Average

Score Report

eponeshop.sk

Scanned on October 8, 2026

Unknown
jQuery 1.11.3
openresty
Company:EPONESHOP s.r.o.· NACE 4778
NIS2: out of scope
Risk:10/100low
Credit:A+
VAT registered
Top 13% in sector
Full company profile →
Last scanned: October 8, 2026
AI verdict

Your site works reasonably well but has security gaps to close. Immediately enable HTTPS protection (HSTS) in your server settings. Bright spot: your SEO and accessibility are performing well.

Not subject to NIS2 cybersecurity duties.Based on NACE sector + company size, Article 21 compliance is not mandatory. Security best practices still recommended.
Supplying a NIS2-regulated company?Even outside direct scope you may inherit supply-chain duties — regulated companies cascade them to suppliers by contract (security, incident reporting, encryption). ICT and managed-service providers are in scope regardless of size.
Check supplier obligations Legal basis: NIS2 Art. 21 · SK 366/2024 §21 · NIS2 Art. 21(2)(d)
Action plan

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

How we rank →

Quick wins

5

High impact, little work. Do these first.

Bigger projects

12

High impact, but the fix needs planning.

+7 more

Small fixes

17

Lower impact, quick to do.

+12 more

Later

47

Lower impact and more work. Plan them once the rest is done.

+42 more

Performance

Weight: 25% · 10 passed · 5 warnings · 2 failed · 2 SPA (verify manually)

What we found: 4.2 MB, 85 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Evidence:PSI-lab· Confidence: high
Get Performance Optimization →

What we found: Only 29% of 7 scripts optimized — most are render-blocking

Why it matters: 5 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
Evidence:HTML-heuristic· Confidence: high
Get Performance Optimization →

What we found: 860 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked

Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.

How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
Evidence:PSI-lab860 KB JavaScript· Confidence: high

What we found: 85 requests — over the budget of 80, but at or below the median of the award-winning shops we benchmarked (140)

Why it matters: The 80-request bar is best practice; the benchmarked cohort median is 140 and the best shop manages 37. Being under the median is not the same as being fast.

How to fix: Bundle CSS/JS that always loads together, serve icons as a sprite or font rather than individual files, and lazy-load below-fold images so they aren't requested on load.
Evidence:PSI-lab85 requests· Confidence: high

What we found: 176 KB unused (CSS: 50 KB, JS: 126 KB)

Why it matters: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
Evidence:PSI-lab· Confidence: low

What we found: 4 images without lazy loading

Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.

How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: no-store, no-cache, must-revalidate, no-cache, private

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Evidence:HTTP-header· Confidence: high
Request quote for speed audit

7 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Full e-commerce audit — 50+ checks across 7 categories
75/100
Grade C
eponeshop.sk
EPONESHOP s.r.o.
Audit date: October 8, 2026
NACE: 4778
Online report: https://score.zulien.sk/r/eponeshop.sk
Generated · score.zulien.sk · by Zulien

Executive summary

16
Failures
65
Warnings
69
OK
173
Checks total

Scores by category

CategoryScoreWeightFailuresWarningsOK
Performance88/10025%2510
SEO89/10020%0619
Security60/10015%278
Mobile70/10010%1115
AI Readiness55/10010%4247
Legal & Compliance64/10010%258
Vulnerability57/10010%556
Accessibility / EAA86/10010%026

Critical findings

Total Page Weight· Performance
Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
Script Loading Strategy· Performance
5 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.
HSTS (Strict-Transport-Security)· Security
Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Content-Security-Policy (CSP)· Security
CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
Form Input Labels (WCAG 3.3.2)· Mobile
The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures.
Content Freshness Signals· AI Readiness
With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
Extractable Answer Blocks· AI Readiness
AI assistants extract individual paragraphs as citations. Without clear, self-contained content blocks, your page can't be quoted in AI-generated answers.
Common Question Coverage· AI Readiness
AI assistants answer shopping queries by fanning out into price/shipping/returns/availability/payment sub-questions. A page that answers none of them is invisible in AI shopping answers and reads as untrustworthy to buyers.
Content-to-Boilerplate Ratio· AI Readiness
Token density measures useful content vs noise. Pages with under 30% content ratio are hard for AI to parse — it can't find your content in the boilerplate.
Privacy Policy Page· Legal & Compliance
A missing privacy policy is one of the most frequently cited GDPR violations. Every EU data protection authority considers it a basic requirement.
Consumer Dispute Resolution Links· Legal & Compliance
EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach.
Known Vulnerabilities (CVE)· Vulnerability
Versions with published CVEs are a prime automated-scanner target — bots (Shodan, Greynoise, Mirai-family) probe for them within minutes. This finding is inferred from the detected version, so confirm the component is actually unpatched before treating it as exploitable.

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

Quick wins (5)

High impact, little work. Do these first.

FindingCategoryEffort
Admin Panel at Default URLVulnerabilityquick fix
HTTP → HTTPS RedirectSecurityquick fix
HSTS (Strict-Transport-Security)Securityquick fix
Consumer Dispute Resolution LinksLegal & Compliancequick fix
DMARC Policy (Email Auth)Vulnerabilityquick fix

Bigger projects (12)

High impact, but the fix needs planning.

FindingCategoryEffort
Privacy Policy PageLegal & Complianceabout a day
Known Vulnerabilities (CVE)Vulnerabilityproject
Script Loading StrategyPerformanceabout a day
Content-Security-Policy (CSP)Securityabout a day
Form Input Labels (WCAG 3.3.2)Mobileabout a day
jQuery VersionVulnerabilityabout a day
Mixed Content ResourcesVulnerabilityabout a day
Payment Page SecurityVulnerabilityabout a day
Total Page WeightPerformanceproject
Extractable Answer BlocksAI Readinessproject
Common Question CoverageAI Readinessproject
Content-to-Boilerplate RatioAI Readinessproject

Small fixes (17)

Lower impact, quick to do.

FindingCategoryEffort
Cache-Control StrategyPerformancequick fix
Meta DescriptionSEOquick fix
Twitter/X CardsSEOquick fix
Canonical URL ConsistencySEOquick fix
CAA DNS RecordSecurityquick fix
Referrer-PolicySecurityquick fix
Permissions-PolicySecurityquick fix
Cookie Security FlagsSecurityquick fix
Subresource Integrity (SRI)Securityquick fix
Theme ColorMobilequick fix
Text Overflow HandlingMobilequick fix
Print StylesheetMobilequick fix

+5 more

Later (47)

Lower impact and more work. Plan them once the rest is done.

FindingCategoryEffort
Lazy LoadingPerformanceabout a day
Image Format OptimizationSEOabout a day
Internal LinkingSEOabout a day
CDN / WAF ProtectionSecurityabout a day
Touch Target SizeMobileabout a day
Font Size ReadabilityMobileabout a day
PWA FeaturesMobileabout a day
Responsive Images (srcset)Mobileabout a day
Mobile Sticky CTAMobileabout a day
Heading Hierarchy (WCAG 1.3.1)Mobileabout a day
Link Text Quality (WCAG 2.4.4)Mobileabout a day
Structured Data FoundationAI Readinessabout a day

+35 more

Performance

88/100
Weight: 25% · 10 OK · 5 warnings · 2 failures · 19 total
Total Page WeightFailed
4.2 MB, 85 requests — too heavy!
Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Script Loading StrategyFailed
Only 29% of 7 scripts optimized — most are render-blocking
Why it matters: 5 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.
How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
JavaScript BudgetWarning
860 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked
Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.
How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
Request BudgetWarning
85 requests — over the budget of 80, but at or below the median of the award-winning shops we benchmarked (140)
Why it matters: The 80-request bar is best practice; the benchmarked cohort median is 140 and the best shop manages 37. Being under the median is not the same as being fast.
How to fix: Bundle CSS/JS that always loads together, serve icons as a sprite or font rather than individual files, and lazy-load below-fold images so they aren't requested on load.
Unused Code (CSS + JS)Warning
176 KB unused (CSS: 50 KB, JS: 126 KB)
Why it matters: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.
How to fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
Lazy LoadingWarning
4 images without lazy loading
Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.
How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
Cache-Control StrategyWarning
no-store, no-cache, must-revalidate, no-cache, private
Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.
How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Server Response Time (TTFB)Passed
7ms
First Contentful Paint (FCP)Passed
0.85s
Largest Contentful Paint (LCP)Passed
0.85s — Core Web Vital ✓
Total Blocking Time (TBT)Passed
130ms
Cumulative Layout Shift (CLS)Passed
0.023 — Core Web Vital ✓
Speed IndexPassed
0.87s
Text Compression (gzip/brotli)Passed
All text resources properly compressed
Resource Hints (Preload/Preconnect)Passed
1 preload, 1 preconnect hint(s)
HTTP/3 (QUIC) SupportPassed
HTTP/3 enabled via Alt-Svc header
CSS File CountPassed
5 CSS file(s) — well consolidated
Third-party ServicesInfo
Not measured — PageSpeed did not return the third-party audit for this URL
Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.
How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Category 1 / 8 · eponeshop.sk · Zulien Score

SEO

89/100
Weight: 20% · 19 OK · 6 warnings · 0 failures · 25 total
Meta DescriptionWarning
77 chars (optimal: 120-160)
Why it matters: Short descriptions waste SERP real estate and miss the chance to persuade searchers to click.
How to fix: Expand your description to at least 120 characters. Include benefits, a CTA, and your target keyword.
Twitter/X CardsWarning
Why it matters: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.
How to fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
Text-to-HTML RatioWarning
4% — low content density (304 words)
Why it matters: A low text-to-HTML ratio signals thin content to Google. Pages with more useful text rank higher and convert better.
How to fix: Add more unique text content. Write detailed product descriptions, buying guides, and FAQ sections.
Image Format OptimizationWarning
0% next-gen formats — 0 JPEG, 1 PNG images
Why it matters: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.
How to fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
Canonical URL ConsistencyWarning
Canonical points to different URL: https://www.eponeshop.sk/
Why it matters: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.
How to fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
Internal LinkingWarning
Only 6 internal links
Why it matters: Internal links help Google discover and rank your pages. Pages with more internal links receive higher PageRank and are crawled more frequently.
How to fix: Add more internal links to related content. Target 10+ internal links per page for strong site crawlability.
Meta TitlePassed
31 chars — "Vitajte v eshope - Eponeshop.sk"
H1 HeadingPassed
"Vitajte v eshope"
Content Structure (H2 Headings)Passed
6 H2 subheadings found
Open Graph TagsPassed
og:title, og:description, og:image, og:type
Open Graph Image FormatPassed
image/png
Canonical URLPassed
https://www.eponeshop.sk/
Structured Data (JSON-LD)Passed
1 block(s): Organization
JSON-LD ValidityPassed
1 block(s) parse cleanly
robots.txtPassed
Present, references sitemap
XML SitemapPassed
Found with 27 URLs
HTML Language AttributePassed
lang="sk"
Image Alt AttributesPassed
100% of 4 images have alt text
Meta Robots TagPassed
index,follow
FaviconPassed
Favicon detected
Semantic HTML StructurePassed
5/6 semantic elements: <nav>, <main>, <header>, <footer>, <aside>
Content DepthPassed
304 words — sufficient content
Deep Heading HierarchyPassed
H2: 6, H3: 10 — well-structured content
Empty/Dead LinksPassed
4 minor dead link(s) — acceptable
Accessibility FundamentalsPassed
4/4 a11y signals: 79 ARIA roles, 7 ARIA labels, skip link, lang="sk"
Category 2 / 8 · eponeshop.sk · Zulien Score

Security

60/100
Weight: 15% · 8 OK · 7 warnings · 2 failures · 18 total
HSTS (Strict-Transport-Security)Failed
Why it matters: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
How to fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
Content-Security-Policy (CSP)Failed
Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
CAA DNS RecordWarning
No CAA records — any CA can issue certificates for this domain
Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
HTTP → HTTPS RedirectWarning
Why it matters: Without a redirect, users can access the insecure HTTP version. Google also treats http and https as separate URLs, splitting your SEO signals.
How to fix: Configure a 301 redirect from http:// to https:// for all pages. In Apache: RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Referrer-PolicyWarning
Why it matters: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.
How to fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
Permissions-PolicyWarning
Why it matters: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.
How to fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
Cookie Security FlagsWarning
3 cookie(s): 2 missing HttpOnly, 2 missing SameSite
Why it matters: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.
How to fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
Subresource Integrity (SRI)Warning
Only 0/6 SRI-eligible third-party scripts have integrity hashes (1 auto-updating provider script(s) excluded — SRI not applicable)
Why it matters: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.
How to fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
CDN / WAF ProtectionWarning
Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.
How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
SSL/TLS CertificatePassed
Valid HTTPS connection established
DNSSECPassed
Zone is DNSSEC-signed (DNSKEY published)
Why it matters: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.
Clickjacking ProtectionPassed
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
X-Content-Type-OptionsPassed
nosniff
Technology DisclosurePassed
Server: openresty (no version)
security.txt (RFC 9116)Passed
Present at /.well-known/security.txt
Server Version DisclosurePassed
openresty — version hidden
Password Field SecurityPassed
2 password field(s) — allow password manager autofill
Cookie Prefix SecurityInfo
1 session cookie(s) already have Secure + HttpOnly + SameSite; adding the __Host- prefix is a cosmetic hardening nicety
Why it matters: With Secure, HttpOnly and SameSite already set, the prefix adds only host-only enforcement — low marginal benefit.
How to fix: Optional: rename to __Host-session (Secure; Path=/; no Domain) for defence-in-depth against subdomain cookie injection.
Category 3 / 8 · eponeshop.sk · Zulien Score

Mobile

70/100
Weight: 10% · 5 OK · 11 warnings · 1 failures · 20 total
Form Input Labels (WCAG 3.3.2)Failed
Only 6/8 inputs have a label (75%)
Why it matters: The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures.
How to fix: 2 input elements have no label. Every input needs a matching <label for="id">Text</label> or an aria-label. A placeholder is NOT a label (WCAG 3.3.2). On a checkout or registration form this costs conversion and breaches EN 301 549 (EAA 2026).
Mobile Performance ScoreWarning
74/100 (target: 90+)
Why it matters: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.
How to fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
Touch Target SizeWarning
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityWarning
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
PWA FeaturesWarning
Why it matters: PWAs combine the best of web and native apps. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access.
How to fix: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.
Theme ColorWarning
Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Responsive Images (srcset)Warning
4 images without responsive sizing
Why it matters: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.
How to fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
Mobile Sticky CTAWarning
Add-to-cart button found but no sticky/fixed positioning detected
Why it matters: Mobile users scroll extensively. A sticky add-to-cart bar keeps the primary action visible. Without it, users must scroll back up to purchase — many won't.
How to fix: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.
Text Overflow HandlingWarning
No word-break/overflow-wrap CSS detected
Why it matters: Long strings without word-break cause horizontal overflow on mobile — a common cause of 'content wider than viewport' failures. Compound words and URLs are frequent culprits.
How to fix: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
Print StylesheetWarning
Order/invoice page without print styles
Why it matters: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.
How to fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
Heading Hierarchy (WCAG 1.3.1)Warning
Skipped levels: h1→h3
Why it matters: Skipped heading levels (h1 straight to h3) break screen-reader navigation and signal poor document structure to Google. SEO suffers too.
How to fix: Keep headings in order h1 → h2 → h3 → h4 with no skipped levels. Screen readers use the heading hierarchy to navigate. If you want smaller text at the same level, use a CSS class rather than a lower heading tag.
Link Text Quality (WCAG 2.4.4)Warning
1 links have generic text ("click here", "more", "here"...)
Why it matters: WCAG 2.4.4: the purpose of a link must be clear from its text. Vague links hurt usability, conversion and SEO (Google reads anchor text for relevance).
How to fix: Replace 'Click here' and 'Read more' with descriptive text: 'Read more about GDPR', 'See module pricing'. Screen readers read links out of context, so a bare 'more' carries no meaning.
Viewport ConfigurationPassed
width=device-width, initial-scale=1
Content Fits ViewportPassed
No horizontal scrolling needed
Responsive Design TechniquesPassed
Media queries detected
Mobile Navigation (Semantic)Passed
<nav> element present — proper navigation landmark
Form Input TypesPassed
Optimized: 2 email, 2 search
Payment Methods DetectedInfo
No known payment gateway detected on the homepage
Why it matters: Visible payment icons (Apple Pay, Google Pay, Klarna, Tatra Pay) in the header or footer lift conversion. A trust signal before checkout.
How to fix: Payment gateway detection only scans the homepage. If payments live on /checkout or are loaded by JS after an interaction, we cannot see them. Consider adding payment icons to the footer.
Express Checkout (Apple Pay + Google Pay)Info
Apple Pay / Google Pay not detected on the homepage — express checkout usually appears only in the cart or checkout
Why it matters: Mobile conversion with express checkout beats manual card entry, and it is a growing trend in SK/CZ. (The scan only sees the homepage, so treat this as a hint rather than a verdict.)
How to fix: If you have no express checkout, add Apple Pay and Google Pay via Stripe, Adyen or Mollie. Biometric auth removes a click from checkout, which lifts conversion.
SK/CZ Local Payment MethodsInfo
No SK/CZ local payment method detected on the homepage — bank buttons and QR payment usually appear only in checkout
Why it matters: An SK/CZ shop without bank buttons and QR payment sees heavy cart abandonment; the average Slovak e-shop offers several payment methods. (The scan only sees the homepage — verify in your checkout.)
How to fix: If you do not offer SK/CZ local payments, integrate GoPay or ComGate — both cover Tatra Pay, VÚB Pay, ČSOB Pay, Raiffeisen and QR payment through one API. Barion is an alternative for the CZ market.
Category 4 / 8 · eponeshop.sk · Zulien Score

AI Readiness

55/100
Weight: 10% · 7 OK · 24 warnings · 4 failures · 49 total
Content Freshness SignalsFailed
Why it matters: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
How to fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
Extractable Answer BlocksFailed
Too few content paragraphs for AI to extract
Why it matters: AI assistants extract individual paragraphs as citations. Without clear, self-contained content blocks, your page can't be quoted in AI-generated answers.
How to fix: Add structured content with clear, focused paragraphs (40-80 words each). Each paragraph should answer one question or make one claim that AI can quote directly.
Common Question CoverageFailed
Answers only 1/5 key shopper questions: returns/refunds
Why it matters: AI assistants answer shopping queries by fanning out into price/shipping/returns/availability/payment sub-questions. A page that answers none of them is invisible in AI shopping answers and reads as untrustworthy to buyers.
How to fix: Your page barely addresses core shopper questions. Add sections covering price, shipping (options + cost), returns/refunds, availability, and payment methods — as visible text, not just in schema. Link to a dedicated FAQ, Shipping, and Returns page.
Content-to-Boilerplate RatioFailed
Only 9% in main content — mostly boilerplate
Why it matters: Token density measures useful content vs noise. Pages with under 30% content ratio are hard for AI to parse — it can't find your content in the boilerplate.
How to fix: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
Structured Data FoundationWarning
Only 1 distinct schema type (BusinessEntity) — insufficient for AI visibility
Why it matters: Single-schema sites get minimal AI coverage. AI models need multiple data signals to confidently recommend your store.
How to fix: One schema type is not enough. Add at minimum: Organization (identity), Product (commerce), BreadcrumbList (navigation), WebSite+SearchAction (discoverability), FAQPage (Q&A answering).
Organization Schema + Entity LinkingWarning
Organization schema found but no sameAs links
Why it matters: sameAs links tell AI that this is the same entity across the web. It's how Google builds Knowledge Panels and how AI attributes information to your brand.
How to fix: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.
FAQ Schema (Direct AI Answers)Warning
Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Breadcrumb SchemaWarning
Why it matters: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.
How to fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
Site Search Schema (SearchAction)Warning
Why it matters: SearchAction enables Google's sitelinks search box and allows AI shopping assistants to search your catalog directly. It's how AI agents find specific products in your store.
How to fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
Content Depth for AIWarning
304 words — add more for better AI citations
Why it matters: AI assistants skip thin pages in favor of content-rich competitors. Aim for the depth that makes your page the definitive resource.
How to fix: Expand to 500+ words: add detailed product descriptions, use cases, benefits, specifications, comparison info, and buying guides. AI needs substantial content to summarize and cite.
Answer-First Content FormatWarning
Content doesn't start with a strong summary paragraph
Why it matters: AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often.
How to fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
Structured Content (Lists & Tables)Warning
14 lists found — consider adding comparison tables
Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.
How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
Entity Clarity & Brand SignalsWarning
OG tags complete but no sameAs entity links
Why it matters: AI needs to confidently identify your brand entity. Open Graph and sameAs together create a cross-platform identity that AI models recognize.
How to fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
Author Expertise Signals (E-E-A-T)Warning
Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.
How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Product Feed (AI Commerce)Warning
Why it matters: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.
How to fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
Heureka XML FeedWarning
Why it matters: Heureka.sk and Heureka.cz are the dominant price comparison engines on the SK/CZ market. Without an XML feed you're not visible on the main marketplace. No generic audit tool checks this.
How to fix: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).
Statistics & Data PresenceWarning
Only 2 data point(s) — add more
Why it matters: AI assistants prefer content with verifiable data points and quantified claims — they're the most quotable parts of a page.
How to fix: Add specific statistics, percentages, dollar amounts, and quantified claims. E.g., '93% of customers report...', 'saves an average of €200/year', '3x faster than...' Data makes content citable.
Section Length OptimizationWarning
Avg section: 115 words — only 14% in 80-200 word optimal range
Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsWarning
1 question heading(s) — add more
Why it matters: AI search engines like Perplexity and ChatGPT match user questions to heading-answer pairs. Q&A format headings are directly extractable by AI and trigger FAQ-style rich results.
How to fix: Phrase H2/H3 headings as questions: 'How does...?', 'What is...?', 'Why should...?' followed by a direct 1-2 sentence answer. This is a leading format AI assistants use to generate responses.
Canonical Tag for AI DeduplicationWarning
Canonical points to different URL: https://www.eponeshop.sk/
Why it matters: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.
How to fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
Return Policy SchemaWarning
Why it matters: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.
How to fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
Shipping Details SchemaWarning
Why it matters: Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver.
How to fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
Knowledge Graph ReadinessWarning
2/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn)
Why it matters: @id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity.
How to fix: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
Content Readability for AIWarning
Grade 20 — too complex for broad AI citation (technical threshold: 14)
Why it matters: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.
How to fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Image Alt Text Quality for AIWarning
50% good, 2 poor, 0 missing
Why it matters: AI uses alt text to understand images for visual search (Google Lens, Bing Visual Search), product recommendations, and accessibility. Quality alt text opens more discovery channels.
How to fix: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.
Expert Quotations & CitationsWarning
1 quotation found — add more for authority
Why it matters: AI assistants weight content with expert quotes and citations higher. Blockquotes signal that your content is backed by authoritative sources — a key E-E-A-T signal.
How to fix: Add expert quotes, customer testimonials, or industry citations using <blockquote> elements.
WebMCP Agentic ReadinessWarning
Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
Trust WidgetWarning
No trust widget (Heureka / Trustpilot / AggregateRating) detected
Why it matters: SK/CZ buyers trust Heureka Ověřeno more than other trust signals. LLMs (ChatGPT, Perplexity) and Google SGE cite shops with AggregateRating schema first.
How to fix: For SK/CZ shops: install the Heureka Ověřeno zákazníky widget (free for verified sellers — https://sluzby.heureka.sk). Alternatives: Trustpilot, Google Reviews with AggregateRating schema. Place the trust widget on product + category + footer.
AI Bot Access PolicyPassed
No AI bot restrictions (allowed by default)
AI agent access (live)Passed
ChatGPT-User and PerplexityBot get the same page as a browser
Content Accessibility for AIPassed
304 words in raw HTML (3.7% text ratio) — readable by AI crawlers without executing JS
Zero-results RecoveryPassed
A search with no matches still offers products, suggestions or a way to get help
Heading Hierarchy for AIPassed
Proper structure: 1 H1 → 6 H2s → 10 H3s — clear content outline
Semantic HTML StructurePassed
5/6 semantic elements: <nav>, <main>, <header>, <footer>, <aside>
Internal Link DensityPassed
20 contextual internal links per 1,000 words — strong knowledge graph signal
llms.txt (AI Site Descriptor)Info
Not present — not required for AI visibility
Why it matters: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.
How to fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
Product Schema CompletenessInfo
No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit
Why it matters: Product schema only belongs on product pages, so its absence on this page is expected — not a defect. Scan a product URL to evaluate it.
How to fix: To audit Product schema, run the scan on a product detail URL. On product pages add: name, description, image, offers (price, priceCurrency, availability), brand, sku, aggregateRating.
Search Typo Handling (measurement)Info
A correctly spelled query and the same query with a typo return similarly sized pages (60319 B vs 60319 B) — consistent with typo tolerance
Why it matters: This is a raw measurement, not a verdict, and it is never scored: page size is only a proxy for result count and themes differ. It is here so you can see what we saw.
How to fix: Verify by hand: search for a product, then search again with one letter transposed. If the second search finds nothing, a search engine with fuzzy matching and synonyms will recover those sales.
Reviews & Ratings SchemaInfo
No review schema on this homepage — review/rating schema typically lives on product pages
Why it matters: Review schema is product-page-specific, so its absence here is expected, not a defect.
How to fix: Scan a product URL to audit review schema. On product pages add AggregateRating (ratingValue, reviewCount, bestRating) and individual Review schemas.
AI Plugin ManifestInfo
Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
Why it matters: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.
GTIN/EAN CoverageInfo
No product feed was sampled — GTIN/EAN coverage could not be verified
Why it matters: GTIN is how an AI shopping agent matches your product to the same product in other shops. Without a feed we cannot measure it — this is not a finding against you.
How to fix: Publish a Google Merchant or Heureka product feed with GTIN/EAN populated, then re-scan to measure coverage.
Speakable Content (Voice AI)Info
Not present — optional; SpeakableSpecification has limited assistant adoption
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Agent-Commerce ReadinessInfo
63/100 — partly ready (Access 100 · Understand 50 · Discover 50 · Transact 50)
Why it matters: Whether an autonomous shopping agent (a ChatGPT operator, Perplexity, the assistants coming next) can do four things on your shop: get in, read and understand the products, discover the whole catalogue, and act (cart, terms). Almost nobody measures this, and for SK/CZ shops nobody does.
Agent: Access — can an agent get inInfo
100/100 (2 signals)
Agent: Understand — can it read the productsInfo
50/100 (2 signals)
Agent: Discover — can it find the whole catalogueInfo
50/100 (3 signals)
Agent: Transact — can it act (cart, terms)Info
50/100 (3 signals)
Category 5 / 8 · eponeshop.sk · Zulien Score

Legal & Compliance

64/100
Weight: 10% · 8 OK · 5 warnings · 2 failures · 17 total
Privacy Policy PageFailed
Why it matters: A missing privacy policy is one of the most frequently cited GDPR violations. Every EU data protection authority considers it a basic requirement.
How to fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).
GDPR Art. 12 · GDPR Art. 13 · GDPR Art. 14 · SK 18/2018 § 19 · SK 18/2018 § 20
Consumer Dispute Resolution LinksFailed
No EU ODR platform or supervisory-authority link found
Why it matters: EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach.
How to fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
Nariadenie (EÚ) 524/2013 (ODR) · Smernica 2013/11/EÚ (ADR) · SK zák. 391/2015 Z.z. · CZ zák. 634/1992 Sb. § 14
Cookie PolicyWarning
Why it matters: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
How to fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
Legal Contact / Imprint PageWarning
Why it matters: In DACH countries, a missing Impressum can trigger fines and competitor cease-and-desist letters. For all EU stores, identifying the data controller is a GDPR Article 13 requirement.
How to fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
Forms Without Privacy NoticeWarning
5 form(s) on page with no privacy policy link
Why it matters: GDPR Article 13 requires informing users about data processing at the point of collection. Forms without privacy notices violate the transparency principle.
How to fix: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.
Right to Erasure (Data Deletion)Warning
Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Withdrawal of Consent MechanismWarning
Why it matters: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.
How to fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
Cookie Consent Banner (CMP)Passed
Cookiebot detected
Tracking Scripts & ConsentPassed
No tracking scripts detected
Terms & Conditions PagePassed
/obchodne-podmienky/
Data Encryption (No Mixed Content)Passed
All resources loaded over HTTPS
Third-party Data SharingPassed
2 third-party domain(s)
Newsletter ConsentPassed
Newsletter form with consent mechanism detected
Data Protection Officer ContactPassed
DPO / data protection contact found
Withdrawal & Complaints PolicyPassed
Withdrawal right + complaints procedure referenced
Online Withdrawal FunctionInfo
No explicit online withdrawal button in the server HTML — it may live in the logged-in account/order area, which this scan can't reach. Verify it's present.
Why it matters: Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually.
How to fix: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.
Legal guarantee noticeInfo
No harmonised notice on the legal guarantee was found on the pages we scanned — it may be on a page this scan does not open. Verify it is shown.
Why it matters: Directive (EU) 2024/825 (amending 2011/83/EU) requires traders to remind consumers, in a harmonised notice prominently displayed on the website, that the legal guarantee of conformity exists and lasts at least 2 years. National rules apply from 27 September 2026.
How to fix: Show the EU harmonised notice on the legal guarantee of conformity as a general reminder on your website (e.g. in the footer or on every product page), using the official design and wording for your language from the Commission implementing act. A 'záruka 24 mesiacov' line on the product is not the same thing — the notice is about the statutory guarantee.
Category 6 / 8 · eponeshop.sk · Zulien Score

Vulnerability

57/100
Weight: 10% · 6 OK · 5 warnings · 5 failures · 16 total
Known Vulnerabilities (CVE)Failed
5 CVEs associated with 1 detected component version
Why it matters: Versions with published CVEs are a prime automated-scanner target — bots (Shodan, Greynoise, Mirai-family) probe for them within minutes. This finding is inferred from the detected version, so confirm the component is actually unpatched before treating it as exploitable.
How to fix: Update jQuery 1.11.3 → 3.7.1 (CVE-2011-4969, CVE-2012-6708, CVE-2015-9251, CVE-2020-11022, CVE-2020-11023). Verify each before acting — a host or distro can backport a security patch while the version string still reads as vulnerable, so a detected CVE is not proof your install is affected. CVE details: CVE-2011-4969: https://nvd.nist.gov/vuln/detail/CVE-2011-4969 · CVE-2012-6708: https://nvd.nist.gov/vuln/detail/CVE-2012-6708 · CVE-2015-9251: https://nvd.nist.gov/vuln/detail/CVE-2015-9251 · CVE-2020-11022: https://nvd.nist.gov/vuln/detail/CVE-2020-11022 · CVE-2020-11023: https://nvd.nist.gov/vuln/detail/CVE-2020-11023
Admin Panel at Default URLFailed
Accessible at: /admin
Why it matters: Default admin URLs receive thousands of automated brute-force attempts daily. Botnets target /admin, /wp-admin, /administrator relentlessly. A renamed path blocks 99% of automated attacks.
How to fix: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).
jQuery VersionFailed
jQuery 1.11.3 — critically outdated!
Why it matters: jQuery 1.x is associated with 6+ known CVEs including XSS and prototype pollution. Automated scanners specifically target sites with jQuery <3.0.
How to fix: jQuery 1.11.3 is associated with multiple known security vulnerabilities. Upgrade to 3.7.x. If your plugins require jQuery 1.x/2.x, use jquery-migrate as a temporary bridge.
DMARC Policy (Email Auth)Failed
Why it matters: Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.
How to fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
Payment Page SecurityFailed
Payment page missing: No HSTS, No CSP
Why it matters: Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.
How to fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
Form CSRF ProtectionWarning
2/5 forms have CSRF tokens
Why it matters: Forms without CSRF tokens allow cross-site request forgery — an attacker's site can submit orders, change settings, or modify data on behalf of your logged-in users.
How to fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
DKIM Signing (Email Auth)Warning
Why it matters: DKIM cryptographically signs outgoing email to prove it comes from your domain. Without DKIM, email providers downgrade trust score — transactional emails land in spam. Gmail and Yahoo require DKIM since 2024 for bulk senders.
How to fix: Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.
Cross-Origin IsolationWarning
Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
Mixed Content ResourcesWarning
1 HTTP resource(s) on HTTPS page
Why it matters: Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site.
How to fix: Replace HTTP URLs with HTTPS: http://www.eponeshop.sk/podmienky-ochrany-osobnych-udajov/
Login Form SecurityWarning
Login form blocks password manager autofill
Why it matters: NIST guidelines recommend allowing password autofill. Blocking it forces users to choose weak, memorable passwords — a leading cause of credential compromise.
How to fix: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
CMS Version DisclosurePassed
No generator tag — CMS identity hidden
Sensitive Files ExposedPassed
.env, .git, composer.json — all properly blocked
Install Script ExposedPassed
No /install/ or /setup/ paths accessible
Directory ListingPassed
Disabled — file structure hidden
Debug Mode / Error ExposurePassed
No debug indicators found in page output
SPF Record (Email Security)Passed
SPF configured: v=spf1 a mx include:_spf.websupport.sk ?all
Category 7 / 8 · eponeshop.sk · Zulien Score

Accessibility / EAA

86/100
Weight: 10% · 6 OK · 2 warnings · 0 failures · 9 total
Form LabelsWarning
2 of 8 form inputs missing a label
Why it matters: Inputs without a programmatic label are inaccessible to assistive technology (WCAG 1.3.1 / EN 301 549 § 9.1.3.1).
How to fix: Add a <label for> or aria-label to the remaining inputs.
Heading StructureWarning
Heading outline issue (h1 count: 1h1→h3)
Why it matters: A clean heading hierarchy is the primary way assistive-tech users skim a page (WCAG 1.3.1 / 2.4.6).
How to fix: Use a single <h1> and don't jump heading levels (e.g. <h2> straight to <h4>).
Page LanguagePassed
<html lang="sk"> is set
Image Alt TextPassed
All 4 images have alt attributes
Link TextPassed
Links use descriptive text
Landmark RegionsPassed
Semantic landmarks present (<main>, <nav>/<header>)
Zoom & ScalingPassed
Pinch-zoom is not disabled
Skip LinkPassed
A skip-to-content link is present
EAA Legal BasisInfo
In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
Category 8 / 8 · eponeshop.sk · Zulien Score

Next steps

  1. Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
  2. Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
  3. Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
  4. Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/eponeshop.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk