Last scanned: October 8, 2026

C0/100

Average

Score Report

herbadrug.sk

Scanned on October 8, 2026

Unknown

jQuery 1.11.3

openresty

Company:Herba Drug, s.r.o.· NACE 2042

NIS2: important entity · Mfg Chemicals

Risk:0/100low

Credit:A+

VAT registered

Top 12% in sector

Full company profile →

Last scanned: October 8, 2026

AI verdict

Your store performs well overall, but has security gaps to fix. Install HTTPS security headers (HSTS) and Content-Security-Policy to protect customer data. Your SEO and accessibility are excellent.

NIS2: important entity — Mfg Chemicals

NIS2 readiness: 2/7 · 29%

Your shop falls under NIS2. The directive requires documented technical measures. These 5 shop-side signals are what we can verify externally:

✓Valid SSL/TLS certificateNIS2 Art. 21(2)(c)

—DMARC email authentication (anti-phishing)NIS2 Art. 21(2)(g)

✓Incident reporting contact (security.txt)NIS2 Art. 21(2)(b), Art. 23

✗Content Security Policy (XSS protection)NIS2 Art. 21(2)(c)

✗HSTS (forced HTTPS)NIS2 Art. 21(2)(c)

✗Vulnerability management (no known CVEs)NIS2 Art. 21(2)(e), 21(2)(g)

!Data protection (cookie consent + privacy policy)NIS2 Art. 21(2)(j)

Check full NIS2 compliance → ·Legal basis: NIS2 Art. 21 · SK 366/2024

Action plan

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

How we rank →

Quick wins

High impact, little work. Do these first.

Bigger projects

High impact, but the fix needs planning.

+5 more

Small fixes

Lower impact, quick to do.

+13 more

Later

Lower impact and more work. Plan them once the rest is done.

+42 more

87/100

Performance

Weight: 25% · 10 passed · 6 warnings · 2 failed · 2 SPA (verify manually)

What we found: 388 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 388 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Evidence:PSI-lab· Confidence: low

What we found: 14 CSS files — too many!

Why it matters: Each CSS file blocks rendering. With 14 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Evidence:HTML-heuristic· Confidence: high

What we found: 2.3 MB, 72 requests (optimal: <1.5 MB, <50 req)

Why it matters: A 3 MB page takes 6+ seconds on 3G mobile. Most e-commerce traffic is mobile — heavy pages lose customers on poor connections.

How to fix: Reduce page weight: compress images to WebP (saves 30-50%), enable text compression (gzip/brotli), lazy load below-fold images, remove unused CSS/JS.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

What we found: 748 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked

Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.

How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.

Evidence:PSI-lab748 KB JavaScript· Confidence: high

What we found: 50 images without lazy loading

Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.

How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

What we found: no-store, no-cache, must-revalidate, no-cache, private

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

Evidence:HTTP-header· Confidence: high

Request quote for speed audit

What we found: Only 73% of 11 scripts use async/defer

Why it matters: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.

How to fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.

Evidence:HTML-heuristic· Confidence: high

What we found: 14 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

8 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

I agree to the Privacy Policy. We'll send your report and optional re-scan notifications.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report

Zulien Score

Full e-commerce audit — 50+ checks across 7 categories

73/100

Grade C

herbadrug.sk

Herba Drug, s.r.o.

Audit date: October 8, 2026

NACE: 2042

Online report: https://score.zulien.sk/r/herbadrug.sk

Executive summary

Failures

Warnings

183

Checks total

Scores by category

Category	Score	Weight	Failures	Warnings	OK
Performance	87/100	25%	2	6	10
SEO	92/100	20%	0	4	20
Security	57/100	15%	2	8	7
Mobile	57/100	10%	1	9	8
AI Readiness	63/100	10%	1	25	9
Legal & Compliance	69/100	10%	2	5	10
Vulnerability	61/100	10%	4	5	7
NIS2	47/100	10%	3	2	2
Accessibility / EAA	93/100	10%	0	1	7

Critical findings

Unused Code (CSS + JS)· Performance

Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

CSS File Count· Performance

Each CSS file blocks rendering. With 14 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

HSTS (Strict-Transport-Security)· Security

Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.

Content-Security-Policy (CSP)· Security

CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

Mobile Performance Score· Mobile

A mobile score below 50 means your store takes several seconds to become usable on a phone. Slow mobile load drives users away before they see the store.

Content Freshness Signals· AI Readiness

With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

Privacy Policy Page· Legal & Compliance

A missing privacy policy is one of the most frequently cited GDPR violations. Every EU data protection authority considers it a basic requirement.

Consumer Dispute Resolution Links· Legal & Compliance

EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach.

Known Vulnerabilities (CVE)· Vulnerability

Versions with published CVEs are a prime automated-scanner target — bots (Shodan, Greynoise, Mirai-family) probe for them within minutes. This finding is inferred from the detected version, so confirm the component is actually unpatched before treating it as exploitable.

Admin Panel at Default URL· Vulnerability

Default admin URLs receive thousands of automated brute-force attempts daily. Botnets target /admin, /wp-admin, /administrator relentlessly. A renamed path blocks 99% of automated attacks.

jQuery Version· Vulnerability

jQuery 1.x is associated with 6+ known CVEs including XSS and prototype pollution. Automated scanners specifically target sites with jQuery <3.0.

Payment Page Security· Vulnerability

Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

Quick wins (5)

High impact, little work. Do these first.

Finding	Category	Effort
Admin Panel at Default URL	Vulnerability	quick fix
HTTP → HTTPS Redirect	Security	quick fix
HSTS (Strict-Transport-Security)	Security	quick fix
Consumer Dispute Resolution Links	Legal & Compliance	quick fix
HSTS — Strict-Transport-Security (Art. 21(2)(c))	NIS2	quick fix

Bigger projects (10)

High impact, but the fix needs planning.

Finding	Category	Effort
Privacy Policy Page	Legal & Compliance	about a day
Known Vulnerabilities (CVE)	Vulnerability	project
Vulnerability Management — CVE (Art. 21(2)(e), (g))	NIS2	project
Content-Security-Policy (CSP)	Security	about a day
jQuery Version	Vulnerability	about a day
Mixed Content Resources	Vulnerability	about a day
Payment Page Security	Vulnerability	about a day
Content Security Policy — CSP (Art. 21(2)(c))	NIS2	about a day
Unused Code (CSS + JS)	Performance	project
Mobile Performance Score	Mobile	project

Small fixes (18)

Lower impact, quick to do.

Finding	Category	Effort
Cache-Control Strategy	Performance	quick fix
Meta Description	SEO	quick fix
Twitter/X Cards	SEO	quick fix
Canonical URL Consistency	SEO	quick fix
DNSSEC	Security	quick fix
CAA DNS Record	Security	quick fix
Referrer-Policy	Security	quick fix
Permissions-Policy	Security	quick fix
Cookie Security Flags	Security	quick fix
Subresource Integrity (SRI)	Security	quick fix
Theme Color	Mobile	quick fix
Text Overflow Handling	Mobile	quick fix

+6 more

Later (47)

Lower impact and more work. Plan them once the rest is done.

Finding	Category	Effort
Lazy Loading	Performance	about a day
Script Loading Strategy	Performance	about a day
Image Format Optimization	SEO	about a day
CDN / WAF Protection	Security	about a day
Touch Target Size	Mobile	about a day
Font Size Readability	Mobile	about a day
PWA Features	Mobile	about a day
Responsive Images (srcset)	Mobile	about a day
Mobile Sticky CTA	Mobile	about a day
Structured Data Foundation	AI Readiness	about a day
FAQ Schema (Direct AI Answers)	AI Readiness	about a day
Site Search Schema (SearchAction)	AI Readiness	about a day

+35 more

Performance

87/100

Weight: 25% · 10 OK · 6 warnings · 2 failures · 20 total

Unused Code (CSS + JS)Failed

388 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

How to fix: You're loading 388 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

CSS File CountFailed

14 CSS files — too many!

Why it matters: Each CSS file blocks rendering. With 14 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Total Page WeightWarning

2.3 MB, 72 requests (optimal: <1.5 MB, <50 req)

Why it matters: A 3 MB page takes 6+ seconds on 3G mobile. Most e-commerce traffic is mobile — heavy pages lose customers on poor connections.

How to fix: Reduce page weight: compress images to WebP (saves 30-50%), enable text compression (gzip/brotli), lazy load below-fold images, remove unused CSS/JS.

JavaScript BudgetWarning

748 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked

Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.

How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.

Lazy LoadingWarning

50 images without lazy loading

Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.

How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.

Cache-Control StrategyWarning

no-store, no-cache, must-revalidate, no-cache, private

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

Script Loading StrategyWarning

Only 73% of 11 scripts use async/defer

Why it matters: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.

How to fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.

Critical CSS StrategyWarning

14 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Server Response Time (TTFB)Passed

22ms

First Contentful Paint (FCP)Passed

0.81s

Largest Contentful Paint (LCP)Passed

1.50s — Core Web Vital ✓

Total Blocking Time (TBT)Passed

28ms

Cumulative Layout Shift (CLS)Passed

0.070 — Core Web Vital ✓

Speed IndexPassed

1.01s

Request BudgetPassed

72 requests — within the budget of 80

Why it matters: Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed.

Text Compression (gzip/brotli)Passed

All text resources properly compressed

Resource Hints (Preload/Preconnect)Passed

1 preload, 1 preconnect hint(s)

HTTP/3 (QUIC) SupportPassed

HTTP/3 enabled via Alt-Svc header

Third-party ServicesInfo

Not measured — PageSpeed did not return the third-party audit for this URL

Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.

How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

SEO

92/100

Weight: 20% · 20 OK · 4 warnings · 0 failures · 25 total

Meta DescriptionWarning

318 chars (optimal: 120-160)

Why it matters: Google truncates descriptions over 160 chars. Mobile shows even less (~120 chars).

How to fix: Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.

Twitter/X CardsWarning

Why it matters: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.

How to fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.

Image Format OptimizationWarning

0% next-gen formats — 1 JPEG, 9 PNG images

Why it matters: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.

How to fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.

Canonical URL ConsistencyWarning

Canonical points to different URL: https://www.herbadrug.sk/

Why it matters: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.

How to fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.

Meta TitlePassed

58 chars — "Kvalitná slovenská kozmetika na jednom mieste - Herba D…"

H1 HeadingPassed

"Kvalitná slovenská kozmetika na jednom mieste"

Content Structure (H2 Headings)Passed

5 H2 subheadings found

Open Graph TagsPassed

og:title, og:description, og:image, og:type

Open Graph Image FormatPassed

image/webp

Canonical URLPassed

https://www.herbadrug.sk/

Structured Data (JSON-LD)Passed

1 block(s): Organization

JSON-LD ValidityPassed

1 block(s) parse cleanly

robots.txtPassed

Present, references sitemap

XML SitemapPassed

Found with 325 URLs

HTML Language AttributePassed

lang="sk"

Image Alt AttributesPassed

98% of 50 images have alt text

Meta Robots TagPassed

index,follow

FaviconPassed

Favicon detected

Semantic HTML StructurePassed

4/6 semantic elements: <nav>, <main>, <header>, <footer>

Content DepthPassed

821 words — sufficient content

Deep Heading HierarchyPassed

H2: 5, H3: 3 — well-structured content

Internal LinkingPassed

44 internal links — strong site navigation

Empty/Dead LinksPassed

2 minor dead link(s) — acceptable

Accessibility FundamentalsPassed

4/4 a11y signals: 162 ARIA roles, 64 ARIA labels, skip link, lang="sk"

Text-to-HTML RatioInfo

3% ratio but 821 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content

Why it matters: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.

How to fix: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.

Security

57/100

Weight: 15% · 7 OK · 8 warnings · 2 failures · 18 total

HSTS (Strict-Transport-Security)Failed

Why it matters: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.

How to fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.

Content-Security-Policy (CSP)Failed

Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.

How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

DNSSECWarning

No DNSKEY records — zone is unsigned

Why it matters: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.

How to fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.

CAA DNS RecordWarning

No CAA records — any CA can issue certificates for this domain

Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

HTTP → HTTPS RedirectWarning

Why it matters: Without a redirect, users can access the insecure HTTP version. Google also treats http and https as separate URLs, splitting your SEO signals.

How to fix: Configure a 301 redirect from http:// to https:// for all pages. In Apache: RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Referrer-PolicyWarning

Why it matters: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.

How to fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.

Permissions-PolicyWarning

Why it matters: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.

How to fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.

Cookie Security FlagsWarning

3 cookie(s): 2 missing HttpOnly, 2 missing SameSite

Why it matters: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.

How to fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.

Subresource Integrity (SRI)Warning

Only 0/4 SRI-eligible third-party scripts have integrity hashes (2 auto-updating provider script(s) excluded — SRI not applicable)

Why it matters: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.

How to fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.

CDN / WAF ProtectionWarning

Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.

How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

SSL/TLS CertificatePassed

Valid HTTPS connection established

Clickjacking ProtectionPassed

X-Frame-Options: SAMEORIGIN, SAMEORIGIN

X-Content-Type-OptionsPassed

nosniff

Technology DisclosurePassed

Server: openresty (no version)

security.txt (RFC 9116)Passed

Present at /.well-known/security.txt

Server Version DisclosurePassed

openresty — version hidden

Password Field SecurityPassed

1 password field(s) — allow password manager autofill

Cookie Prefix SecurityInfo

1 session cookie(s) already have Secure + HttpOnly + SameSite; adding the __Host- prefix is a cosmetic hardening nicety

Why it matters: With Secure, HttpOnly and SameSite already set, the prefix adds only host-only enforcement — low marginal benefit.

How to fix: Optional: rename to __Host-session (Secure; Path=/; no Domain) for defence-in-depth against subdomain cookie injection.

Mobile

57/100

Weight: 10% · 8 OK · 9 warnings · 1 failures · 21 total

Mobile Performance ScoreFailed

47/100 — critically slow

Why it matters: A mobile score below 50 means your store takes several seconds to become usable on a phone. Slow mobile load drives users away before they see the store.

How to fix: Your mobile experience is severely degraded. Priority fixes: 1) Reduce JavaScript, 2) Convert all images to WebP with responsive sizing, 3) Enable aggressive caching, 4) Use a CDN.

Desktop/Mobile Performance GapWarning

Desktop: 93 vs Mobile: 47 (46 point gap)

Why it matters: Google uses mobile-first indexing — your mobile score IS your SEO score. A big gap means your desktop optimizations aren't reaching mobile users, who are the majority of your traffic.

How to fix: Your desktop experience is significantly better than mobile. Focus on: reducing JavaScript (mobile CPUs are slower), serving responsive images (smaller files for smaller screens), and minimizing main-thread work.

Touch Target SizeWarning

Some tappable targets are too small or too close together (Lighthouse tap-targets audit)

Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityWarning

Some text renders below the 12px legibility threshold (Lighthouse font-size audit)

Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.

How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

PWA FeaturesWarning

Why it matters: PWAs combine the best of web and native apps. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access.

How to fix: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.

Theme ColorWarning

Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.

How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.

Responsive Images (srcset)Warning

50 images without responsive sizing

Why it matters: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.

How to fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.

Mobile Sticky CTAWarning

Add-to-cart button found but no sticky/fixed positioning detected

Why it matters: Mobile users scroll extensively. A sticky add-to-cart bar keeps the primary action visible. Without it, users must scroll back up to purchase — many won't.

How to fix: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.

Text Overflow HandlingWarning

No word-break/overflow-wrap CSS detected

Why it matters: Long strings without word-break cause horizontal overflow on mobile — a common cause of 'content wider than viewport' failures. Compound words and URLs are frequent culprits.

How to fix: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.

Print StylesheetWarning

Order/invoice page without print styles

Why it matters: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.

How to fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.

Viewport ConfigurationPassed

width=device-width, initial-scale=1

Content Fits ViewportPassed

No horizontal scrolling needed

Responsive Design TechniquesPassed

Media queries detected

Mobile Navigation (Semantic)Passed

<nav> element present — proper navigation landmark

Form Input TypesPassed

Optimized: 2 email, 1 search

Form Input Labels (WCAG 3.3.2)Passed

23/23 inputs have a label

Heading Hierarchy (WCAG 1.3.1)Passed

No skipped heading levels

Link Text Quality (WCAG 2.4.4)Passed

All links have descriptive text

Payment Methods DetectedInfo

No known payment gateway detected on the homepage

Why it matters: Visible payment icons (Apple Pay, Google Pay, Klarna, Tatra Pay) in the header or footer lift conversion. A trust signal before checkout.

How to fix: Payment gateway detection only scans the homepage. If payments live on /checkout or are loaded by JS after an interaction, we cannot see them. Consider adding payment icons to the footer.

Express Checkout (Apple Pay + Google Pay)Info

Apple Pay / Google Pay not detected on the homepage — express checkout usually appears only in the cart or checkout

Why it matters: Mobile conversion with express checkout beats manual card entry, and it is a growing trend in SK/CZ. (The scan only sees the homepage, so treat this as a hint rather than a verdict.)

How to fix: If you have no express checkout, add Apple Pay and Google Pay via Stripe, Adyen or Mollie. Biometric auth removes a click from checkout, which lifts conversion.

SK/CZ Local Payment MethodsInfo

No SK/CZ local payment method detected on the homepage — bank buttons and QR payment usually appear only in checkout

Why it matters: An SK/CZ shop without bank buttons and QR payment sees heavy cart abandonment; the average Slovak e-shop offers several payment methods. (The scan only sees the homepage — verify in your checkout.)

How to fix: If you do not offer SK/CZ local payments, integrate GoPay or ComGate — both cover Tatra Pay, VÚB Pay, ČSOB Pay, Raiffeisen and QR payment through one API. Barion is an alternative for the CZ market.

AI Readiness

63/100

Weight: 10% · 9 OK · 25 warnings · 1 failures · 49 total

Content Freshness SignalsFailed

Why it matters: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

How to fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.

Structured Data FoundationWarning

Only 1 distinct schema type (BusinessEntity) — insufficient for AI visibility

Why it matters: Single-schema sites get minimal AI coverage. AI models need multiple data signals to confidently recommend your store.

How to fix: One schema type is not enough. Add at minimum: Organization (identity), Product (commerce), BreadcrumbList (navigation), WebSite+SearchAction (discoverability), FAQPage (Q&A answering).

FAQ Schema (Direct AI Answers)Warning

Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.

How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Breadcrumb SchemaWarning

Why it matters: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.

How to fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.

Site Search Schema (SearchAction)Warning

Why it matters: SearchAction enables Google's sitelinks search box and allows AI shopping assistants to search your catalog directly. It's how AI agents find specific products in your store.

How to fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.

Answer-First Content FormatWarning

Content doesn't start with a strong summary paragraph

Why it matters: AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often.

How to fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.

Structured Content (Lists & Tables)Warning

20 lists found — consider adding comparison tables

Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.

How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.

Entity Clarity & Brand SignalsWarning

OG tags complete but no sameAs entity links

Why it matters: AI needs to confidently identify your brand entity. Open Graph and sameAs together create a cross-platform identity that AI models recognize.

How to fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.

Author Expertise Signals (E-E-A-T)Warning

Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.

How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Product Feed (AI Commerce)Warning

Why it matters: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.

How to fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.

Heureka XML FeedWarning

Why it matters: Heureka.sk and Heureka.cz are the dominant price comparison engines on the SK/CZ market. Without an XML feed you're not visible on the main marketplace. No generic audit tool checks this.

How to fix: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).

Extractable Answer BlocksWarning

10 paragraphs, avg 18 words — too short for citation

Why it matters: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.

How to fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.

Statistics & Data PresenceWarning

No statistical data found in content

Why it matters: Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics.

How to fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.

Section Length OptimizationWarning

Avg section: 225 words — only 17% in 80-200 word optimal range

Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.

How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Q&A Format HeadingsWarning

Why it matters: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

How to fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.

Common Question CoverageWarning

Answers 3/5 — missing: price, returns/refunds

Why it matters: LLMs like ChatGPT and Perplexity 'fan out' a shopping query into these sub-questions and cite the pages that answer them. Pages missing these answers get skipped in AI-generated shopping results — and lose the shopper's trust.

How to fix: Add clear content answering the questions shoppers (and AI assistants) ask: pricing, shipping options & cost, returns/refund policy, stock availability, and accepted payment methods. A visible FAQ or info section covering these is ideal.

Canonical Tag for AI DeduplicationWarning

Canonical points to different URL: https://www.herbadrug.sk/

Why it matters: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.

How to fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.

Return Policy SchemaWarning

Why it matters: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.

How to fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.

Shipping Details SchemaWarning

Why it matters: Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver.

How to fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.

Knowledge Graph ReadinessWarning

2/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn)

Why it matters: @id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity.

How to fix: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.

Content Readability for AIWarning

Grade 19 — too complex for broad AI citation

Why it matters: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.

How to fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Image Alt Text Quality for AIWarning

65% good, 8 poor, 1 missing

Why it matters: AI uses alt text to understand images for visual search (Google Lens, Bing Visual Search), product recommendations, and accessibility. Quality alt text opens more discovery channels.

How to fix: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.

Expert Quotations & CitationsWarning

Why it matters: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

How to fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

WebMCP Agentic ReadinessWarning

Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

Content-to-Boilerplate RatioWarning

58% in main content area — too much boilerplate

Why it matters: AI crawlers specifically target <main> and <article> content blocks. If most of your text is in navigation, footers, and sidebars, AI gets noise instead of signal — reducing citation quality.

How to fix: Move more content into <main> or <article> elements. Reduce navigation text, footer content, and sidebar noise. AI crawlers extract content from semantic containers and discard the rest.

Trust WidgetWarning

No trust widget (Heureka / Trustpilot / AggregateRating) detected

Why it matters: SK/CZ buyers trust Heureka Ověřeno more than other trust signals. LLMs (ChatGPT, Perplexity) and Google SGE cite shops with AggregateRating schema first.

How to fix: For SK/CZ shops: install the Heureka Ověřeno zákazníky widget (free for verified sellers — https://sluzby.heureka.sk). Alternatives: Trustpilot, Google Reviews with AggregateRating schema. Place the trust widget on product + category + footer.

AI Bot Access PolicyPassed

No AI bot restrictions (allowed by default)

AI agent access (live)Passed

ChatGPT-User and PerplexityBot get the same page as a browser

Content Accessibility for AIPassed

821 words in raw HTML (3.3% text ratio) — readable by AI crawlers without executing JS

Zero-results RecoveryPassed

A search with no matches still offers products, suggestions or a way to get help

Organization Schema + Entity LinkingPassed

Organization found with 1 sameAs links — strong entity identity

Content Depth for AIPassed

821 words — rich content for AI analysis and citation

Heading Hierarchy for AIPassed

Proper structure: 1 H1 → 5 H2s → 3 H3s — clear content outline

Semantic HTML StructurePassed

4/6 semantic elements: <nav>, <main>, <header>, <footer>

Internal Link DensityPassed

54 contextual internal links per 1,000 words — strong knowledge graph signal

llms.txt (AI Site Descriptor)Info

Not present — not required for AI visibility

Why it matters: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.

How to fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

llms-full.txt (Complete AI Content)Info

Not present — not required for AI visibility

Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

Product Schema CompletenessInfo

No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit

Why it matters: Product schema only belongs on product pages, so its absence on this page is expected — not a defect. Scan a product URL to evaluate it.

How to fix: To audit Product schema, run the scan on a product detail URL. On product pages add: name, description, image, offers (price, priceCurrency, availability), brand, sku, aggregateRating.

Search Typo Handling (measurement)Info

A correctly spelled query and the same query with a typo return similarly sized pages (191760 B vs 191228 B) — consistent with typo tolerance

Why it matters: This is a raw measurement, not a verdict, and it is never scored: page size is only a proxy for result count and themes differ. It is here so you can see what we saw.

How to fix: Verify by hand: search for a product, then search again with one letter transposed. If the second search finds nothing, a search engine with fuzzy matching and synonyms will recover those sales.

Reviews & Ratings SchemaInfo

No review schema on this homepage — review/rating schema typically lives on product pages

Why it matters: Review schema is product-page-specific, so its absence here is expected, not a defect.

How to fix: Scan a product URL to audit review schema. On product pages add AggregateRating (ratingValue, reviewCount, bestRating) and individual Review schemas.

AI Plugin ManifestInfo

Not present — not required (the ChatGPT-plugins manifest was retired in 2024)

Why it matters: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.

GTIN/EAN CoverageInfo

No product feed was sampled — GTIN/EAN coverage could not be verified

Why it matters: GTIN is how an AI shopping agent matches your product to the same product in other shops. Without a feed we cannot measure it — this is not a finding against you.

How to fix: Publish a Google Merchant or Heureka product feed with GTIN/EAN populated, then re-scan to measure coverage.

Speakable Content (Voice AI)Info

Not present — optional; SpeakableSpecification has limited assistant adoption

ai.txt (AI Permissions)Info

Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt

Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.

Agent-Commerce ReadinessInfo

69/100 — partly ready (Access 100 · Understand 75 · Discover 50 · Transact 50)

Why it matters: Whether an autonomous shopping agent (a ChatGPT operator, Perplexity, the assistants coming next) can do four things on your shop: get in, read and understand the products, discover the whole catalogue, and act (cart, terms). Almost nobody measures this, and for SK/CZ shops nobody does.

Agent: Access — can an agent get inInfo

100/100 (2 signals)

Agent: Understand — can it read the productsInfo

75/100 (2 signals)

Agent: Discover — can it find the whole catalogueInfo

50/100 (3 signals)

Agent: Transact — can it act (cart, terms)Info

50/100 (3 signals)

Legal & Compliance

69/100

Weight: 10% · 10 OK · 5 warnings · 2 failures · 18 total

Privacy Policy PageFailed

Why it matters: A missing privacy policy is one of the most frequently cited GDPR violations. Every EU data protection authority considers it a basic requirement.

How to fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).

GDPR Art. 12 · GDPR Art. 13 · GDPR Art. 14 · SK 18/2018 § 19 · SK 18/2018 § 20

Consumer Dispute Resolution LinksFailed

No EU ODR platform or supervisory-authority link found

Why it matters: EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach.

How to fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.

Nariadenie (EÚ) 524/2013 (ODR) · Smernica 2013/11/EÚ (ADR) · SK zák. 391/2015 Z.z. · CZ zák. 634/1992 Sb. § 14

Cookie PolicyWarning

Why it matters: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

How to fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.

Forms Without Privacy NoticeWarning

19 form(s) on page with no privacy policy link

Why it matters: GDPR Article 13 requires informing users about data processing at the point of collection. Forms without privacy notices violate the transparency principle.

How to fix: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.

Right to Erasure (Data Deletion)Warning

Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.

How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Withdrawal & Complaints PolicyWarning

Missing: right of withdrawal (odstúpenie od zmluvy), complaints procedure (reklamačný poriadok)

Why it matters: The Consumer Rights Directive (2011/83/EU) and SK zák. 108/2024 / CZ zák. 89/2012 require pre-contractual disclosure of the 14-day withdrawal right and an accessible complaints procedure. Missing them extends customers' cancellation rights and is a standard ŠOI/ČOI finding.

How to fix: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.

Online Withdrawal FunctionWarning

No online withdrawal function or withdrawal information detected

Why it matters: Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually.

How to fix: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.

Cookie Consent Banner (CMP)Passed

Cookiebot detected

Tracking Scripts & ConsentPassed

2 tracker(s) detected with CMP: Google Analytics/GTM, Meta Pixel

Google Consent Mode v2Passed

Consent mode signals detected (ad_storage, analytics_storage)

Legal Contact / Imprint PagePassed

/o-nas/

Terms & Conditions PagePassed

/obchodne-podmienky/

Data Encryption (No Mixed Content)Passed

All resources loaded over HTTPS

Third-party Data SharingPassed

3 third-party domain(s)

Newsletter ConsentPassed

Newsletter form with consent mechanism detected

Data Protection Officer ContactPassed

DPO / data protection contact found

Withdrawal of Consent MechanismPassed

Consent withdrawal / opt-out mechanism found

Legal guarantee noticeInfo

No harmonised notice on the legal guarantee was found on the pages we scanned — it may be on a page this scan does not open. Verify it is shown.

Why it matters: Directive (EU) 2024/825 (amending 2011/83/EU) requires traders to remind consumers, in a harmonised notice prominently displayed on the website, that the legal guarantee of conformity exists and lasts at least 2 years. National rules apply from 27 September 2026.

How to fix: Show the EU harmonised notice on the legal guarantee of conformity as a general reminder on your website (e.g. in the footer or on every product page), using the official design and wording for your language from the Commission implementing act. A 'záruka 24 mesiacov' line on the product is not the same thing — the notice is about the statutory guarantee.

Vulnerability

61/100

Weight: 10% · 7 OK · 5 warnings · 4 failures · 16 total

Known Vulnerabilities (CVE)Failed

5 CVEs associated with 1 detected component version

Why it matters: Versions with published CVEs are a prime automated-scanner target — bots (Shodan, Greynoise, Mirai-family) probe for them within minutes. This finding is inferred from the detected version, so confirm the component is actually unpatched before treating it as exploitable.

How to fix: Update jQuery 1.11.3 → 3.7.1 (CVE-2011-4969, CVE-2012-6708, CVE-2015-9251, CVE-2020-11022, CVE-2020-11023). Verify each before acting — a host or distro can backport a security patch while the version string still reads as vulnerable, so a detected CVE is not proof your install is affected. CVE details: CVE-2011-4969: https://nvd.nist.gov/vuln/detail/CVE-2011-4969 · CVE-2012-6708: https://nvd.nist.gov/vuln/detail/CVE-2012-6708 · CVE-2015-9251: https://nvd.nist.gov/vuln/detail/CVE-2015-9251 · CVE-2020-11022: https://nvd.nist.gov/vuln/detail/CVE-2020-11022 · CVE-2020-11023: https://nvd.nist.gov/vuln/detail/CVE-2020-11023

Admin Panel at Default URLFailed

Accessible at: /admin

Why it matters: Default admin URLs receive thousands of automated brute-force attempts daily. Botnets target /admin, /wp-admin, /administrator relentlessly. A renamed path blocks 99% of automated attacks.

How to fix: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).

jQuery VersionFailed

jQuery 1.11.3 — critically outdated!

Why it matters: jQuery 1.x is associated with 6+ known CVEs including XSS and prototype pollution. Automated scanners specifically target sites with jQuery <3.0.

How to fix: jQuery 1.11.3 is associated with multiple known security vulnerabilities. Upgrade to 3.7.x. If your plugins require jQuery 1.x/2.x, use jquery-migrate as a temporary bridge.

Payment Page SecurityFailed

Payment page missing: No HSTS, No CSP

Why it matters: Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.

How to fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.

Form CSRF ProtectionWarning

17/19 forms have CSRF tokens

Why it matters: Forms without CSRF tokens allow cross-site request forgery — an attacker's site can submit orders, change settings, or modify data on behalf of your logged-in users.

How to fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().

DMARC Policy (Email Auth)Warning

DMARC set to p=none (monitoring only, no enforcement)

Why it matters: DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes.

How to fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.

Cross-Origin IsolationWarning

Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

Mixed Content ResourcesWarning

1 HTTP resource(s) on HTTPS page

Why it matters: Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site.

How to fix: Replace HTTP URLs with HTTPS: http://carpathiaherbarium.com/

Login Form SecurityWarning

Why it matters: NIST guidelines recommend allowing password autofill. Blocking it forces users to choose weak, memorable passwords — a leading cause of credential compromise.

How to fix: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.

CMS Version DisclosurePassed

No generator tag — CMS identity hidden

Sensitive Files ExposedPassed

.env, .git, composer.json — all properly blocked

Install Script ExposedPassed

No /install/ or /setup/ paths accessible

Directory ListingPassed

Disabled — file structure hidden

Debug Mode / Error ExposurePassed

No debug indicators found in page output

SPF Record (Email Security)Passed

SPF configured: v=spf1 a mx include:_spf.nameserver.sk -all

DKIM Signing (Email Auth)Passed

DKIM configured (selectors: default)

NIS2

47/100

Weight: 10% · 2 OK · 2 warnings · 3 failures · 7 total

Content Security Policy — CSP (Art. 21(2)(c))Failed

No Content-Security-Policy header detected

Why it matters: NIS2 Article 21(2)(c) covers network and information system security. CSP is the application-layer control against injected-script attacks — a common breach class for e-commerce.

How to fix: Send a Content-Security-Policy response header with at minimum default-src 'self'. Mitigates XSS, formjacking and Magecart-style supply-chain attacks.

HSTS — Strict-Transport-Security (Art. 21(2)(c))Failed

HSTS header not detected

Why it matters: HSTS prevents protocol-downgrade and active MITM attacks. Article 21(2)(c) requires safeguards against active network attackers — HSTS is the browser-level minimum.

How to fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains; preload to enforce HTTPS for all subsequent requests.

Vulnerability Management — CVE (Art. 21(2)(e), (g))Failed

5 CVEs associated with 1 detected component version

Why it matters: NIS2 Article 21(2)(e) covers supply-chain security and 21(2)(g) covers cybersecurity hygiene. Both require you to track and remediate known vulnerabilities in software you operate.

How to fix: Maintain an inventory of CMS, framework and library versions. Patch known CVEs within the window your sector regulator expects (typically 30 days for high severity).

Email Authentication — DMARC (Art. 21(2)(g))Warning

DMARC set to p=none (monitoring only, no enforcement)

Why it matters: NIS2 Article 21(2)(g) covers basic cybersecurity hygiene practices. Brand spoofing is one of the most common NIS2-reportable incident vectors.

How to fix: Publish a DMARC TXT record with policy=reject (or quarantine) covering your domain. Prevents your brand being spoofed for phishing of partners and customers.

Privacy & Personal-Data Protection (Art. 21(2)(j))Warning

Partial GDPR compliance

Why it matters: NIS2 Article 21(2)(j) requires policies for HR security, asset management and personal-data handling. The supervisory authority (NBÚ in SK, NÚKIB in CZ) cross-checks GDPR posture during NIS2 audits.

How to fix: Implement a CMP-managed cookie banner AND a complete privacy policy. NIS2 incidents involving personal data trigger BOTH NIS2 incident reporting AND GDPR breach notification — keep both pipelines wired.

Encryption in Transit — TLS (Art. 21(2)(c))Passed

Valid HTTPS connection established

Why it matters: Important entity under NIS2 Article 21(2)(c) — policies on the use of cryptography and encryption. Sector: Mfg Chemicals.

Incident Reporting Channel — security.txt (Art. 21(2)(b), Art. 23)Passed

Present at /.well-known/security.txt

Why it matters: Researchers, hosting providers and national CSIRTs (SK-CERT, NÚKIB) rely on security.txt to reach the right contact during an incident. Without it, the 24-hour early-warning obligation can slip.

Accessibility / EAA

93/100

Weight: 10% · 7 OK · 1 warnings · 0 failures · 9 total

Image Alt TextWarning

1 of 50 images missing alt text

Why it matters: Every image missing alt text is content a screen-reader user cannot access (WCAG 1.1.1 / EN 301 549 § 9.1.1.1).

How to fix: Add alt text to the remaining images (alt="" for decorative ones).

Page LanguagePassed

<html lang="sk"> is set

Form LabelsPassed

All 23 form inputs are labelled

Heading StructurePassed

Single <h1> with a consistent heading outline

Link TextPassed

Links use descriptive text

Landmark RegionsPassed

Semantic landmarks present (<main>, <nav>/<header>)

Zoom & ScalingPassed

Pinch-zoom is not disabled

Skip LinkPassed

A skip-to-content link is present

EAA Legal BasisInfo

In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.

Next steps

Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/herbadrug.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk