Last scanned: October 19, 2026

C0/100

Average

Score Report

dev.proenergy.sk

Scanned on October 19, 2026

WooCommerce (WP 6.1.1)

jQuery

Font Awesome

Select2

Underscore

Last scanned: October 19, 2026

AI verdict

Your store works reasonably well, but has notable gaps in SEO and security. Prioritize adding meta descriptions to all products and pages immediately. On the bright side, your accessibility for all visitors is excellent.

Action plan

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

How we rank →

Quick wins

High impact, little work. Do these first.

Bigger projects

High impact, but the fix needs planning.

+7 more

Small fixes

Lower impact, quick to do.

+12 more

Later

Lower impact and more work. Plan them once the rest is done.

+29 more

87/100

Performance

Weight: 25% · 10 passed · 7 warnings · 2 failed · 3 SPA (verify manually)

What we found: Only 0% of 41 scripts optimized — most are render-blocking

Why it matters: 41 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Evidence:HTML-heuristic· Confidence: high

Get Performance Optimization →

What we found: 28 CSS files — too many!

Why it matters: Each CSS file blocks rendering. With 28 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Evidence:HTML-heuristic· Confidence: high

What we found: 120 requests — over the budget of 80, but at or below the median of the award-winning shops we benchmarked (140)

Why it matters: The 80-request bar is best practice; the benchmarked cohort median is 140 and the best shop manages 37. Being under the median is not the same as being fast.

How to fix: Bundle CSS/JS that always loads together, serve icons as a sprite or font rather than individual files, and lazy-load below-fold images so they aren't requested on load.

Evidence:PSI-lab120 requests· Confidence: high

What we found: 94 KB unused (CSS: 59 KB, JS: 36 KB)

Why it matters: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.

Evidence:PSI-lab· Confidence: low

Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

What we found: 7 images without lazy loading

Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.

How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

What we found: Google Fonts detected without font-display

Why it matters: Without font-display, custom fonts cause Flash of Invisible Text (FOIT) — text is completely hidden during font download. On slow connections this can last 3+ seconds.

How to fix: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

What we found: Custom fonts detected without preload hints

Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

What we found: 28 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

9 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

I agree to the Privacy Policy. We'll send your report and optional re-scan notifications.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report

Zulien Score

Full e-commerce audit — 50+ checks across 7 categories

73/100

Grade C

dev.proenergy.sk

Audit date: October 19, 2026

Platform: WooCommerce (WP 6.1.1)

Online report: https://score.zulien.sk/r/dev.proenergy.sk

Executive summary

Failures

Warnings

143

Checks total

Scores by category

Category	Score	Weight	Failures	Warnings	OK
Performance	87/100	25%	2	7	10
SEO	66/100	20%	5	6	15
Security	60/100	15%	2	8	7
Mobile	72/100	10%	0	7	6
AI Readiness	48/100	10%	7	12	7
Legal & Compliance	65/100	10%	1	6	6
Vulnerability	76/100	10%	2	3	6
Accessibility / EAA	100/100	10%	0	0	8

Critical findings

Script Loading Strategy· Performance

41 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

CSS File Count· Performance

Each CSS file blocks rendering. With 28 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Meta Description· SEO

Without a meta description, Google auto-generates one — often poorly. A custom description gives you control over the SERP snippet and improves click-through.

Text-to-HTML Ratio· SEO

Google's Helpful Content Update specifically targets thin content pages, which hurts your rankings.

Content Depth· SEO

Pages with under 100 words are nearly invisible to search engines. Google can't determine relevance without sufficient text content. This is a critical ranking barrier.

Internal Linking· SEO

A page with zero internal links is isolated from your site's link graph. Google may treat it as low-priority or not index it at all.

Robots Noindex Warning· SEO

Noindex removes your page from Google completely. If this is your homepage or a key product page, you're invisible to search. This is one of the most common and damaging SEO mistakes.

HSTS (Strict-Transport-Security)· Security

Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.

Content-Security-Policy (CSP)· Security

CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

Content Accessibility for AI· AI Readiness

AI crawlers see only raw HTML. Content that only appears after JavaScript runs is invisible to them. Server-rendered content is the primary prerequisite for AI visibility.

Content Depth for AI· AI Readiness

Pages with very little content are nearly invisible to AI search. Without substance, AI has nothing to quote, summarize, or recommend.

Answer-First Content Format· AI Readiness

Without a clear opening paragraph, AI assistants can't generate a useful summary of your page. They'll skip to competitor pages that provide immediate, quotable content.

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

Quick wins (5)

High impact, little work. Do these first.

Finding	Category	Effort
Meta Description	SEO	quick fix
Robots Noindex Warning	SEO	quick fix
HSTS (Strict-Transport-Security)	Security	quick fix
Canonical Tag for AI Deduplication	AI Readiness	quick fix
CMS Version Disclosure	Vulnerability	quick fix

Bigger projects (12)

High impact, but the fix needs planning.

Finding	Category	Effort
Privacy Policy Page	Legal & Compliance	about a day
Known Vulnerabilities (CVE)	Vulnerability	project
Script Loading Strategy	Performance	about a day
Internal Linking	SEO	about a day
Content-Security-Policy (CSP)	Security	about a day
Heading Hierarchy for AI	AI Readiness	about a day
Image Alt Text Quality for AI	AI Readiness	about a day
Text-to-HTML Ratio	SEO	project
Content Depth	SEO	project
Content Accessibility for AI	AI Readiness	project
Content Depth for AI	AI Readiness	project
Answer-First Content Format	AI Readiness	project

Small fixes (17)

Lower impact, quick to do.

Finding	Category	Effort
Open Graph Tags	SEO	quick fix
Canonical URL	SEO	quick fix
Meta Robots Tag	SEO	quick fix
DNSSEC	Security	quick fix
CAA DNS Record	Security	quick fix
X-Content-Type-Options	Security	quick fix
Referrer-Policy	Security	quick fix
Permissions-Policy	Security	quick fix
Cookie Security Flags	Security	quick fix
security.txt (RFC 9116)	Security	quick fix
Theme Color	Mobile	quick fix
Legal Contact / Imprint Page	Legal & Compliance	quick fix

+5 more

Later (34)

Lower impact and more work. Plan them once the rest is done.

Finding	Category	Effort
Lazy Loading	Performance	about a day
Content Structure (H2 Headings)	SEO	about a day
Image Format Optimization	SEO	about a day
CDN / WAF Protection	Security	about a day
Touch Target Size	Mobile	about a day
Font Size Readability	Mobile	about a day
Inline CSS Size	Mobile	about a day
Responsive Images (srcset)	Mobile	about a day
Organization Schema + Entity Linking	AI Readiness	about a day
FAQ Schema (Direct AI Answers)	AI Readiness	about a day
Cookie Policy	Legal & Compliance	about a day
Terms & Conditions Page	Legal & Compliance	about a day

+22 more

Performance

87/100

Weight: 25% · 10 OK · 7 warnings · 2 failures · 22 total

Script Loading StrategyFailed

Only 0% of 41 scripts optimized — most are render-blocking

Why it matters: 41 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

CSS File CountFailed

28 CSS files — too many!

Why it matters: Each CSS file blocks rendering. With 28 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Request BudgetWarning

120 requests — over the budget of 80, but at or below the median of the award-winning shops we benchmarked (140)

Why it matters: The 80-request bar is best practice; the benchmarked cohort median is 140 and the best shop manages 37. Being under the median is not the same as being fast.

How to fix: Bundle CSS/JS that always loads together, serve icons as a sprite or font rather than individual files, and lazy-load below-fold images so they aren't requested on load.

Unused Code (CSS + JS)Warning

94 KB unused (CSS: 59 KB, JS: 36 KB)

Why it matters: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.

How to fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.

Resource Hints (Preload/Preconnect)Warning

Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.

Lazy LoadingWarning

7 images without lazy loading

Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.

How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.

Font Loading StrategyWarning

Google Fonts detected without font-display

Why it matters: Without font-display, custom fonts cause Flash of Invisible Text (FOIT) — text is completely hidden during font download. On slow connections this can last 3+ seconds.

How to fix: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.

Font PreloadingWarning

Custom fonts detected without preload hints

Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Critical CSS StrategyWarning

28 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Server Response Time (TTFB)Passed

28ms

First Contentful Paint (FCP)Passed

0.92s

Largest Contentful Paint (LCP)Passed

1.20s — Core Web Vital ✓

Total Blocking Time (TBT)Passed

14ms

Cumulative Layout Shift (CLS)Passed

0.000 — Core Web Vital ✓

Speed IndexPassed

1.66s

Total Page WeightPassed

784 KB (120 requests)

JavaScript BudgetPassed

428 KB — within the 600 KB budget

Why it matters: JavaScript is the most expensive resource on a page: it must be downloaded, parsed and executed before the page responds to input. Staying under 600 KB is what keeps mid-range phones responsive.

Text Compression (gzip/brotli)Passed

All text resources properly compressed

HTTP/3 (QUIC) SupportPassed

HTTP/3 enabled via Alt-Svc header

Third-party ServicesInfo

Not measured — PageSpeed did not return the third-party audit for this URL

Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.

How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

Cache-Control StrategyInfo

Not measured — no Cache-Control on the HTML document; static-asset caching was not sampled

Why it matters: Asset caching can eliminate a large share of requests for repeat visitors. We only see the HTML response here, so this is a hint, not a verdict.

How to fix: Ensure static assets (CSS/JS/images) are served with 'Cache-Control: max-age=31536000, immutable' and versioned filenames. HTML can stay 'max-age=0, must-revalidate'.

SEO

66/100

Weight: 20% · 15 OK · 6 warnings · 5 failures · 26 total

Meta DescriptionFailed

Why it matters: Without a meta description, Google auto-generates one — often poorly. A custom description gives you control over the SERP snippet and improves click-through.

How to fix: Write a compelling meta description (120-160 chars) with a call-to-action. Include your target keyword naturally.

Text-to-HTML RatioFailed

0% — very thin content (33 words)

Why it matters: Google's Helpful Content Update specifically targets thin content pages, which hurts your rankings.

How to fix: Your page is almost entirely HTML/CSS/JS with very little actual content. Add substantial product descriptions, content blocks, and informational text.

Content DepthFailed

Only 33 words — very thin content

Why it matters: Pages with under 100 words are nearly invisible to search engines. Google can't determine relevance without sufficient text content. This is a critical ranking barrier.

How to fix: This page has almost no text content. Add detailed product descriptions, buying guides, FAQs, or informational content. Search engines need text to understand and rank your page.

Internal LinkingFailed

No internal links found

Why it matters: A page with zero internal links is isolated from your site's link graph. Google may treat it as low-priority or not index it at all.

How to fix: Add internal links to other pages on your site. Every page should link to related content, categories, and key landing pages.

Robots Noindex WarningFailed

meta robots="noindex, nofollow" — page excluded from search!

Why it matters: Noindex removes your page from Google completely. If this is your homepage or a key product page, you're invisible to search. This is one of the most common and damaging SEO mistakes.

How to fix: Your page has 'noindex' which blocks it from Google entirely. Remove 'noindex' unless this page is intentionally hidden (staging, duplicates).

Content Structure (H2 Headings)Warning

Only 1 H2 subheading

Why it matters: Well-structured content with multiple H2s ranks for more long-tail keywords and improves featured snippet eligibility.

How to fix: Add more H2 subheadings to break content into scannable sections. Include secondary keywords in H2 tags.

Open Graph TagsWarning

Missing: og:description, og:image

Why it matters: Incomplete OG tags mean broken social previews. Shared links without an image get far fewer clicks on Facebook and LinkedIn.

How to fix: Add the missing OG tags: og:description, og:image. Use high-quality 1200×630px images for og:image.

Canonical URLWarning

og:url present (https://dev.proenergy.sk/prihlasenie/) but <link rel=canonical> missing

Why it matters: og:url helps social platforms but Google ranks the canonical tag higher. With both present, you avoid any duplicate-content ambiguity.

How to fix: Add <link rel='canonical' href='https://dev.proenergy.sk/prihlasenie/'> to <head>. og:url covers social sharing; canonical covers Google + AI crawlers explicitly.

Meta Robots TagWarning

"noindex, nofollow" — page is set to noindex (hidden from search)

Why it matters: A noindex tag completely removes the page from search results. It's frequently left on by accident after a site goes live — one of the most damaging silent SEO bugs — but it's also set deliberately on staging/utility pages, so verify intent rather than assume a defect.

How to fix: If this is your live public page, remove 'noindex' from the meta robots tag immediately — it removes the page from Google. If this is intentional (staging, thank-you, or filtered page), you can ignore this.

Image Format OptimizationWarning

0% next-gen formats — 0 JPEG, 3 PNG images

Why it matters: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.

How to fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.

Excessive Resource RequestsWarning

41 JS + 28 CSS = 69 external requests

Why it matters: Google's crawl budget is limited. Sites with excessive resources get crawled less frequently and experience slower indexation of new content.

How to fix: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.

Meta TitlePassed

30 chars — "Prihlásenie - PROENERGY PORTAL"

H1 HeadingPassed

"Prihlásenie"

Twitter/X CardsPassed

Card type: summary_large_image

Structured Data (JSON-LD)Passed

1 block(s): WebPage, ReadAction, BreadcrumbList, ListItem

JSON-LD ValidityPassed

1 block(s) parse cleanly

robots.txtPassed

Present, references sitemap

XML SitemapPassed

Sitemap index with 6 child sitemaps

HTML Language AttributePassed

lang="sk-SK"

Hreflang Tags (Multilingual)Passed

3 language(s): sk, cs, en

Image Alt AttributesPassed

100% of 7 images have alt text

FaviconPassed

Favicon detected

Semantic HTML StructurePassed

6/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>, <aside>

Empty/Dead LinksPassed

2 minor dead link(s) — acceptable

Accessibility FundamentalsPassed

4/4 a11y signals: 11 ARIA roles, 5 ARIA labels, skip link, lang="sk-SK"

Sitemap FreshnessPassed

Newest <lastmod> 146 day(s) ago

Security

60/100

Weight: 15% · 7 OK · 8 warnings · 2 failures · 17 total

HSTS (Strict-Transport-Security)Failed

Why it matters: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.

How to fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.

Content-Security-Policy (CSP)Failed

Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

DNSSECWarning

No DNSKEY records — zone is unsigned

Why it matters: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.

How to fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.

CAA DNS RecordWarning

No CAA records — any CA can issue certificates for this domain

Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

X-Content-Type-OptionsWarning

Why it matters: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.

How to fix: Add header: X-Content-Type-Options: nosniff

Referrer-PolicyWarning

Why it matters: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.

How to fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.

Permissions-PolicyWarning

Why it matters: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.

How to fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.

Cookie Security FlagsWarning

1 cookie(s): 1 missing HttpOnly

Why it matters: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.

How to fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.

security.txt (RFC 9116)Warning

Why it matters: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.

How to fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.

CDN / WAF ProtectionWarning

Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.

How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

SSL/TLS CertificatePassed

Valid HTTPS connection established

HTTP → HTTPS RedirectPassed

HTTP properly redirects to HTTPS

Clickjacking ProtectionPassed

X-Frame-Options: SAMEORIGIN

Technology DisclosurePassed

Server: openresty (no version)

Subresource Integrity (SRI)Passed

All cross-origin scripts are auto-updating provider scripts where SRI does not apply

Server Version DisclosurePassed

openresty — version hidden

Password Field SecurityPassed

1 password field(s) — allow password manager autofill

Mobile

72/100

Weight: 10% · 6 OK · 7 warnings · 0 failures · 13 total

Mobile Performance ScoreWarning

71/100 (target: 90+)

Why it matters: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.

How to fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.

Touch Target SizeWarning

Some tappable targets are too small or too close together (Lighthouse tap-targets audit)

Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityWarning

Some text renders below the 12px legibility threshold (Lighthouse font-size audit)

Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.

How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

Theme ColorWarning

Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.

How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.

Inline CSS SizeWarning

107 KB of inline CSS

Why it matters: Large inline CSS blocks increase initial HTML download and parsing time — especially painful on mobile with limited CPU and slower connections.

How to fix: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.

Responsive Images (srcset)Warning

7 images without responsive sizing

Why it matters: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.

How to fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.

Apple Mobile Web AppWarning

Missing: apple-mobile-web-app-capable, status-bar-style

Why it matters: These tags enable 'Add to Home Screen' on iOS with a full-screen experience. A polished home screen presence increases return visits.

How to fix: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.

Viewport ConfigurationPassed

width=device-width, initial-scale=1

Content Fits ViewportPassed

No horizontal scrolling needed

Responsive Design TechniquesPassed

Flexbox, CSS Grid, Media queries detected

Mobile Navigation (Semantic)Passed

<nav> element present — proper navigation landmark

Form Input Labels (WCAG 3.3.2)Passed

2/2 inputs have a label

Heading Hierarchy (WCAG 1.3.1)Passed

No skipped heading levels

AI Readiness

48/100

Weight: 10% · 7 OK · 12 warnings · 7 failures · 29 total

Content Accessibility for AIFailed

Only 33 words visible in HTML — content may be JS-dependent

Why it matters: AI crawlers see only raw HTML. Content that only appears after JavaScript runs is invisible to them. Server-rendered content is the primary prerequisite for AI visibility.

How to fix: Your page has very little content in the HTML source. If you're using a JavaScript framework (React, Vue, Angular), implement Server-Side Rendering (SSR) or Static Site Generation (SSG).

Content Depth for AIFailed

Only 33 words — too thin for AI citation

Why it matters: Pages with very little content are nearly invisible to AI search. Without substance, AI has nothing to quote, summarize, or recommend.

How to fix: Your page has critically low content. Add: comprehensive product descriptions, feature lists, FAQs, buying guides, comparison tables, and trust signals (reviews, certifications, guarantees).

Answer-First Content FormatFailed

No meaningful opening content for AI to extract

Why it matters: Without a clear opening paragraph, AI assistants can't generate a useful summary of your page. They'll skip to competitor pages that provide immediate, quotable content.

How to fix: Add a strong opening paragraph (50-100 words) that summarizes what this page offers. AI assistants use the first paragraph as the primary citation source.

Heading Hierarchy for AIFailed

1 H1, 1 H2, 0 H3 — poor structure

Why it matters: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

How to fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).

Entity Clarity & Brand SignalsFailed

Why it matters: AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.

How to fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.

Canonical Tag for AI DeduplicationFailed

Why it matters: Without a canonical tag, AI models may index multiple versions of the same page (with/without trailing slash, with parameters, etc.), diluting your AI visibility across duplicate URLs.

How to fix: Add <link rel='canonical' href='https://your-absolute-url'> to every page. This tells AI engines which URL is the authoritative version of this content.

Image Alt Text Quality for AIFailed

Only 0% quality alt text — 0 missing, 5 poor

Why it matters: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

How to fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.

Organization Schema + Entity LinkingWarning

Organization schema found but no sameAs links

Why it matters: sameAs links tell AI that this is the same entity across the web. It's how Google builds Knowledge Panels and how AI attributes information to your brand.

How to fix: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.

FAQ Schema (Direct AI Answers)Warning

Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.

How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Structured Content (Lists & Tables)Warning

2 lists found — consider adding comparison tables

Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.

How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.

Content Freshness SignalsWarning

Schema dates found but no visible date on page

Why it matters: AI models weight recency in their citation algorithms. Freshness signals tell AI your content is current and reliable.

How to fix: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.

Author Expertise Signals (E-E-A-T)Warning

Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.

How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Extractable Answer BlocksWarning

3 paragraphs, avg 6 words — too short for citation

Why it matters: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.

How to fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.

Statistics & Data PresenceWarning

No statistical data found in content

Why it matters: Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics.

How to fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.

Q&A Format HeadingsWarning

Why it matters: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

How to fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.

Expert Quotations & CitationsWarning

Why it matters: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

How to fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

WebMCP Agentic ReadinessWarning

Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

Content-to-Boilerplate RatioWarning

32% in main content area — too much boilerplate

Why it matters: AI crawlers specifically target <main> and <article> content blocks. If most of your text is in navigation, footers, and sidebars, AI gets noise instead of signal — reducing citation quality.

How to fix: Move more content into <main> or <article> elements. Reduce navigation text, footer content, and sidebar noise. AI crawlers extract content from semantic containers and discard the rest.

Social Proof (Testimonials / Case Studies)Warning

Why it matters: Without visible social proof, B2B prospects can't verify your track record before reaching out. Missing testimonials and case studies is a common reason consultancy sites lose qualified leads at the contact stage.

How to fix: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is a leading credibility lever.

AI Bot Access PolicyPassed

No AI bot restrictions (allowed by default)

AI agent access (live)Passed

ChatGPT-User and PerplexityBot get the same page as a browser

Structured Data FoundationPassed

1 JSON-LD blocks with 4 distinct schema types: WebPage, BreadcrumbList, WebSite, BusinessEntity

Breadcrumb SchemaPassed

BreadcrumbList structured data found — clear navigation hierarchy

Site Search Schema (SearchAction)Passed

WebSite SearchAction configured — AI can search your store

Semantic HTML StructurePassed

6/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>, <aside>

Knowledge Graph ReadinessPassed

3/4 entity signals — strong Knowledge Graph presence

llms.txt (AI Site Descriptor)Info

Not present — not required for AI visibility

Why it matters: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.

How to fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

llms-full.txt (Complete AI Content)Info

Not present — not required for AI visibility

Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

ai.txt (AI Permissions)Info

Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt

Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.

Legal & Compliance

65/100

Weight: 10% · 6 OK · 6 warnings · 1 failures · 13 total

Privacy Policy PageFailed

Why it matters: A missing privacy policy is one of the most frequently cited GDPR violations. Every EU data protection authority considers it a basic requirement.

How to fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).

GDPR Art. 12 · GDPR Art. 13 · GDPR Art. 14 · SK 18/2018 § 19 · SK 18/2018 § 20

Cookie PolicyWarning

Why it matters: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

How to fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.

Legal Contact / Imprint PageWarning

Why it matters: In DACH countries, a missing Impressum can trigger fines and competitor cease-and-desist letters. For all EU stores, identifying the data controller is a GDPR Article 13 requirement.

How to fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).

Terms & Conditions PageWarning

Why it matters: EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights.

How to fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.

Forms Without Privacy NoticeWarning

1 form(s) on page with no privacy policy link

Why it matters: GDPR Article 13 requires informing users about data processing at the point of collection. Forms without privacy notices violate the transparency principle.

How to fix: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.

Right to Erasure (Data Deletion)Warning

Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.

How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Withdrawal of Consent MechanismWarning

Why it matters: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.

How to fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.

Cookie Consent Banner (CMP)Passed

Cookiebot detected

Tracking Scripts & ConsentPassed

No tracking scripts detected

Data Encryption (No Mixed Content)Passed

All resources loaded over HTTPS

Third-party Data SharingPassed

1 third-party domain(s)

Newsletter ConsentPassed

Newsletter form with consent mechanism detected

Data Protection Officer ContactPassed

DPO / data protection contact found

Vulnerability

76/100

Weight: 10% · 6 OK · 3 warnings · 2 failures · 14 total

Known Vulnerabilities (CVE)Failed

3 CVEs associated with 1 detected component version

Why it matters: Versions with published CVEs are a prime automated-scanner target — bots (Shodan, Greynoise, Mirai-family) probe for them within minutes. This finding is inferred from the detected version, so confirm the component is actually unpatched before treating it as exploitable.

How to fix: Update WordPress 6.1.1 → 6.7 (CVE-2024-31210, CVE-2023-39999, CVE-2023-2745). Verify each before acting — a host or distro can backport a security patch while the version string still reads as vulnerable, so a detected CVE is not proof your install is affected. CVE details: CVE-2024-31210: https://nvd.nist.gov/vuln/detail/CVE-2024-31210 · CVE-2023-39999: https://nvd.nist.gov/vuln/detail/CVE-2023-39999 · CVE-2023-2745: https://nvd.nist.gov/vuln/detail/CVE-2023-2745

CMS Version DisclosureFailed

"WordPress 6.1.1" exposed in meta generator

Why it matters: Knowing your exact CMS version lets attackers search CVE databases instantly. E.g., PrestaShop 1.7.8.x is associated with known SQL injection CVEs. Hiding the version forces attackers to guess.

How to fix: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.

CMS Information FilesWarning

readme.html accessible — reveals version details

Why it matters: Even if you hide the generator tag, readme.html and CHANGELOG.txt reveal exact version numbers. Attackers check these as a fallback.

How to fix: Delete or block access to readme.html. These files reveal your exact CMS version and update history.

CMS VersionWarning

WordPress 6.1.1 — update available

Why it matters: Outdated CMS versions miss security patches. Each update typically fixes 5-15 security issues. Staying current is among the most effective defenses against automated attacks.

How to fix: Update WordPress to the latest version for security patches, performance improvements, and new features.

Cross-Origin IsolationWarning

Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

Sensitive Files ExposedPassed

.env, .git, composer.json — all properly blocked

Install Script ExposedPassed

No /install/ or /setup/ paths accessible

Directory ListingPassed

Disabled — file structure hidden

Admin Panel at Default URLPassed

Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)

Debug Mode / Error ExposurePassed

No debug indicators found in page output

Form CSRF ProtectionPassed

1 form(s) — all have CSRF tokens

SPF Record (Email Security)Info

No SPF record, and no MX — this domain doesn't send/receive email, so deliverability isn't affected

Why it matters: Attackers spoof unprotected domains (even ones that never send email) in phishing. A hard-fail SPF (v=spf1 -all) plus DMARC p=reject stops your domain being used to impersonate you — this is the M3AAWG/NCSC guidance for non-sending domains.

How to fix: Even a non-sending domain should block spoofing: publish an explicit null-sending SPF record — v=spf1 -all — so no server can forge mail as this domain.

DMARC Policy (Email Auth)Info

No DMARC record, and no MX — this domain doesn't handle email, so deliverability isn't affected

Why it matters: Domains with no email are still spoofed by attackers. A DMARC p=reject (with SPF -all) tells receivers to drop any mail claiming to be from this domain — closing the impersonation vector without affecting any real mail (there is none).

How to fix: Publish an anti-spoofing DMARC record even on a non-sending domain: at _dmarc.yourdomain.com set v=DMARC1; p=reject; — paired with SPF v=spf1 -all it prevents your domain being forged in phishing.

Email InfrastructureInfo

No MX records — domain does not receive email

Accessibility / EAA

100/100

Weight: 10% · 8 OK · 0 warnings · 0 failures · 9 total

Page LanguagePassed

<html lang="sk-SK"> is set

Image Alt TextPassed

All 7 images have alt attributes

Form LabelsPassed

All 2 form inputs are labelled

Heading StructurePassed

Single <h1> with a consistent heading outline

Link TextPassed

Links use descriptive text

Landmark RegionsPassed

Semantic landmarks present (<main>, <nav>/<header>)

Zoom & ScalingPassed

Pinch-zoom is not disabled

Skip LinkPassed

A skip-to-content link is present

EAA Legal BasisInfo

In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.

Next steps

Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/dev.proenergy.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk