Last scanned: July 28, 2026
B0/100
Score Report
bonprix.skScanned on July 28, 2026
Magento
Vue.js
Nuxt.js
Swiper
PhotoSwipe
Last scanned: July 28, 2026
AI verdict
Your store runs well, but has security and legal gaps. Add a cookie consent banner immediately for GDPR compliance. Your accessibility for users is excellent.
Action plan
Fix these 3 things first
Sorted by score impact — each fix moves your overall grade up.
+18potential gain
94/100
Performance
Weight: 25% · 13 passed · 4 warnings · 1 failed · 1 SPA (verify manually)
Why it matters: Each CSS file blocks rendering. With 28 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Evidence: HTML-heuristic · Confidence: high
What we found: 28 CSS files — too many!
Why it matters: Each CSS file blocks rendering. With 28 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Evidence:HTML-heuristic· Confidence: high
Why it matters: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.
How to fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
Evidence: PSI-lab · Confidence: low
What we found: 160 KB unused (CSS: 0 KB, JS: 160 KB)
Why it matters: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.
Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.
How to fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
Evidence:PSI-lab· Confidence: low
Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.
How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Evidence: HTTP-header · Confidence: high
What we found: max-age=0, no-cache
Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.
How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Evidence:HTTP-header· Confidence: high
Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Evidence: HTML-heuristic · Confidence: high
What we found: Custom fonts detected without preload hints
Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Evidence:HTML-heuristic· Confidence: high
Why it matters: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.
How to fix: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
Evidence: PSI-lab · Confidence: high
What we found: 105 KB of inline JavaScript
Why it matters: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.
How to fix: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
Evidence:PSI-lab· Confidence: high
How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Evidence: PSI-lab · Confidence: high
🏆 Your store qualifies for the Zulien Score Badge!
Add this badge to your store to show customers it's optimized.
Get embed code
<a href="https://score.zulien.sk/r/bonprix.sk?utm_source=embed&utm_medium=badge&utm_campaign=bonprix.sk" target="_blank" rel="noopener"><img src="https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/badge?domain=bonprix.sk&size=medium&theme=dark" alt="Zulien Score — bonprix.sk (B)" width="280" height="72" loading="lazy" /></a>
This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Zulien Score
Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách
83/100
Grade B
bonprix.sk
Executive summary
8
Chýb
45
Upozornení
83
OK
149
Spolu kontrol
Skóre po kategóriách
| Kategória | Skóre | Váha | Chyby | Upozornenia | OK |
|---|---|---|---|---|---|
| Performance | 94/100 | 25% | 1 | 4 | 13 |
| SEO | 89/100 | 20% | 1 | 4 | 21 |
| Security | 83/100 | 15% | 0 | 5 | 9 |
| Mobile | 74/100 | 10% | 0 | 10 | 7 |
| AI Readiness | 72/100 | 10% | 1 | 15 | 11 |
| GDPR | 63/100 | 10% | 2 | 3 | 6 |
| Vulnerability | 75/100 | 10% | 3 | 3 | 9 |
| Accessibility | 96/100 | — | 0 | 1 | 7 |
Kritické zistenia
CSS File Count· Performance
Each CSS file blocks rendering. With 28 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
Open Graph Image Format· SEO
Social scrapers expect an image at the og:image URL. If they get HTML/JSON instead, no preview renders.
Content Freshness Signals· AI Readiness
With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
Cookie Consent Banner (CMP)· GDPR
Since 2024, EU regulators actively enforce cookie consent. A non-compliant cookie banner is one of the most frequently fined GDPR offences.
Tracking Scripts Without Consent· GDPR
Loading ANY tracking before consent is a direct GDPR/ePrivacy violation. This is one of the most commonly fined offences by EU data protection authorities.
Suspicious Inline Script Patterns· Vulnerability
These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites.
DMARC Policy (Email Auth)· Vulnerability
Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.
API Key Exposure in Source· Vulnerability
Exposed API keys are exploited within minutes by automated bots scanning HTML source. Stripe keys enable charges to your account, Google keys enable billing abuse, GitHub tokens compromise your repositories.
Performance
94/100
CSS File CountZlyhalo
28 CSS files — too many!
Prečo je to dôležité: Each CSS file blocks rendering. With 28 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
Ako opraviť: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Unused Code (CSS + JS)Upozornenie
160 KB unused (CSS: 0 KB, JS: 160 KB)
Prečo je to dôležité: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.
Ako opraviť: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
Cache-Control StrategyUpozornenie
max-age=0, no-cache
Prečo je to dôležité: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.
Ako opraviť: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Font PreloadingUpozornenie
Custom fonts detected without preload hints
Prečo je to dôležité: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
Ako opraviť: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Inline JavaScript SizeUpozornenie
105 KB of inline JavaScript
Prečo je to dôležité: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.
Ako opraviť: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
Server Response Time (TTFB)Prešlo
19ms
First Contentful Paint (FCP)Prešlo
0.81s
Largest Contentful Paint (LCP)Prešlo
0.89s — Core Web Vital ✓
Total Blocking Time (TBT)Prešlo
0ms
Cumulative Layout Shift (CLS)Prešlo
0.008 — Core Web Vital ✓
Speed IndexPrešlo
1.45s
Total Page WeightPrešlo
1.4 MB (65 requests)
Text Compression (gzip/brotli)Prešlo
All text resources properly compressed
Resource Hints (Preload/Preconnect)Prešlo
2 preload, 1 preconnect hint(s)
Lazy LoadingPrešlo
95% of images use native lazy loading (35/37)
Font Loading StrategyPrešlo
font-display: swap
HTTP/3 (QUIC) SupportPrešlo
HTTP/3 enabled via Alt-Svc header
Critical CSS StrategyPrešlo
Critical CSS / async CSS loading detected
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
SEO
89/100
Open Graph Image FormatZlyhalo
og:image returned text/html
Prečo je to dôležité: Social scrapers expect an image at the og:image URL. If they get HTML/JSON instead, no preview renders.
Ako opraviť: Make sure the og:image URL returns an image (Content-Type: image/png or image/jpeg). Common cause: returning HTML or JSON from a broken redirect.
Meta DescriptionUpozornenie
168 chars (optimal: 120-160)
Prečo je to dôležité: Google truncates descriptions over 160 chars. Mobile shows even less (~120 chars).
Ako opraviť: Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.
Twitter/X CardsUpozornenie
Prečo je to dôležité: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.
Ako opraviť: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
Canonical URL ConsistencyUpozornenie
Canonical points to different URL: https://www.bonprix.sk
Prečo je to dôležité: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.
Ako opraviť: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
Sitemap in robots.txtUpozornenie
robots.txt exists but doesn't reference your sitemap
Prečo je to dôležité: While Google can find sitemaps via Search Console, referencing it in robots.txt ensures all search engines (Bing, Yandex, Baidu) can discover it automatically.
Ako opraviť: Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.
Meta TitlePrešlo
60 chars — "bonprix • Internetový obchod • Odevy dámske, pánske a d…"
H1 HeadingPrešlo
"Odevy dámske, pánske a detské"
Content Structure (H2 Headings)Prešlo
2 H2 subheadings found
Open Graph TagsPrešlo
og:title, og:description, og:image, og:type
Canonical URLPrešlo
https://www.bonprix.sk
Structured Data (JSON-LD)Prešlo
2 block(s): WebSite, SearchAction, Organization
JSON-LD ValidityPrešlo
2 block(s) parse cleanly
robots.txtPrešlo
Present
XML SitemapPrešlo
Found with ~17+ URLs
HTML Language AttributePrešlo
lang="sk-SK"
Hreflang Tags (Multilingual)Prešlo
10 language(s): fr-BE, nl-BE, nl-NL, fr-FR, pl-PL
Image Alt AttributesPrešlo
100% of 37 images have alt text
Meta Robots TagPrešlo
index, follow
FaviconPrešlo
Favicon detected
Image Format OptimizationPrešlo
62% next-gen formats (23 WebP, 0 AVIF)
Semantic HTML StructurePrešlo
4/6 semantic elements: <nav>, <main>, <header>, <footer>
Content DepthPrešlo
690 words — sufficient content
Deep Heading HierarchyPrešlo
H2: 2, H3: 3 — well-structured content
Internal LinkingPrešlo
43 internal links — strong site navigation
Empty/Dead LinksPrešlo
1 minor dead link(s) — acceptable
Accessibility FundamentalsPrešlo
3/4 a11y signals: 5 ARIA roles, 86 ARIA labels, lang="sk-SK"
Text-to-HTML RatioInfo
1% ratio but 690 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.
Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.
Security
83/100
DNSSECUpozornenie
No DNSKEY records — zone is unsigned
Prečo je to dôležité: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.
Ako opraviť: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
CAA DNS RecordUpozornenie
No CAA records — any CA can issue certificates for this domain
Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
Cookie Security FlagsUpozornenie
4 cookie(s): 1 missing HttpOnly
Prečo je to dôležité: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.
Ako opraviť: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
security.txt (RFC 9116)Upozornenie
Prečo je to dôležité: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.
Ako opraviť: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
CDN / WAF ProtectionUpozornenie
Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.
Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
SSL/TLS CertificatePrešlo
Valid HTTPS connection established
HTTP → HTTPS RedirectPrešlo
HTTP properly redirects to HTTPS
HSTS (Strict-Transport-Security)Prešlo
max-age=31536000, preload, includeSubDomains
Content-Security-Policy (CSP)Prešlo
Present and reasonably configured
Clickjacking ProtectionPrešlo
X-Frame-Options: SAMEORIGIN
X-Content-Type-OptionsPrešlo
nosniff
Referrer-PolicyPrešlo
no-referrer-when-downgrade
Permissions-PolicyPrešlo
geolocation=(self), camera=(self), microphone=(self)
Technology DisclosurePrešlo
Server identity hidden
Mobile
74/100
Mobile Performance ScoreUpozornenie
76/100 (target: 90+)
Prečo je to dôležité: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.
Ako opraviť: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
Touch Target SizeUpozornenie
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Prečo je to dôležité: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityUpozornenie
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
Theme ColorUpozornenie
Prečo je to dôležité: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
Ako opraviť: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Inline CSS SizeUpozornenie
157 KB of inline CSS
Prečo je to dôležité: Large inline CSS blocks increase initial HTML download and parsing time — especially painful on mobile with limited CPU and slower connections.
Ako opraviť: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
Responsive Images (srcset)Upozornenie
37 images without responsive sizing
Prečo je to dôležité: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.
Ako opraviť: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
Apple Mobile Web AppUpozornenie
Missing: apple-mobile-web-app-capable, status-bar-style
Prečo je to dôležité: These tags enable 'Add to Home Screen' on iOS with a full-screen experience. A polished home screen presence increases return visits.
Ako opraviť: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
Notch/Safe Area HandlingUpozornenie
viewport-fit=cover set but no safe-area-inset padding detected
Prečo je to dôležité: viewport-fit=cover without safe-area padding can hide content behind the iPhone notch or Dynamic Island. Most new iPhones have a notch.
Ako opraviť: Add CSS padding using env(safe-area-inset-*) for content near screen edges. Without it, content may be hidden behind the notch or Dynamic Island.
Fixed Width ElementsUpozornenie
Large fixed-width elements detected — may cause horizontal scroll
Prečo je to dôležité: Fixed-width elements wider than the viewport cause horizontal scrolling on mobile. Google's mobile-friendly test specifically checks for this.
Ako opraviť: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
Link Text Quality (WCAG 2.4.4)Upozornenie
1 odkazov má generický text ("click here", "more", "tu"...)
Prečo je to dôležité: WCAG 2.4.4: Účel odkazu musí byť zrejmý z textu. Vágne odkazy zhoršujú UX, konverziu aj SEO (Google anchor text relevancia).
Ako opraviť: Nahraď 'Click here' / 'Read more' / 'Viac' popisným textom: 'Prečítaj si viac o GDPR', 'Pozri cenník modulov'. Screen readers čítajú odkazy mimo kontextu — samostatné 'viac' nemá význam.
Viewport ConfigurationPrešlo
width=device-width, initial-scale=1
Content Fits ViewportPrešlo
No horizontal scrolling needed
Responsive Design TechniquesPrešlo
Flexbox, CSS Grid, Media queries detected
Mobile Navigation (Semantic)Prešlo
<nav> element present — proper navigation landmark
Form Input TypesPrešlo
Optimized: 1 email, 2 search
Form Input Labels (WCAG 3.3.2)Prešlo
3/3 inputs majú label
Heading Hierarchy (WCAG 1.3.1)Prešlo
Žiadne preskočené úrovne
AI Readiness
72/100
Content Freshness SignalsZlyhalo
Prečo je to dôležité: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
Ako opraviť: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
Structured Data FoundationUpozornenie
2 distinct schema types (WebSite, BusinessEntity) — add more for comprehensive AI coverage
Prečo je to dôležité: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite.
Ako opraviť: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
FAQ Schema (Direct AI Answers)Upozornenie
Prečo je to dôležité: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Structured Content (Lists & Tables)Upozornenie
15 lists found — consider adding comparison tables
Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.
Ako opraviť: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
Author Expertise Signals (E-E-A-T)Upozornenie
Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.
Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Extractable Answer BlocksUpozornenie
18 paragraphs, avg 19 words — too short for citation
Prečo je to dôležité: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.
Ako opraviť: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
Section Length OptimizationUpozornenie
Avg section: 91 words — only 20% in 80-200 word optimal range
Prečo je to dôležité: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsUpozornenie
Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.
Ako opraviť: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
Common Question CoverageUpozornenie
Answers 3/5 — missing: price, availability
Prečo je to dôležité: LLMs like ChatGPT and Perplexity 'fan out' a shopping query into these sub-questions and cite the pages that answer them. Pages missing these answers get skipped in AI-generated shopping results — and lose the shopper's trust.
Ako opraviť: Add clear content answering the questions shoppers (and AI assistants) ask: pricing, shipping options & cost, returns/refund policy, stock availability, and accepted payment methods. A visible FAQ or info section covering these is ideal.
Canonical Tag for AI DeduplicationUpozornenie
Canonical points to different URL: https://www.bonprix.sk
Prečo je to dôležité: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.
Ako opraviť: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
Knowledge Graph ReadinessUpozornenie
2/4 signals — missing: @id in JSON-LD, consistent brand name (title/schema/OG)
Prečo je to dôležité: @id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity.
Ako opraviť: Add: @id in JSON-LD, consistent brand name (title/schema/OG). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
Content Readability for AIUpozornenie
Grade 18 — too complex for broad AI citation (technical threshold: 14)
Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.
Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Image Alt Text Quality for AIUpozornenie
62% good, 14 poor, 0 missing
Prečo je to dôležité: AI uses alt text to understand images for visual search (Google Lens, Bing Visual Search), product recommendations, and accessibility. Quality alt text opens more discovery channels.
Ako opraviť: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.
Expert Quotations & CitationsUpozornenie
Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.
Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
WebMCP Agentic ReadinessUpozornenie
Prečo je to dôležité: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
Content-to-Boilerplate RatioUpozornenie
38% in main content area — too much boilerplate
Prečo je to dôležité: AI crawlers specifically target <main> and <article> content blocks. If most of your text is in navigation, footers, and sidebars, AI gets noise instead of signal — reducing citation quality.
Ako opraviť: Move more content into <main> or <article> elements. Reduce navigation text, footer content, and sidebar noise. AI crawlers extract content from semantic containers and discard the rest.
AI Bot Access PolicyPrešlo
Explicitly allowed: Googlebot
Content Accessibility for AIPrešlo
690 words in raw HTML (1.3% text ratio) — readable by AI crawlers without executing JS
Organization Schema + Entity LinkingPrešlo
Organization found with 4 sameAs links — strong entity identity
Site Search Schema (SearchAction)Prešlo
WebSite SearchAction configured — AI can search your store
Content Depth for AIPrešlo
690 words — rich content for AI analysis and citation
Answer-First Content FormatPrešlo
First paragraph: 20 words — good content density above the fold
Heading Hierarchy for AIPrešlo
Proper structure: 1 H1 → 2 H2s → 3 H3s — clear content outline
Semantic HTML StructurePrešlo
4/6 semantic elements: <nav>, <main>, <header>, <footer>
Entity Clarity & Brand SignalsPrešlo
OG tags complete + 4 sameAs links: Facebook, Instagram, YouTube
Statistics & Data PresencePrešlo
6 data points found — strong citation magnet
Internal Link DensityPrešlo
62 contextual internal links per 1,000 words — strong knowledge graph signal
llms.txt (AI Site Descriptor)Info
Not present — not required for AI visibility
Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.
Ako opraviť: Create /llms.txt in Markdown format:
# Your Store Name
> One-line summary of your business and key offerings.
Detailed description paragraph.
## Products
- [Product Category](URL): Description
## About
- [About Us](URL): Company history and values
See llmstxt.org for the full specification.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Prečo je to dôležité: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Social Proof (Testimonials / Case Studies)Info
None detected. For a non-commercial/informational site, testimonials and case studies are optional
Prečo je to dôležité: Client testimonials and 'trusted by' logos are a B2B sales-cycle lever. A non-profit, club, or informational site isn't selling a service, so their absence isn't a credibility gap — hence informational, not scored.
Ako opraviť: Optional: member stories, event photos/recaps, partner logos, or press mentions build trust and give AI assistants more to cite about your organisation — but they don't gate credibility the way they do for a B2B vendor.
Agent-Commerce ReadinessInfo
81/100 — pripravené pre AI agentov (Prístup 100 · Porozumenie 75 · Objaviteľnosť 100 · Transakcia 50)
Prečo je to dôležité: Či dokáže autonómny nákupný AI agent (ChatGPT operator, Perplexity, budúce agentické asistenty) na vašom obchode: prísť dnu, prečítať a porozumieť produktom, objaviť celý katalóg a konať (kôš, podmienky). Toto meria málokto — a pre SK/CZ shopy nikto. Skóre spája AI-bot prístup, Product schema, produktové feedy (Merchant/Heureka/Zboží), WebMCP a nákupné podmienky do jedného agent-first pohľadu. Nadväzuje na pripravovaný verejný MCP konektor ("naskenuj tento obchod").
Agent: Prístup — dostane sa agent dnuInfo
100/100 (2 signály/-ov)
Agent: Porozumenie — rozumie produktomInfo
75/100 (2 signály/-ov)
Agent: Objaviteľnosť — nájde celý katalógInfo
100/100 (1 signál)
Agent: Transakcia — vie konať (kôš/podmienky)Info
50/100 (1 signál)
GDPR
63/100
Cookie Consent Banner (CMP)Zlyhalo
Prečo je to dôležité: Since 2024, EU regulators actively enforce cookie consent. A non-compliant cookie banner is one of the most frequently fined GDPR offences.
Ako opraviť: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
GDPR Art. 6(1)(a) · GDPR Art. 7 · SK 18/2018 § 14
Tracking Scripts Without ConsentZlyhalo
1 tracker(s) loading without consent: Pinterest Tag
Prečo je to dôležité: Loading ANY tracking before consent is a direct GDPR/ePrivacy violation. This is one of the most commonly fined offences by EU data protection authorities.
Ako opraviť: These tracking scripts fire before user consent: Pinterest Tag. Configure your CMP to block them until explicit opt-in. Use Tag Manager's consent mode or CMP script blocking.
GDPR Art. 6(1)(a) · GDPR Art. 7 · SK 18/2018 § 14
Cookie PolicyUpozornenie
Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
International Data TransfersUpozornenie
1 US-based tracker(s) without consent: Pinterest Tag
Prečo je to dôležité: The EU-US Data Privacy Framework covers some transfers, but loading US trackers without consent remains a violation. Austrian and French DPAs have ruled Google Analytics non-compliant without proper safeguards.
Ako opraviť: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
Right to Erasure (Data Deletion)Upozornenie
Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Privacy Policy PagePrešlo
/pomoc/zasady-ochrany-osobnych-udajov/
Legal Contact / Imprint PagePrešlo
/corporate/about-us/
Data Encryption (No Mixed Content)Prešlo
All resources loaded over HTTPS
Newsletter ConsentPrešlo
Newsletter form with consent mechanism detected
Data Protection Officer ContactPrešlo
DPO / data protection contact found
Withdrawal of Consent MechanismPrešlo
Consent withdrawal / opt-out mechanism found
Terms & Conditions PageInfo
No Terms & Conditions link found — for a non-commercial/informational site this is optional (no purchase or paid service to govern)
Prečo je to dôležité: Consumer T&C (AGB/VOP) obligations attach to selling goods or services. A purely informational or non-profit site has no transaction to govern, so missing T&C isn't a compliance gap.
Ako opraviť: If you accept memberships, donations, sign-ups, or run events with paid tickets, publish simple Terms of Use / participation rules and link them in the footer.
Vulnerability
75/100
Suspicious Inline Script PatternsZlyhalo
Detected: Payment data exfiltration pattern, Dynamic script injection
Prečo je to dôležité: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites.
Ako opraviť: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
DMARC Policy (Email Auth)Zlyhalo
Prečo je to dôležité: Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.
Ako opraviť: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
API Key Exposure in SourceZlyhalo
3 potential API key(s) in HTML: secretKey:"aiXA1G6zeoJUu40oYS3..., AIzaSyByJAknczAEXQ-w_RzW5e85ec...
Prečo je to dôležité: Exposed API keys are exploited within minutes by automated bots scanning HTML source. Stripe keys enable charges to your account, Google keys enable billing abuse, GitHub tokens compromise your repositories.
Ako opraviť: URGENT: Rotate all exposed API keys immediately! Move secrets to server-side environment variables. Never include API keys in client-side HTML or JavaScript. Use server-side proxy endpoints for API calls.
Inline JavaScript ExposureUpozornenie
105 KB of inline JavaScript
Prečo je to dôležité: Large amounts of inline JavaScript prevent proper CSP implementation and increase the risk of XSS. External scripts can be protected with SRI hashes.
Ako opraviť: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
DKIM Signing (Email Auth)Upozornenie
Prečo je to dôležité: DKIM cryptographically signs outgoing email to prove it comes from your domain. Without DKIM, email providers downgrade trust score — transactional emails land in spam. Gmail and Yahoo require DKIM since 2024 for bulk senders.
Ako opraviť: Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.
Cross-Origin IsolationUpozornenie
Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
CMS Version DisclosurePrešlo
No generator tag — CMS identity hidden
Sensitive Files ExposedPrešlo
.env, .git, composer.json — all properly blocked
Install Script ExposedPrešlo
No /install/ or /setup/ paths accessible
Directory ListingPrešlo
Disabled — file structure hidden
Admin Panel at Default URLPrešlo
Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
Debug Mode / Error ExposurePrešlo
No debug indicators found in page output
Form CSRF ProtectionPrešlo
1 form(s) — all have CSRF tokens
SPF Record (Email Security)Prešlo
SPF configured: v=spf1 a mx ip4:82.177.16.10/32 ip4:194.79.25.177/32 ip4:194.79.25.55/32 ip4:194
Payment Page SecurityPrešlo
All essential security headers present on payment page
Accessibility
96/100
Skip LinkUpozornenie
No skip-to-content link detected
Prečo je to dôležité: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).
Ako opraviť: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
Page LanguagePrešlo
<html lang="sk-SK"> is set
Image Alt TextPrešlo
All 37 images have alt attributes
Form LabelsPrešlo
All 3 form inputs are labelled
Heading StructurePrešlo
Single <h1> with a consistent heading outline
Link TextPrešlo
Links use descriptive text
Landmark RegionsPrešlo
Semantic landmarks present (<main>, <nav>/<header>)
Zoom & ScalingPrešlo
Pinch-zoom is not disabled
EAA Legal BasisInfo
In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
Ďalšie kroky
Online report
Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:
https://score.zulien.sk/r/bonprix.sk
Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk