Last scanned: July 29, 2026

C0/100

Average

Score Report

hetzner.truckershop.sk

Scanned on July 29, 2026

PrestaShop

jQuery

Font Awesome

Toastr

Turnstile

Company:Auto-Piko, s.r.o.· NACE 4672

NIS2: out of scope

Risk:35/100medium

Credit:C

VAT registered

Full company profile →

Last scanned: July 29, 2026

AI verdict

Your store performs well overall, but security needs attention. Start by creating an XML Sitemap to improve search visibility. Great news: Your site already excels in accessibility and SEO.

Not subject to NIS2 cybersecurity duties.Based on NACE sector + company size, Article 21 compliance is not mandatory. Security best practices still recommended.

Supplying a NIS2-regulated company?Even outside direct scope you may inherit supply-chain duties — regulated companies cascade them to suppliers by contract (security, incident reporting, encryption). ICT and managed-service providers are in scope regardless of size.

Check supplier obligations ·Legal basis: NIS2 Art. 21 · SK 366/2024 §21 · NIS2 Art. 21(2)(d)

Action plan

Fix these 3 things first

Sorted by score impact — each fix moves your overall grade up.

+15potential gain

69/100

Performance

Weight: 25% · 10 passed · 3 warnings · 4 failed · 1 SPA (verify manually)

What we found: 4.86s (good: <2.5s) — Core Web Vital FAILING

Why it matters: LCP >4s fails Core Web Vitals — Google actively demotes these pages. Faster LCP correlates with higher conversion rates.

How to fix: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.

Evidence:PSI-lab· Confidence: high

Fix with Performance module →

What we found: 7.0 MB, 183 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Evidence:PSI-lab· Confidence: high

Get Performance Optimization →

What we found: 653 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 653 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Evidence:PSI-lab· Confidence: low

What we found: Only 25% of 4 scripts optimized — most are render-blocking

Why it matters: 3 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Evidence:HTML-heuristic· Confidence: high

Get Performance Optimization →

What we found: Google Fonts detected without font-display

Why it matters: Without font-display, custom fonts cause Flash of Invisible Text (FOIT) — text is completely hidden during font download. On slow connections this can last 3+ seconds.

How to fix: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

What we found: no-store, no-cache, must-revalidate

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

Evidence:HTTP-header· Confidence: high

Request quote for speed audit

What we found: Custom fonts detected without preload hints

Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Evidence:HTML-heuristic· Confidence: high

Request quote for speed audit

7 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

I agree to the Privacy Policy. We'll send your report and optional re-scan notifications.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report

Zulien Score

Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách

79/100

Grade C

hetzner.truckershop.sk

Auto-Piko, s.r.o.

Dátum auditu: July 29, 2026

Platforma: PrestaShop

NACE: 4672

Online report: https://score.zulien.sk/r/hetzner.truckershop.sk

Executive summary

Chýb

Upozornení

166

Spolu kontrol

Skóre po kategóriách

Kategória	Skóre	Váha	Chyby	Upozornenia	OK
Performance	69/100	25%	4	3	10
SEO	89/100	20%	1	4	19
Security	82/100	15%	0	5	10
Mobile	67/100	10%	0	8	9
AI Readiness	84/100	10%	0	14	21
GDPR	80/100	10%	0	7	10
Vulnerability	79/100	10%	2	3	6
Accessibility	89/100	—	0	2	6

Kritické zistenia

Largest Contentful Paint (LCP)· Performance

LCP >4s fails Core Web Vitals — Google actively demotes these pages. Faster LCP correlates with higher conversion rates.

Total Page Weight· Performance

Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

Unused Code (CSS + JS)· Performance

Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Script Loading Strategy· Performance

3 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

XML Sitemap· SEO

Sitemaps help Google discover and index pages faster, especially for large stores with deep category structures.

Form CSRF Protection· Vulnerability

CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.

Suspicious Inline Script Patterns· Vulnerability

These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites.

Performance

69/100

Váha: 25% · 10 OK · 3 upozornení · 4 chýb · spolu 18

Largest Contentful Paint (LCP)Zlyhalo

4.86s (good: <2.5s) — Core Web Vital FAILING

Prečo je to dôležité: LCP >4s fails Core Web Vitals — Google actively demotes these pages. Faster LCP correlates with higher conversion rates.

Ako opraviť: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.

Total Page WeightZlyhalo

7.0 MB, 183 requests — too heavy!

Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Unused Code (CSS + JS)Zlyhalo

653 KB wasted on unused code!

Prečo je to dôležité: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Ako opraviť: You're loading 653 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Script Loading StrategyZlyhalo

Only 25% of 4 scripts optimized — most are render-blocking

Prečo je to dôležité: 3 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

Ako opraviť: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.

Font Loading StrategyUpozornenie

Google Fonts detected without font-display

Prečo je to dôležité: Without font-display, custom fonts cause Flash of Invisible Text (FOIT) — text is completely hidden during font download. On slow connections this can last 3+ seconds.

Ako opraviť: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.

Cache-Control StrategyUpozornenie

no-store, no-cache, must-revalidate

Prečo je to dôležité: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

Ako opraviť: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

Font PreloadingUpozornenie

Custom fonts detected without preload hints

Prečo je to dôležité: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

Ako opraviť: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Server Response Time (TTFB)Prešlo

25ms

First Contentful Paint (FCP)Prešlo

1.12s

Total Blocking Time (TBT)Prešlo

122ms

Cumulative Layout Shift (CLS)Prešlo

0.057 — Core Web Vital ✓

Speed IndexPrešlo

1.99s

Text Compression (gzip/brotli)Prešlo

All text resources properly compressed

Resource Hints (Preload/Preconnect)Prešlo

0 preload, 3 preconnect hint(s)

Lazy LoadingPrešlo

86% of images use native lazy loading (187/218)

HTTP/3 (QUIC) SupportPrešlo

HTTP/3 enabled via Alt-Svc header

CSS File CountPrešlo

2 CSS file(s) — well consolidated

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

SEO

89/100

Váha: 20% · 19 OK · 4 upozornení · 1 chýb · spolu 25

XML SitemapZlyhalo

Prečo je to dôležité: Sitemaps help Google discover and index pages faster, especially for large stores with deep category structures.

Ako opraviť: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.

Image Format OptimizationUpozornenie

Only 13% next-gen formats — 189 legacy images remain

Prečo je to dôležité: WebP/AVIF images are 30-70% smaller than JPEG/PNG at the same quality. This directly improves page speed, LCP, and mobile experience.

Ako opraviť: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.

Empty/Dead LinksUpozornenie

10 dead links (7 empty, 3 hash-only, 0 javascript:void)

Prečo je to dôležité: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.

Ako opraviť: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.

Broken Image SourcesUpozornenie

1 image(s) with empty src attribute

Prečo je to dôležité: Empty src attributes cause extra HTTP requests to the page URL, waste bandwidth, and show broken image icons to users.

Ako opraviť: Fix images with empty src=''. Either add proper URLs or use loading='lazy' with valid data-src for lazy-loaded images.

Sitemap Host ConsistencyUpozornenie

robots.txt Sitemap points to truckershop.sk (page is hetzner.truckershop.sk)

Prečo je to dôležité: Google fetches the sitemap from the host declared in robots.txt. A staging domain there either exposes an environment that must not be indexed, or sends every crawl to the wrong host — splitting ranking signals and burning crawl budget.

Ako opraviť: Update the Sitemap: line in robots.txt to your canonical host. A staging/dev hostname (new., staging., dev.) leaks pre-production to Google and feeds crawlers URLs that 404 or duplicate the live site.

Meta TitlePrešlo

47 chars — "TRUCKERSHOP.SK - Vybavenie pre nákladnú dopravu"

Meta DescriptionPrešlo

157 chars

H1 HeadingPrešlo

"TRUCKERSHOP.SK – Vybavenie, doplnky a náhradné diely pre kam…"

Content Structure (H2 Headings)Prešlo

7 H2 subheadings found

Open Graph TagsPrešlo

og:title, og:description, og:image, og:type

Open Graph Image FormatPrešlo

image/jpeg

Twitter/X CardsPrešlo

Card type: summary_large_image

Canonical URLPrešlo

https://hetzner.truckershop.sk/

Structured Data (JSON-LD)Prešlo

6 block(s): Organization, ImageObject, WebPage, WebSite

JSON-LD ValidityPrešlo

6 block(s) parse cleanly

robots.txtPrešlo

Present, references sitemap

HTML Language AttributePrešlo

lang="sk-SK"

Image Alt AttributesPrešlo

100% of 218 images have alt text

FaviconPrešlo

Favicon detected

Semantic HTML StructurePrešlo

5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>

Content DepthPrešlo

2722 words — sufficient content

Deep Heading HierarchyPrešlo

H2: 7, H3: 6 — well-structured content

Internal LinkingPrešlo

307 internal links — strong site navigation

Accessibility FundamentalsPrešlo

3/4 a11y signals: 125 ARIA roles, 175 ARIA labels, lang="sk-SK"

Text-to-HTML RatioInfo

3% ratio but 2722 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content

Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.

Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.

Security

82/100

Váha: 15% · 10 OK · 5 upozornení · 0 chýb · spolu 17

DNSSECUpozornenie

No DNSKEY records — zone is unsigned

Prečo je to dôležité: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.

Ako opraviť: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.

CAA DNS RecordUpozornenie

No CAA records — any CA can issue certificates for this domain

Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

Content-Security-Policy (CSP)Upozornenie

Present but uses 'unsafe-inline' and 'unsafe-eval'

Prečo je to dôležité: 'unsafe-inline' allows injected scripts to execute — defeating the main purpose of CSP. Major XSS protection is bypassed.

Ako opraviť: Remove 'unsafe-inline' by using nonces or hashes for inline scripts. Remove 'unsafe-eval' by eliminating eval() calls. These exceptions weaken CSP significantly.

Subresource Integrity (SRI)Upozornenie

Only 0/2 SRI-eligible third-party scripts have integrity hashes (1 auto-updating provider script(s) excluded — SRI not applicable)

Prečo je to dôležité: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.

Ako opraviť: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.

CDN / WAF ProtectionUpozornenie

Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.

Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

SSL/TLS CertificatePrešlo

Valid HTTPS connection established

HTTP → HTTPS RedirectPrešlo

HTTP properly redirects to HTTPS

HSTS (Strict-Transport-Security)Prešlo

max-age=31536000, includeSubDomains

Clickjacking ProtectionPrešlo

X-Frame-Options: SAMEORIGIN

X-Content-Type-OptionsPrešlo

nosniff

Referrer-PolicyPrešlo

strict-origin-when-cross-origin

Permissions-PolicyPrešlo

geolocation=(), microphone=(), camera=()

Cookie Security FlagsPrešlo

2 cookie(s) — all have Secure, HttpOnly, SameSite

Technology DisclosurePrešlo

Server identity hidden

security.txt (RFC 9116)Prešlo

Present at /.well-known/security.txt

Iframe SandboxingInfo

1 trusted provider embed(s) without sandbox — expected (sandbox would break YouTube/Maps/Stripe/reCAPTCHA)

Cookie Prefix SecurityInfo

2 session cookie(s) already have Secure + HttpOnly + SameSite; adding the __Host- prefix is a cosmetic hardening nicety

Prečo je to dôležité: With Secure, HttpOnly and SameSite already set, the prefix adds only host-only enforcement — low marginal benefit.

Ako opraviť: Optional: rename to __Host-session (Secure; Path=/; no Domain) for defence-in-depth against subdomain cookie injection.

Mobile

67/100

Váha: 10% · 9 OK · 8 upozornení · 0 chýb · spolu 19

Mobile Performance ScoreUpozornenie

57/100 (target: 90+)

Prečo je to dôležité: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.

Ako opraviť: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.

Touch Target SizeUpozornenie

Some tappable targets are too small or too close together (Lighthouse tap-targets audit)

Prečo je to dôležité: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityUpozornenie

Some text renders below the 12px legibility threshold (Lighthouse font-size audit)

Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.

Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

PWA FeaturesUpozornenie

Prečo je to dôležité: PWAs combine the best of web and native apps. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access.

Ako opraviť: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.

Form Input TypesUpozornenie

phone fields use type='text' instead of type='tel'

Prečo je to dôležité: Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors and speeds up form completion.

Ako opraviť: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.

Text Overflow HandlingUpozornenie

No word-break/overflow-wrap CSS detected

Prečo je to dôležité: Long strings without word-break cause horizontal overflow on mobile — a common cause of 'content wider than viewport' failures. Compound words and URLs are frequent culprits.

Ako opraviť: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.

Print StylesheetUpozornenie

Order/invoice page without print styles

Prečo je to dôležité: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.

Ako opraviť: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.

Heading Hierarchy (WCAG 1.3.1)Upozornenie

Preskočené úrovne: h1→h3

Prečo je to dôležité: Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené.

Ako opraviť: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.

Viewport ConfigurationPrešlo

width=device-width, initial-scale=1

Content Fits ViewportPrešlo

No horizontal scrolling needed

Responsive Design TechniquesPrešlo

Media queries detected

Theme ColorPrešlo

theme-color meta tag present

Mobile Navigation (Semantic)Prešlo

<nav> element present — proper navigation landmark

Responsive Images (srcset)Prešlo

56 image(s) use srcset for responsive sizing

Payment Methods DetectedPrešlo

1 method(s): Stripe

Form Input Labels (WCAG 3.3.2)Prešlo

31/31 inputs majú label

Link Text Quality (WCAG 2.4.4)Prešlo

Všetky odkazy majú popisný text

Express Checkout (Apple Pay + Google Pay)Info

Apple Pay / Google Pay nedetekované na homepage — express checkout sa zvyčajne zobrazí až v košíku/checkoute

Prečo je to dôležité: Mobile conversion pri express checkout je vyšší oproti klasickej karte. V SK/CZ rastúci trend. (Sken vidí iba homepage, takže toto je hint, nie verdikt.)

Ako opraviť: Ak express checkout nemáš, pridaj Apple Pay + Google Pay cez Stripe/Adyen/Mollie. Biometric auth = -1 click checkout = vyšší conversion.

SK/CZ Local Payment MethodsInfo

Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute

Prečo je to dôležité: SK/CZ shop bez bankových tlačidiel a QR platby = masívny cart abandonment. Priemerný SK e-shop má viacero payment metód. (Sken vidí iba homepage — over manuálne v checkoute.)

Ako opraviť: Ak SK/CZ local platby nemáš, integruj GoPay alebo ComGate — obe podporujú Tatra Pay, VÚB Pay, ČSOB Pay, Raiffeisen, QR platba v jednom API. Alternatívne Barion pre CZ trh.

AI Readiness

84/100

Váha: 10% · 21 OK · 14 upozornení · 0 chýb · spolu 46

Structured Data FoundationUpozornenie

3 distinct schema types (near-duplicate entity types merged from 4) (BusinessEntity, WebPage, WebSite) — add more for comprehensive AI coverage

Prečo je to dôležité: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite.

Ako opraviť: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.

FAQ Schema (Direct AI Answers)Upozornenie

Prečo je to dôležité: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.

Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Breadcrumb SchemaUpozornenie

Prečo je to dôležité: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.

Ako opraviť: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.

Structured Content (Lists & Tables)Upozornenie

96 lists found — consider adding comparison tables

Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.

Ako opraviť: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.

Author Expertise Signals (E-E-A-T)Upozornenie

Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.

Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Product Feed (AI Commerce)Upozornenie

Prečo je to dôležité: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.

Ako opraviť: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.

Heureka XML FeedUpozornenie

Prečo je to dôležité: Heureka.sk and Heureka.cz are the dominant price comparison engines on the SK/CZ market. Without an XML feed you're not visible on the main marketplace. No generic audit tool checks this.

Ako opraviť: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).

Extractable Answer BlocksUpozornenie

51 paragraphs, avg 16 words — too short for citation

Prečo je to dôležité: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.

Ako opraviť: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.

Section Length OptimizationUpozornenie

Avg section: 116 words — only 18% in 80-200 word optimal range

Prečo je to dôležité: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.

Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Return Policy SchemaUpozornenie

Prečo je to dôležité: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.

Ako opraviť: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.

Shipping Details SchemaUpozornenie

Prečo je to dôležité: Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver.

Ako opraviť: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.

Content Readability for AIUpozornenie

Grade 20 — too complex for broad AI citation (technical threshold: 14)

Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.

Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Expert Quotations & CitationsUpozornenie

Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

WebMCP Agentic ReadinessUpozornenie

Prečo je to dôležité: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

AI Bot Access PolicyPrešlo

Explicitly allowed: GPTBot, ChatGPT-User, anthropic-ai, ClaudeBot, PerplexityBot

Content Accessibility for AIPrešlo

2722 words in raw HTML (3.2% text ratio) — readable by AI crawlers without executing JS

Organization Schema + Entity LinkingPrešlo

Organization found with 4 sameAs links — strong entity identity

Site Search Schema (SearchAction)Prešlo

WebSite SearchAction configured — AI can search your store

Content Depth for AIPrešlo

2722 words — rich content for AI analysis and citation

Answer-First Content FormatPrešlo

First paragraph: 159 words — good content density above the fold

Heading Hierarchy for AIPrešlo

Proper structure: 1 H1 → 7 H2s → 6 H3s — clear content outline

Semantic HTML StructurePrešlo

5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>

Content Freshness SignalsPrešlo

Schema dates found + visible date on page

Entity Clarity & Brand SignalsPrešlo

OG tags complete + 4 sameAs links: Facebook, Instagram, YouTube

Reviews & Ratings SchemaPrešlo

AggregateRating/Review data found — social proof for AI

Statistics & Data PresencePrešlo

6 data points found — strong citation magnet

Q&A Format HeadingsPrešlo

3 question-format headings — excellent for AI Q&A extraction

Common Question CoveragePrešlo

Answers 4/5 key shopper questions: shipping, returns/refunds, availability, payment

Internal Link DensityPrešlo

113 contextual internal links per 1,000 words — strong knowledge graph signal

Canonical Tag for AI DeduplicationPrešlo

Self-referencing canonical — clean signal for AI

Knowledge Graph ReadinessPrešlo

4/4 entity signals — strong Knowledge Graph presence

Image Alt Text Quality for AIPrešlo

88% quality alt text (192/217 images) — strong visual search signal

Content-to-Boilerplate RatioPrešlo

67% of text in <main>/<article> — clean content signal

AggregateRating SchemaPrešlo

Review aggregate rating schema present

Customer Reviews — AggregatePrešlo

1 source: AggregateRating schema — ★ 4.9 · 123 reviews

Prečo je to dôležité: Multi-source reviews with published counts compound trust: AI assistants (ChatGPT/Perplexity) and Google SGE cite shops with verifiable AggregateRating schema first; SK/CZ buyers cross-check Heureka against Trustpilot before purchase.

llms.txt (AI Site Descriptor)Info

Valid llms.txt with 4000 chars — proper format with H1, summary

Prečo je to dôležité: No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md.

llms-full.txt (Complete AI Content)Info

Full content file found (4 KB) — comprehensive AI feed

Product Schema CompletenessInfo

No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit

Prečo je to dôležité: Product schema only belongs on product pages, so its absence on this page is expected — not a defect. Scan a product URL to evaluate it.

Ako opraviť: To audit Product schema, run the scan on a product detail URL. On product pages add: name, description, image, offers (price, priceCurrency, availability), brand, sku, aggregateRating.

AI Plugin ManifestInfo

Not present — not required (the ChatGPT-plugins manifest was retired in 2024)

Prečo je to dôležité: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.

Speakable Content (Voice AI)Info

Not present — optional; SpeakableSpecification has limited assistant adoption

ai.txt (AI Permissions)Info

Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt

Prečo je to dôležité: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.

Agent-Commerce ReadinessInfo

73/100 — čiastočne pripravené (Prístup 100 · Porozumenie 75 · Objaviteľnosť 67 · Transakcia 50)

Prečo je to dôležité: Či dokáže autonómny nákupný AI agent (ChatGPT operator, Perplexity, budúce agentické asistenty) na vašom obchode: prísť dnu, prečítať a porozumieť produktom, objaviť celý katalóg a konať (kôš, podmienky). Toto meria málokto — a pre SK/CZ shopy nikto. Skóre spája AI-bot prístup, Product schema, produktové feedy (Merchant/Heureka/Zboží), WebMCP a nákupné podmienky do jedného agent-first pohľadu. Nadväzuje na pripravovaný verejný MCP konektor ("naskenuj tento obchod").

Agent: Prístup — dostane sa agent dnuInfo

100/100 (2 signály/-ov)

Agent: Porozumenie — rozumie produktomInfo

75/100 (2 signály/-ov)

Agent: Objaviteľnosť — nájde celý katalógInfo

67/100 (3 signály/-ov)

Agent: Transakcia — vie konať (kôš/podmienky)Info

50/100 (3 signály/-ov)

GDPR

80/100

Váha: 10% · 10 OK · 7 upozornení · 0 chýb · spolu 18

Cookie PolicyUpozornenie

Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.

Right to Erasure (Data Deletion)Upozornenie

Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.

Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Withdrawal of Consent MechanismUpozornenie

Prečo je to dôležité: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.

Ako opraviť: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.

Cookie Lifetime ComplianceUpozornenie

1 cookie(s) with >1 year expiry

Prečo je to dôležité: French CNIL and other EU DPAs recommend a maximum 13-month cookie lifetime. Excessive cookie durations violate data minimization (GDPR Art. 5c).

Ako opraviť: Reduce cookie lifetimes to maximum 13 months (CNIL recommendation) or 6 months for marketing cookies. Session cookies should expire when the browser closes.

Omnibus Price Disclosure (30-day low)Upozornenie

Discounts shown without a visible 'lowest price in last 30 days' reference

Prečo je to dôležité: The EU Omnibus Directive (2019/2161), enacted in SK as zák. 108/2024 and CZ via zák. 634/1992, makes the 30-day reference price MANDATORY on every advertised discount. ŠOI/ČOI actively inspect for missing disclosures — and a '−40%' off an inflated base is exactly what they target.

Ako opraviť: Whenever you advertise a price reduction, display the lowest price applied in the 30 days before the discount, next to the new price. In PrestaShop add a 30-day price-history anchor (e.g. our zu_pricehistory module) so every sale label is compliant automatically.

Consumer Dispute Resolution LinksUpozornenie

Authority link present but no EU ODR platform link

Prečo je to dôležité: EU Regulation 524/2013 and the Consumer ADR Directive require online traders to link the ODR platform and name the competent supervisory authority. Missing links are a documented inspection finding (ŠOI/ČOI) and void parts of your Terms.

Ako opraviť: Add BOTH the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national supervisory authority (SK: ŠOI / soi.sk, CZ: ČOI / coi.cz) to the footer and Terms.

Withdrawal & Complaints PolicyUpozornenie

Missing: complaints procedure (reklamačný poriadok)

Prečo je to dôležité: The Consumer Rights Directive (2011/83/EU) and SK zák. 108/2024 / CZ zák. 89/2012 require pre-contractual disclosure of the 14-day withdrawal right and an accessible complaints procedure. Missing them extends customers' cancellation rights and is a standard ŠOI/ČOI finding.

Ako opraviť: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.

Cookie Consent Banner (CMP)Prešlo

CookieYes detected

Tracking Scripts & ConsentPrešlo

1 tracker(s) detected with CMP: Google Analytics/GTM

Google Consent Mode v2Prešlo

Consent mode signals detected (ad_storage, analytics_storage)

Privacy Policy PagePrešlo

//hetzner.truckershop.sk/content/2-ochrana-osobnych-udajov

Legal Contact / Imprint PagePrešlo

//hetzner.truckershop.sk/content/4-o-nas

Terms & Conditions PagePrešlo

//hetzner.truckershop.sk/content/3-obchodne-podmienky

Data Encryption (No Mixed Content)Prešlo

All resources loaded over HTTPS

Third-party Data SharingPrešlo

3 third-party domain(s)

Newsletter ConsentPrešlo

Newsletter form with consent mechanism detected

Data Protection Officer ContactPrešlo

DPO / data protection contact found

Online Withdrawal FunctionInfo

No explicit online withdrawal button in the server HTML — it may live in the logged-in account/order area, which this scan can't reach. Verify it's present.

Prečo je to dôležité: Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually.

Ako opraviť: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.

Vulnerability

79/100

Váha: 10% · 6 OK · 3 upozornení · 2 chýb · spolu 14

Form CSRF ProtectionZlyhalo

29 form(s) without CSRF tokens

Prečo je to dôležité: CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.

Ako opraviť: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.

Suspicious Inline Script PatternsZlyhalo

Detected: Dynamic script injection

Prečo je to dôležité: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites.

Ako opraviť: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.

Source Maps ExposedUpozornenie

JavaScript source maps (.js.map) are publicly accessible

Prečo je to dôležité: Source maps reveal your original source code, variable names, comments, and application logic. Attackers use this to find vulnerabilities, API keys in code, and understand your authentication flow.

Ako opraviť: Remove source maps from production or block access via server config. In Vite/Webpack: set sourcemap: false for production builds.

Cross-Origin IsolationUpozornenie

Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

Inline Event HandlersUpozornenie

26 inline event handlers (onclick, onmouseover, etc.)

Prečo je to dôležité: Inline event handlers are a legacy pattern that prevents Content Security Policy enforcement. They also make XSS attacks easier — injected HTML attributes can execute JavaScript immediately.

Ako opraviť: Move inline event handlers to external JavaScript files using addEventListener(). Inline handlers prevent proper CSP implementation (require 'unsafe-inline') and increase XSS attack surface.

CMS Version DisclosurePrešlo

No generator tag — CMS identity hidden

Sensitive Files ExposedPrešlo

.env, .git, composer.json — all properly blocked

Install Script ExposedPrešlo

No /install/ or /setup/ paths accessible

Directory ListingPrešlo

Disabled — file structure hidden

Admin Panel at Default URLPrešlo

Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)

Debug Mode / Error ExposurePrešlo

No debug indicators found in page output

SPF Record (Email Security)Info

No SPF record, and no MX — this domain doesn't send/receive email, so deliverability isn't affected

Prečo je to dôležité: Attackers spoof unprotected domains (even ones that never send email) in phishing. A hard-fail SPF (v=spf1 -all) plus DMARC p=reject stops your domain being used to impersonate you — this is the M3AAWG/NCSC guidance for non-sending domains.

Ako opraviť: Even a non-sending domain should block spoofing: publish an explicit null-sending SPF record — v=spf1 -all — so no server can forge mail as this domain.

DMARC Policy (Email Auth)Info

No DMARC record, and no MX — this domain doesn't handle email, so deliverability isn't affected

Prečo je to dôležité: Domains with no email are still spoofed by attackers. A DMARC p=reject (with SPF -all) tells receivers to drop any mail claiming to be from this domain — closing the impersonation vector without affecting any real mail (there is none).

Ako opraviť: Publish an anti-spoofing DMARC record even on a non-sending domain: at _dmarc.yourdomain.com set v=DMARC1; p=reject; — paired with SPF v=spf1 -all it prevents your domain being forged in phishing.

Email InfrastructureInfo

No MX records — domain does not receive email

Accessibility

89/100

Váha: — · 6 OK · 2 upozornení · 0 chýb · spolu 9

Heading StructureUpozornenie

Heading outline issue (h1 count: 1h1→h3)

Prečo je to dôležité: A clean heading hierarchy is the primary way assistive-tech users skim a page (WCAG 1.3.1 / 2.4.6).

Ako opraviť: Use a single <h1> and don't jump heading levels (e.g. <h2> straight to <h4>).

Skip LinkUpozornenie

No skip-to-content link detected

Prečo je to dôležité: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).

Ako opraviť: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.

Page LanguagePrešlo

<html lang="sk-SK"> is set

Image Alt TextPrešlo

All 218 images have alt attributes

Form LabelsPrešlo

All 31 form inputs are labelled

Link TextPrešlo

Links use descriptive text

Landmark RegionsPrešlo

Semantic landmarks present (<main>, <nav>/<header>)

Zoom & ScalingPrešlo

Pinch-zoom is not disabled

EAA Legal BasisInfo

In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.

Ďalšie kroky

Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/hetzner.truckershop.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk