structured Data (JSON-LD)Passed

3 block(s): Organization, ImageObject, WebPage, WebSite

JSON-LD ValidityPassed

3 block(s) parse cleanly

robots.txtPassed

Present

HTML Language AttributePassed

lang="sk-SK"

Image Alt AttributesPassed

100% of 13 images have alt text

FaviconPassed

Favicon detected

Semantic HTML StructurePassed

6/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>, <aside>

Deep Heading HierarchyPassed

H2: 4, H3: 11 — well-structured content

Internal LinkingPassed

55 internal links — strong site navigation

Accessibility FundamentalsPassed

3/4 a11y signals: 14 ARIA roles, 18 ARIA labels, lang="sk-SK"

Security

53/100

Weight: 15% · 5 OK · 8 warnings · 3 failures · 17 total

HSTS (Strict-Transport-Security)Failed

Why it matters: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.

How to fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.

Content-Security-Policy (CSP)Failed

Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

Clickjacking ProtectionFailed

Why it matters: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

How to fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.

DNSSECWarning

No DNSKEY records — zone is unsigned

Why it matters: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.

How to fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.

CAA DNS RecordWarning

No CAA records — any CA can issue certificates for this domain

Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

X-Content-Type-OptionsWarning

Why it matters: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.

How to fix: Add header: X-Content-Type-Options: nosniff

Referrer-PolicyWarning

Why it matters: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.

How to fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.

Permissions-PolicyWarning

Why it matters: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.

How to fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.

Subresource Integrity (SRI)Warning

Only 0/1 SRI-eligible third-party scripts have integrity hashes

Why it matters: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.

How to fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.

security.txt (RFC 9116)Warning

Why it matters: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.

How to fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.

CDN / WAF ProtectionWarning

Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.

How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

SSL/TLS CertificatePassed

Valid HTTPS connection established

HTTP → HTTPS RedirectPassed

HTTP properly redirects to HTTPS

Cookie Security FlagsPassed

2 cookie(s) — all have Secure, HttpOnly, SameSite

Technology DisclosurePassed

Server: nginx (no version)

Server Version DisclosurePassed

Nginx — version hidden

Cookie Prefix SecurityInfo

2 session cookie(s) already have Secure + HttpOnly + SameSite; adding the __Host- prefix is a cosmetic hardening nicety

Why it matters: With Secure, HttpOnly and SameSite already set, the prefix adds only host-only enforcement — low marginal benefit.

How to fix: Optional: rename to __Host-session (Secure; Path=/; no Domain) for defence-in-depth against subdomain cookie injection.

Mobile

77/100

Weight: 10% · 7 OK · 6 warnings · 0 failures · 13 total

Mobile Performance ScoreWarning

79/100 (target: 90+)

Why it matters: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.

How to fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.

Touch Target SizeWarning

Some tappable targets are too small or too close together (Lighthouse tap-targets audit)

Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityWarning

Some text renders below the 12px legibility threshold (Lighthouse font-size audit)

Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.

How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

Theme ColorWarning

Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.

How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.

Responsive Images (srcset)Warning

13 images without responsive sizing

Why it matters: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.

How to fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.

Heading Hierarchy (WCAG 1.3.1)Warning

Skipped levels: h3→h5

Why it matters: Skipped heading levels (h1 straight to h3) break screen-reader navigation and signal poor document structure to Google. SEO suffers too.

How to fix: Keep headings in order h1 → h2 → h3 → h4 with no skipped levels. Screen readers use the heading hierarchy to navigate. If you want smaller text at the same level, use a CSS class rather than a lower heading tag.

Viewport ConfigurationPassed

width=device-width, initial-scale=1

Content Fits ViewportPassed

No horizontal scrolling needed

Responsive Design TechniquesPassed

Media queries detected

Mobile Navigation (Semantic)Passed

<nav> element present — proper navigation landmark

Form Input TypesPassed

Optimized: 1 email

Form Input Labels (WCAG 3.3.2)Passed

4/4 inputs have a label

Link Text Quality (WCAG 2.4.4)Passed

All links have descriptive text

AI Readiness

63/100

Weight: 10% · 9 OK · 16 warnings · 3 failures · 31 total

Content Freshness SignalsFailed

Why it matters: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

How to fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.

Entity Clarity & Brand SignalsFailed

Why it matters: AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.

How to fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.

Canonical Tag for AI DeduplicationFailed

Why it matters: Without a canonical tag, AI models may index multiple versions of the same page (with/without trailing slash, with parameters, etc.), diluting your AI visibility across duplicate URLs.

How to fix: Add <link rel='canonical' href='https://your-absolute-url'> to every page. This tells AI engines which URL is the authoritative version of this content.

Structured Data FoundationWarning

3 distinct schema types (BusinessEntity, WebPage, WebSite) — add more for comprehensive AI coverage

Why it matters: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite.

How to fix: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.

Organization Schema + Entity LinkingWarning

Organization schema found but no sameAs links

Why it matters: sameAs links tell AI that this is the same entity across the web. It's how Google builds Knowledge Panels and how AI attributes information to your brand.

How to fix: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.

FAQ Schema (Direct AI Answers)Warning

Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.

How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Content Depth for AIWarning

291 words — add more for better AI citations

Why it matters: AI assistants skip thin pages in favor of content-rich competitors. Aim for the depth that makes your page the definitive resource.

How to fix: Expand to 500+ words: add detailed product descriptions, use cases, benefits, specifications, comparison info, and buying guides. AI needs substantial content to summarize and cite.

Structured Content (Lists & Tables)Warning

17 lists found — consider adding comparison tables

Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.

How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.

Author Expertise Signals (E-E-A-T)Warning

Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.

How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Extractable Answer BlocksWarning

7 paragraphs, avg 15 words — too short for citation

Why it matters: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.

How to fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.

Statistics & Data PresenceWarning

No statistical data found in content

Why it matters: Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics.

How to fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.

Section Length OptimizationWarning

Avg section: 52 words — only 25% in 80-200 word optimal range

Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.

How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Q&A Format HeadingsWarning

Why it matters: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

How to fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.

Knowledge Graph ReadinessWarning

2/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn)

Why it matters: @id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity.

How to fix: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.

Content Readability for AIWarning

Grade 20 — too complex for broad AI citation (technical threshold: 14)

Why it matters: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.

How to fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Image Alt Text Quality for AIWarning

50% good, 6 poor, 0 missing

Why it matters: AI uses alt text to understand images for visual search (Google Lens, Bing Visual Search), product recommendations, and accessibility. Quality alt text opens more discovery channels.

How to fix: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.

Expert Quotations & CitationsWarning

Why it matters: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

How to fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

WebMCP Agentic ReadinessWarning

Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

Social Proof (Testimonials / Case Studies)Warning

Why it matters: Without visible social proof, B2B prospects can't verify your track record before reaching out. Missing testimonials and case studies is a common reason consultancy sites lose qualified leads at the contact stage.

How to fix: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is a leading credibility lever.

AI Bot Access PolicyPassed

No AI bot restrictions (allowed by default)

AI agent access (live)Passed

ChatGPT-User and PerplexityBot get the same page as a browser

Content Accessibility for AIPassed

291 words in raw HTML (3.8% text ratio) — readable by AI crawlers without executing JS

Site Search Schema (SearchAction)Passed

WebSite SearchAction configured — AI can search your store

Answer-First Content FormatPassed

First paragraph: 20 words — good content density above the fold

Heading Hierarchy for AIPassed

Proper structure: 1 H1 → 4 H2s → 11 H3s — clear content outline

Semantic HTML StructurePassed

6/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>, <aside>

Internal Link DensityPassed

189 contextual internal links per 1,000 words — strong knowledge graph signal

Content-to-Boilerplate RatioPassed

100% of text in <main>/<article> — clean content signal

llms.txt (AI Site Descriptor)Info

Not present — not required for AI visibility

Why it matters: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.

How to fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

llms-full.txt (Complete AI Content)Info

Not present — not required for AI visibility

Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

ai.txt (AI Permissions)Info

Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt

Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.

Legal & Compliance

89/100

Weight: 10% · 9 OK · 3 warnings · 0 failures · 13 total

Right to Erasure (Data Deletion)Warning

Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.

How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Data Protection Officer ContactWarning

Why it matters: GDPR Article 37 requires a DPO for organizations processing personal data at scale. Even if not mandatory, having a designated privacy contact builds trust and is expected by regulators.

How to fix: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.

Withdrawal of Consent MechanismWarning

Why it matters: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.

How to fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.

Cookie Consent Banner (CMP)Passed

PrestaShop GDPR (psgdpr) detected

Tracking Scripts & ConsentPassed

No tracking scripts detected

Privacy Policy PagePassed

https://www.bobek.sk/content/6-spracovanie-osobnych-udajov

Cookie PolicyPassed

Separate cookie policy detected

Legal Contact / Imprint PagePassed

https://www.bobek.sk/content/4-o-nas

Terms & Conditions PagePassed

https://www.bobek.sk/content/3-obchodne-podmienky

Data Encryption (No Mixed Content)Passed

All resources loaded over HTTPS

Third-party Data SharingPassed

1 third-party domain(s)

Newsletter ConsentPassed

Newsletter form with consent mechanism detected

AI chatbot disclosureInfo

Chat widget detected: Smartsupp. If it answers with AI (e.g. an AI agent or auto-replies), visitors must be told they are talking to an AI.

Why it matters: AI Act Article 50(1) (Regulation (EU) 2024/1689, applies from 2 August 2026) requires AI systems that interact with people to inform them they are interacting with an AI, unless it is obvious from the context.

How to fix: If the chat uses AI (Tidio Lyro, Intercom Fin, Smartsupp AI, Chatbase…), show a clear notice at the start of the conversation, e.g. 'You are chatting with an AI assistant', and offer a way to reach a human. If only people answer, nothing to do.

Vulnerability

89/100

Weight: 10% · 8 OK · 4 warnings · 0 failures · 12 total

Form CSRF ProtectionWarning

1/2 forms have CSRF tokens

Why it matters: Forms without CSRF tokens allow cross-site request forgery — an attacker's site can submit orders, change settings, or modify data on behalf of your logged-in users.

How to fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().

DMARC Policy (Email Auth)Warning

DMARC set to p=none (monitoring only, no enforcement)

Why it matters: DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes.

How to fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.

Cross-Origin IsolationWarning

Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

Mixed Content ResourcesWarning

3 HTTP resource(s) on HTTPS page

Why it matters: Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site.

How to fix: Replace HTTP URLs with HTTPS: http://www.bobek.sk/3-detske-nalepky-na-stenu, http://www.bobek.sk/6-dekorativne-nalepky-na-stenu, http://www.bobek.sk/

CMS Version DisclosurePassed

No generator tag — CMS identity hidden

Sensitive Files ExposedPassed

.env, .git, composer.json — all properly blocked

Install Script ExposedPassed

No /install/ or /setup/ paths accessible

Directory ListingPassed

Disabled — file structure hidden

Admin Panel at Default URLPassed

Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)

Debug Mode / Error ExposurePassed

No debug indicators found in page output

SPF Record (Email Security)Passed

SPF configured: v=spf1 a mx include:_spf.wy.sk -all

DKIM Signing (Email Auth)Passed

DKIM configured (selectors: default)

Accessibility / EAA

89/100

Weight: 10% · 6 OK · 2 warnings · 0 failures · 9 total

Heading StructureWarning

Heading outline issue (h1 count: 1h3→h5)

Why it matters: A clean heading hierarchy is the primary way assistive-tech users skim a page (WCAG 1.3.1 / 2.4.6).

How to fix: Use a single <h1> and don't jump heading levels (e.g. <h2> straight to <h4>).

Skip LinkWarning

No skip-to-content link detected

Why it matters: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).

How to fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.

Page LanguagePassed

<html lang="sk-SK"> is set

Image Alt TextPassed

All 13 images have alt attributes

Form LabelsPassed

All 4 form inputs are labelled

Link TextPassed

Links use descriptive text

Landmark RegionsPassed

Semantic landmarks present (<main>, <nav>/<header>)

Zoom & ScalingPassed

Pinch-zoom is not disabled

EAA Legal BasisInfo

In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.

Next steps

Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/bobek.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk