# eset.com — Zulien Score 67/100 (Grade C)

> Free e-commerce audit: 67/100 overall score. Company: ESET, spol. s r.o.. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://www.eset.com
- **Company:** ESET, spol. s r.o.
- **Scan date:** 2026-06-18
- **Full report:** https://score.zulien.sk/en/r/eset.com
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/eset.com

## Score by category

| Category | Score |
|---|---|
| Performance | 55/100 |
| SEO | 87/100 |
| Security | 57/100 |
| Mobile | 57/100 |
| AI Readiness | 63/100 |
| GDPR | 84/100 |
| Vulnerability | 65/100 |

## Detailed findings

### Performance — 55/100

- **[FAIL]** Total Blocking Time (TBT) — 5918ms (good: <200ms)
  - Fix: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.
- **[FAIL]** Total Page Weight — 5.8 MB, 161 requests — too heavy!
  - Fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
- **[FAIL]** Unused Code (CSS + JS) — 1305 KB wasted on unused code!
  - Fix: You're loading 1305 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
- **[FAIL]** Script Loading Strategy — Only 18% of 11 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.
- **[WARN]** Largest Contentful Paint (LCP) — 3.56s (good: <2.5s) — Core Web Vital
  - Fix: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.
- **[WARN]** Resource Hints (Preload/Preconnect)
  - Fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
- **[WARN]** Inline JavaScript Size — 544 KB of inline JavaScript
  - Fix: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
- **[PASS]** Server Response Time (TTFB) — 16ms
- **[PASS]** First Contentful Paint (FCP) — 1.07s
- **[PASS]** Cumulative Layout Shift (CLS) — 0.030 — Core Web Vital ✓
- **[PASS]** Speed Index — 1.97s
- **[PASS]** Render-blocking Resources — No render-blocking resources found
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
- **[PASS]** Lazy Loading — 80% of images use native lazy loading (4/5)
- **[PASS]** CSS File Count — 2 CSS file(s) — well consolidated

### SEO — 87/100

- **[FAIL]** Text-to-HTML Ratio — 3% — very thin content (4414 words)
  - Fix: Your page is almost entirely HTML/CSS/JS with very little actual content. Add substantial product descriptions, content blocks, and informational text.
- **[WARN]** Meta Title — 72 chars (optimal: 30-60)
  - Fix: Shorten your title to under 60 characters. Google truncates longer titles with '…' which loses your message.
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
- **[WARN]** Image Alt Attributes — Only 60% of 5 images have alt text
  - Fix: 2 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
- **[WARN]** Image Format Optimization — 0% next-gen formats — 0 JPEG, 4 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
- **[WARN]** Canonical URL Consistency — Canonical points to different URL: https://www.eset.com/us/
  - Fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
- **[PASS]** Meta Description — 152 chars
- **[PASS]** H1 Heading — "AI-Native Prevention for Tomorrow's Threats"
- **[PASS]** Content Structure (H2 Headings) — 3 H2 subheadings found
- **[PASS]** Open Graph Tags — og:title, og:description, og:image
- **[PASS]** Open Graph Image Format — image/jpeg
- **[PASS]** Canonical URL — https://www.eset.com/us/
- **[PASS]** Structured Data (JSON-LD) — 2 block(s): BreadcrumbList, ListItem, Organization, ContactPoint
- **[PASS]** robots.txt — Present, references sitemap
- **[PASS]** XML Sitemap — Found with ~214+ URLs
- **[PASS]** HTML Language Attribute — lang="en-US"
- **[PASS]** Hreflang Tags (Multilingual) — 85 language(s): en-US, sk-SK, cs-CZ, en-CA, fr-CA
- **[PASS]** Meta Robots Tag — index,follow
- **[PASS]** Favicon — Favicon detected
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <header>, <footer>, <aside>
- **[PASS]** Content Depth — 4414 words — sufficient content
- **[PASS]** Deep Heading Hierarchy — H2: 3, H3: 6 — well-structured content
- **[PASS]** Internal Linking — 87 internal links — strong site navigation
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 112 ARIA roles, 17 ARIA labels, lang="en-US"

### Security — 57/100

- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
- **[WARN]** HSTS (Strict-Transport-Security) — missing includeSubDomains
  - Fix: Set: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org for browser preloading.
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
- **[WARN]** Subresource Integrity (SRI) — Only 0/11 external scripts have integrity hashes
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' attributes to all third-party <script> tags. Use srihash.org to generate hashes.
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
- **[WARN]** Iframe Sandboxing — 2/2 iframe(s) without sandbox attribute
  - Fix: Add sandbox attribute to all <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. This restricts iframe capabilities to only what's needed.
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
- **[PASS]** Cookie Security Flags — No cookies set on initial response
- **[PASS]** Technology Disclosure — Server identity hidden

### Mobile — 57/100

- **[FAIL]** Mobile Performance Score — 45/100 — critically slow
  - Fix: Your mobile experience is severely degraded. Priority fixes: 1) Reduce JavaScript by 50%+, 2) Convert all images to WebP with responsive sizing, 3) Enable aggressive caching, 4) Use a CDN.
- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Iba 9/12 inputs má label (75%)
  - Fix: 3 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
- **[WARN]** Touch Target Size
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
- **[WARN]** Font Size Readability
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
- **[WARN]** PWA Features — Has manifest, missing service worker
  - Fix: Add a service worker to enable PWA features. Register a service worker for offline caching and faster repeat visits.
- **[WARN]** Inline CSS Size — 81 KB of inline CSS
  - Fix: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
- **[WARN]** Fixed Width Elements — Large fixed-width elements detected — may cause horizontal scroll
  - Fix: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
- **[WARN]** Express Checkout (Apple Pay + Google Pay)
  - Fix: Pridaj Apple Pay + Google Pay cez Stripe/Adyen/Mollie. Biometric auth = -1 click checkout = vyšší conversion.
- **[INFO]** Payment Methods Detected — Žiadna známa platobná brána nedetekovaná na homepage
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
- **[PASS]** Responsive Design Techniques — Flexbox, Media queries detected
- **[PASS]** Theme Color — theme-color meta tag present
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
- **[PASS]** Responsive Images (srcset) — 6 image(s) use srcset for responsive sizing
- **[PASS]** Apple Mobile Web App — 2/3 Apple mobile meta tags configured
- **[PASS]** Heading Hierarchy (WCAG 1.3.1) — Žiadne preskočené úrovne
- **[PASS]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text

### AI Readiness — 63/100

- **[FAIL]** llms.txt (AI Site Descriptor)
  - Fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
- **[FAIL]** Content Accessibility for AI — Only 4414 words visible in HTML — content may be JS-dependent
  - Fix: Your page has very little content in the HTML source. If you're using a JavaScript framework (React, Vue, Angular), implement Server-Side Rendering (SSR) or Static Site Generation (SSG).
- **[FAIL]** Product Schema Completeness
  - Fix: Add complete Product JSON-LD schema: name, description, image, sku, brand, offers (price, priceCurrency, availability, seller), aggregateRating, review. This is mandatory for AI-powered commerce.
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
- **[WARN]** llms-full.txt (Complete AI Content)
  - Fix: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
- **[WARN]** Site Search Schema (SearchAction)
  - Fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
- **[WARN]** Structured Content (Lists & Tables) — 29 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
- **[WARN]** Reviews & Ratings Schema
  - Fix: Add AggregateRating schema (ratingValue, reviewCount, bestRating) and individual Review schemas. AI shopping assistants prioritize products with verified reviews and ratings.
- **[WARN]** AI Plugin Manifest
  - Fix: Create /.well-known/ai-plugin.json if you have an API. This enables direct AI agent integration (ChatGPT Actions, custom GPTs). Include: name_for_model, description_for_model, auth config, and link to OpenAPI spec.
- **[WARN]** Product Feed (AI Commerce)
  - Fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery.
- **[WARN]** Speakable Content (Voice AI)
  - Fix: Add SpeakableSpecification schema to identify content sections suitable for voice assistants (Google Assistant, Alexa, Siri). Mark your product summaries and FAQs as speakable.
- **[WARN]** Section Length Optimization — Avg section: 530 words — only 0% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
- **[WARN]** Q&A Format Headings — 1 question heading(s) — add more
  - Fix: Phrase H2/H3 headings as questions: 'How does...?', 'What is...?', 'Why should...?' followed by a direct 1-2 sentence answer. This is the #1 format AI assistants use to generate responses.
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.eset.com/us/
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
- **[WARN]** Return Policy Schema
  - Fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
- **[WARN]** Shipping Details Schema
  - Fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
- **[WARN]** Content Readability for AI — Grade 15 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
- **[WARN]** Image Alt Text Quality for AI — 60% good, 0 poor, 2 missing
  - Fix: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
- **[WARN]** ai.txt (AI Permissions)
  - Fix: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
- **[WARN]** Content-to-Boilerplate Ratio — No <main> or <article> elements — AI can't isolate content from boilerplate
  - Fix: Add <main> around your primary content and <article> around self-contained content blocks. This creates clear boundaries for AI content extraction.
- **[WARN]** Customer Reviews — Aggregate — 1 source: Trustpilot
  - Fix: Single review source detected without published reviewCount. Add AggregateRating JSON-LD (ratingValue + reviewCount + bestRating) so the count is machine-readable, and add a second source (Heureka Ověřeno + Trustpilot is the SK/CZ standard).
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
- **[PASS]** Structured Data Foundation — 2 JSON-LD blocks with 5 schema types: BreadcrumbList, ListItem, Organization, ContactPoint, PostalAddress
- **[PASS]** Organization Schema + Entity Linking — Organization found with 6 sameAs links — strong entity identity
- **[PASS]** Breadcrumb Schema — BreadcrumbList structured data found — clear navigation hierarchy
- **[PASS]** Content Depth for AI — 4414 words — rich content for AI analysis and citation
- **[PASS]** Answer-First Content Format — First paragraph: 25 words — good content density above the fold
- **[PASS]** Heading Hierarchy for AI — Proper structure: 1 H1 → 3 H2s → 6 H3s — clear content outline
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <header>, <footer>, <aside>
- **[PASS]** Entity Clarity & Brand Signals — OG tags complete + 6 sameAs links: Facebook, X/Twitter, LinkedIn, Instagram, YouTube, Wikipedia
- **[PASS]** Extractable Answer Blocks — 81 paragraphs, avg 52 words — optimal for AI extraction
- **[PASS]** Statistics & Data Presence — 8 data points found — strong citation magnet
- **[PASS]** Internal Link Density — 20 contextual internal links per 1,000 words — strong knowledge graph signal
- **[PASS]** Knowledge Graph Readiness — 3/4 entity signals — strong Knowledge Graph presence
- **[PASS]** Trust Widget — Trustpilot widget detected

### GDPR — 84/100

- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
- **[WARN]** Legal Contact / Imprint Page
  - Fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
- **[PASS]** Cookie Consent Banner (CMP) — TrustArc detected
- **[PASS]** Tracking Scripts & Consent — No tracking scripts detected
- **[PASS]** Privacy Policy Page — /us/home/digital-privacy-protection/
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
- **[PASS]** Third-party Data Sharing — 3 third-party domain(s)
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found

### Vulnerability — 65/100

- **[FAIL]** Suspicious Inline Script Patterns — Detected: Dynamic script injection
  - Fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
- **[FAIL]** Payment Page Security — Payment page missing: No CSP, No X-Content-Type-Options, No clickjacking protection
  - Fix: CRITICAL: Your payment page is missing security headers: No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
- **[FAIL]** Clickjacking on Sensitive Page — Login/payment page without X-Frame-Options or CSP frame-ancestors
  - Fix: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
- **[WARN]** Inline JavaScript Exposure — 544 KB of inline JavaScript
  - Fix: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
- **[WARN]** DKIM Signing (Email Auth)
  - Fix: Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
- **[INFO]** BIMI Brand Indicators
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
- **[PASS]** Directory Listing — Disabled — file structure hidden
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 a:a.mx.eset.com a:b.mx.eset.com a:smtpout.eset.com a:branchsmtp.eset.com
- **[PASS]** DMARC Policy (Email Auth) — DMARC enforced: p=quarantine

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/en/r/eset.com)