Last scanned: July 10, 2026

D0/100

Below Average

Score Report

hype.sk

Scanned on July 10, 2026

WordPress 6.7.5

jQuery

Font Awesome

Swiper

reCAPTCHA

Webpack

Last scanned: July 10, 2026

Action plan

Fix these 3 things first

Sorted by score impact — each fix moves your overall grade up.

+21potential gain

67/100

Performance

Weight: 25% · 9 passed · 2 warnings · 5 failed · 1 SPA (verify manually)

What we found: 5.02s (good: <2.5s) — Core Web Vital FAILING

Why it matters: LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).

How to fix: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.

Evidence:PSI-lab· Confidence: high

Fix with Performance module →

What we found: 14.4 MB, 147 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Evidence:PSI-lab· Confidence: high

Get Performance Optimization →

What we found: 867 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 867 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Evidence:PSI-lab· Confidence: low

What we found: Only 5% of 22 scripts optimized — most are render-blocking

Why it matters: 21 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.

Evidence:HTML-heuristic· Confidence: high

Get Performance Optimization →

What we found: 39 CSS files — too many!

Why it matters: Each CSS file blocks rendering. With 39 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Evidence:HTML-heuristic· Confidence: high

What we found: 39 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Evidence:PSI-lab· Confidence: high

Request quote for speed audit

What we found: 6 external domains without preconnect

Why it matters: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

How to fix: Add <link rel='preconnect'> for key third-party domains: cdn-cookieyes.com, www.googletagmanager.com, www.google.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.

Evidence:PSI-lab· Confidence: high

7 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

I agree to the Privacy Policy. We'll send your report and optional re-scan notifications.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Your store is losing customers every day. The issues above are costing you sales.

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

Does your business fall under NIS2?

EU's NIS2 directive requires cybersecurity compliance for many online businesses. Check if you're affected.

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report

Zulien Score

Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách

68/100

Grade D

hype.sk

Dátum auditu: July 10, 2026

Platforma: WordPress 6.7.5

Online report: https://score.zulien.sk/r/hype.sk

Executive summary

Chýb

Upozornení

138

Spolu kontrol

Skóre po kategóriách

Kategória	Skóre	Váha	Chyby	Upozornenia	OK
Performance	67/100	25%	5	2	9
SEO	87/100	20%	1	4	19
Security	57/100	15%	3	8	6
Mobile	67/100	10%	1	8	7
AI Readiness	68/100	10%	3	15	13
GDPR	71/100	10%	1	6	7
Vulnerability	48/100	10%	6	6	6

Kritické zistenia

Largest Contentful Paint (LCP)· Performance

LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).

Total Page Weight· Performance

Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Unused Code (CSS + JS)· Performance

Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Script Loading Strategy· Performance

21 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

CSS File Count· Performance

Each CSS file blocks rendering. With 39 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Image Alt Attributes· SEO

Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA.

HSTS (Strict-Transport-Security)· Security

Without HSTS, attackers can intercept the first HTTP request and downgrade the connection. This is the #1 way to steal session cookies on public WiFi.

Content-Security-Policy (CSP)· Security

CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.

Clickjacking Protection· Security

Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Form Input Labels (WCAG 3.3.2)· Mobile

EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.

llms.txt (AI Site Descriptor)· AI Readiness

llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.

Heading Hierarchy for AI· AI Readiness

AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Performance

67/100

Váha: 25% · 9 OK · 2 upozornení · 5 chýb · spolu 17

Largest Contentful Paint (LCP)Zlyhalo

5.02s (good: <2.5s) — Core Web Vital FAILING

Prečo je to dôležité: LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).

Ako opraviť: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.

Total Page WeightZlyhalo

14.4 MB, 147 requests — too heavy!

Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Unused Code (CSS + JS)Zlyhalo

867 KB wasted on unused code!

Prečo je to dôležité: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Ako opraviť: You're loading 867 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Script Loading StrategyZlyhalo

Only 5% of 22 scripts optimized — most are render-blocking

Prečo je to dôležité: 21 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

Ako opraviť: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.

CSS File CountZlyhalo

39 CSS files — too many!

Prečo je to dôležité: Each CSS file blocks rendering. With 39 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Ako opraviť: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Critical CSS StrategyUpozornenie

39 CSS files without critical CSS extraction

Prečo je to dôležité: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

Ako opraviť: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Connection Hint CoverageUpozornenie

6 external domains without preconnect

Prečo je to dôležité: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

Ako opraviť: Add <link rel='preconnect'> for key third-party domains: cdn-cookieyes.com, www.googletagmanager.com, www.google.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.

Server Response Time (TTFB)Prešlo

76ms

First Contentful Paint (FCP)Prešlo

0.53s

Total Blocking Time (TBT)Prešlo

172ms

Cumulative Layout Shift (CLS)Prešlo

0.000 — Core Web Vital ✓

Speed IndexPrešlo

2.48s

Text Compression (gzip/brotli)Prešlo

All text resources properly compressed

Resource Hints (Preload/Preconnect)Prešlo

1 preload, 0 preconnect hint(s)

Lazy LoadingPrešlo

72% of images use native lazy loading (26/36)

HTTP/3 (QUIC) SupportPrešlo

HTTP/3 enabled via Alt-Svc header

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

SEO

87/100

Váha: 20% · 19 OK · 4 upozornení · 1 chýb · spolu 25

Image Alt AttributesZlyhalo

Only 31% of 36 images have alt text

Prečo je to dôležité: Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA.

Ako opraviť: 25 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.

H1 HeadingUpozornenie

5 H1 tags (should be exactly 1)

Prečo je to dôležité: Multiple H1 tags dilute the main topic signal. Google's John Mueller confirmed: one H1 per page is best practice.

Ako opraviť: Consolidate to exactly one H1 tag per page. Use H2-H6 for subheadings.

Image Format OptimizationUpozornenie

0% next-gen formats — 4 JPEG, 18 PNG images

Prečo je to dôležité: Your images are using legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.

Ako opraviť: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.

Semantic HTML StructureUpozornenie

Only 2/6 semantic elements — missing: <article>, <header>, <footer>, <aside>

Prečo je to dôležité: Semantic HTML gives search engines clear signals about content structure. Pages with proper semantic markup earn more featured snippets and knowledge panel appearances.

Ako opraviť: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.

Excessive Resource RequestsUpozornenie

23 JS + 39 CSS = 62 external requests

Prečo je to dôležité: Google's crawl budget is limited. Sites with excessive resources get crawled less frequently and experience slower indexation of new content.

Ako opraviť: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.

Meta TitlePrešlo

38 chars — "Hype - digitálna marketingová agentúra"

Meta DescriptionPrešlo

138 chars

Content Structure (H2 Headings)Prešlo

34 H2 subheadings found

Open Graph TagsPrešlo

og:title, og:description, og:image, og:type

Open Graph Image FormatPrešlo

image/jpeg

Twitter/X CardsPrešlo

Card type: summary_large_image

Canonical URLPrešlo

https://hype.sk/

Structured Data (JSON-LD)Prešlo

1 block(s): WebPage, ReadAction, ImageObject, BreadcrumbList

JSON-LD ValidityPrešlo

1 block(s) parse cleanly

robots.txtPrešlo

Present, references sitemap

XML SitemapPrešlo

Found with ~9+ URLs

HTML Language AttributePrešlo

lang="sk-SK"

Meta Robots TagPrešlo

index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1

FaviconPrešlo

Favicon detected

Content DepthPrešlo

1017 words — sufficient content

Deep Heading HierarchyPrešlo

H2: 34, H3: 9 — well-structured content

Internal LinkingPrešlo

51 internal links — strong site navigation

Accessibility FundamentalsPrešlo

3/4 a11y signals: 15 ARIA roles, 19 ARIA labels, lang="sk-SK"

Sitemap FreshnessPrešlo

Newest <lastmod> 92 day(s) ago

Text-to-HTML RatioInfo

3% ratio but 1017 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content

Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.

Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.

Security

57/100

Váha: 15% · 6 OK · 8 upozornení · 3 chýb · spolu 17

HSTS (Strict-Transport-Security)Zlyhalo

Prečo je to dôležité: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection. This is the #1 way to steal session cookies on public WiFi.

Ako opraviť: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.

Content-Security-Policy (CSP)Zlyhalo

Prečo je to dôležité: CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.

Ako opraviť: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

Clickjacking ProtectionZlyhalo

Prečo je to dôležité: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Ako opraviť: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.

CAA DNS RecordUpozornenie

No CAA records — any CA can issue certificates for this domain

Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

X-Content-Type-OptionsUpozornenie

Prečo je to dôležité: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.

Ako opraviť: Add header: X-Content-Type-Options: nosniff

Referrer-PolicyUpozornenie

Prečo je to dôležité: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.

Ako opraviť: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.

Permissions-PolicyUpozornenie

Prečo je to dôležité: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.

Ako opraviť: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.

Subresource Integrity (SRI)Upozornenie

Only 0/3 SRI-eligible third-party scripts have integrity hashes (3 auto-updating provider script(s) excluded — SRI not applicable)

Prečo je to dôležité: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site. The British Airways breach (£20M fine) was exactly this attack vector.

Ako opraviť: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.

security.txt (RFC 9116)Upozornenie

Prečo je to dôležité: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all. Required by ISO 27001 and SOC 2.

Ako opraviť: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.

CDN / WAF ProtectionUpozornenie

Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts. Cloudflare blocks 150+ billion daily threats.

Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

Iframe SandboxingUpozornenie

1/1 unknown iframe(s) without sandbox attribute

Prečo je to dôležité: Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS.

Ako opraviť: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.

SSL/TLS CertificatePrešlo

Valid HTTPS connection established

DNSSECPrešlo

Zone is DNSSEC-signed (DNSKEY published)

Prečo je to dôležité: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.

HTTP → HTTPS RedirectPrešlo

HTTP properly redirects to HTTPS

Cookie Security FlagsPrešlo

No cookies set on initial response

Technology DisclosurePrešlo

Server: openresty (no version)

Server Version DisclosurePrešlo

openresty — version hidden

Mobile

67/100

Váha: 10% · 7 OK · 8 upozornení · 1 chýb · spolu 16

Form Input Labels (WCAG 3.3.2)Zlyhalo

Iba 0/18 inputs má label (0%)

Prečo je to dôležité: EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.

Ako opraviť: 18 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).

Mobile Performance ScoreUpozornenie

62/100 (target: 90+)

Prečo je to dôležité: Over 65% of e-commerce traffic is mobile (Statista 2024). Google ranks based on mobile performance, not desktop. Mobile score <50 means you're penalized in mobile search.

Ako opraviť: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.

Touch Target SizeUpozornenie

Prečo je to dôležité: Small tap targets cause 37% more mis-taps on mobile (Google UX research). In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityUpozornenie

Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience. Users over 40 are especially affected — and they have the highest purchasing power.

Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

Theme ColorUpozornenie

Prečo je to dôležité: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional — small detail, big perception impact.

Ako opraviť: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.

Apple Mobile Web AppUpozornenie

Missing: apple-mobile-web-app-capable, status-bar-style

Prečo je to dôležité: These tags enable 'Add to Home Screen' on iOS with a full-screen experience. 45% of mobile shoppers use iOS — a polished home screen presence increases return visits.

Ako opraviť: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.

Form Input TypesUpozornenie

phone fields use type='text' instead of type='tel'

Prečo je to dôležité: Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors by 30% and speeds up form completion (Baymard Institute).

Ako opraviť: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.

Print StylesheetUpozornenie

Order/invoice page without print styles

Prečo je to dôležité: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.

Ako opraviť: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.

Fixed Width ElementsUpozornenie

Large fixed-width elements detected — may cause horizontal scroll

Prečo je to dôležité: Fixed-width elements wider than the viewport cause horizontal scrolling on mobile. Google's mobile-friendly test specifically checks for this.

Ako opraviť: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.

Viewport ConfigurationPrešlo

width=device-width, initial-scale=1

Content Fits ViewportPrešlo

No horizontal scrolling needed

Responsive Design TechniquesPrešlo

Flexbox, CSS Grid, Media queries detected

Mobile Navigation (Semantic)Prešlo

<nav> element present — proper navigation landmark

Responsive Images (srcset)Prešlo

9 image(s) use srcset for responsive sizing

Heading Hierarchy (WCAG 1.3.1)Prešlo

Žiadne preskočené úrovne

Link Text Quality (WCAG 2.4.4)Prešlo

Všetky odkazy majú popisný text

AI Readiness

68/100

Váha: 10% · 13 OK · 15 upozornení · 3 chýb · spolu 31

llms.txt (AI Site Descriptor)Zlyhalo

Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.

Ako opraviť: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

Heading Hierarchy for AIZlyhalo

5 H1, 34 H2, 9 H3 — poor structure

Prečo je to dôležité: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Ako opraviť: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).

Image Alt Text Quality for AIZlyhalo

Only 22% quality alt text — 25 missing, 3 poor

Prečo je to dôležité: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

Ako opraviť: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.

llms-full.txt (Complete AI Content)Upozornenie

Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

Ako opraviť: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.

Organization Schema + Entity LinkingUpozornenie

Organization schema found but no sameAs links

Prečo je to dôležité: sameAs links tell AI: 'This is the same entity across the web.' Sites with sameAs to Wikipedia are 3x more likely to appear in AI-generated answers. It's how Google builds Knowledge Panels.

Ako opraviť: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.

FAQ Schema (Direct AI Answers)Upozornenie

Prečo je to dôležité: FAQ schema provides 30% higher AI citation rates (LLMClicks research). ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. It's the fastest way to get your content cited by AI.

Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Semantic HTML StructureUpozornenie

2/6 elements — missing: <article>, <header>, <footer>, <aside>

Prečo je to dôležité: AI crawlers don't see your CSS. They rely on semantic HTML to distinguish main content from navigation, ads, and boilerplate. The WordLift AI Audit weights semantic HTML as a primary machine-readability signal.

Ako opraviť: Add: <article>, <header>, <footer>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.

Structured Content (Lists & Tables)Upozornenie

12 lists found — consider adding comparison tables

Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with much higher accuracy than paragraph text. Structured content = more AI citations.

Ako opraviť: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.

Content Freshness SignalsUpozornenie

Schema dates found but no visible date on page

Prečo je to dôležité: 76.4% of ChatGPT's top 1000 cited pages were updated within 30 days. AI-cited content is 25.7% fresher than traditional organic results. Freshness signals tell AI your content is current and reliable.

Ako opraviť: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.

Entity Clarity & Brand SignalsUpozornenie

OG tags complete but no sameAs entity links

Prečo je to dôležité: AI needs to confidently identify your brand entity. Open Graph + sameAs create a cross-platform identity that AI models recognize. The HubSpot AEO Grader found entity clarity is a top-3 factor for AI brand recognition.

Ako opraviť: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.

Author Expertise Signals (E-E-A-T)Upozornenie

Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited 3x more than anonymous content. This is especially important for product guides, reviews, and advice content.

Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Statistics & Data PresenceUpozornenie

Only 2 data point(s) — add more

Prečo je to dôležité: Princeton/Georgia Tech study found that adding statistics to content improves AI visibility by 41% — the single most effective GEO optimization. AI assistants prefer content with verifiable data points.

Ako opraviť: Add specific statistics, percentages, dollar amounts, and quantified claims. E.g., '93% of customers report...', 'saves an average of €200/year', '3x faster than...' Data makes content citable.

Section Length OptimizationUpozornenie

Avg section: 40 words — only 6% in 80-200 word optimal range

Prečo je to dôležité: Pages with 120-180 word sections earn 70% more AI citations (Otterly Citation Economy 2026). For Google AI Overviews specifically, 100-150 words per section is the sweet spot.

Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Q&A Format HeadingsUpozornenie

Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

Ako opraviť: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.

Content Readability for AIUpozornenie

Grade 18 — too complex for broad AI citation (technical threshold: 14)

Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are 28% more likely to be cited by AI.

Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Expert Quotations & CitationsUpozornenie

Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

ai.txt (AI Permissions)Upozornenie

Prečo je to dôležité: ai.txt is an emerging standard (proposed May 2025) for fine-grained AI permissions beyond robots.txt. Early adoption signals AI-forward thinking and gives you control over how AI uses your content.

Ako opraviť: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.

WebMCP Agentic ReadinessUpozornenie

Prečo je to dôležité: WebMCP is called 'the new Schema.org moment' — it's how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

AI Bot Access PolicyPrešlo

No AI bot restrictions (allowed by default)

Content Accessibility for AIPrešlo

1017 words in raw HTML (3.0% text ratio) — readable by AI crawlers without executing JS

Structured Data FoundationPrešlo

1 JSON-LD blocks with 10 schema types: WebPage, ReadAction, ImageObject, BreadcrumbList, ListItem, WebSite

Breadcrumb SchemaPrešlo

BreadcrumbList structured data found — clear navigation hierarchy

Site Search Schema (SearchAction)Prešlo

WebSite SearchAction configured — AI can search your store

Content Depth for AIPrešlo

1017 words — rich content for AI analysis and citation

Answer-First Content FormatPrešlo

First paragraph: 44 words — good content density above the fold

Extractable Answer BlocksPrešlo

25 paragraphs, avg 63 words — optimal for AI extraction

Internal Link DensityPrešlo

50 contextual internal links per 1,000 words — strong knowledge graph signal

Canonical Tag for AI DeduplicationPrešlo

Self-referencing canonical — clean signal for AI

Knowledge Graph ReadinessPrešlo

3/4 entity signals — strong Knowledge Graph presence

Content-to-Boilerplate RatioPrešlo

91% of text in <main>/<article> — clean content signal

Social Proof (Testimonials / Case Studies)Prešlo

Strong social proof: testimonials, case studies / portfolio

GDPR

71/100

Váha: 10% · 7 OK · 6 upozornení · 1 chýb · spolu 14

Privacy Policy PageZlyhalo

Prečo je to dôležité: A missing privacy policy is the #1 most cited GDPR violation. Every EU data protection authority considers this a basic requirement — and fines start at €5,000 for small businesses.

Ako opraviť: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).

GDPR Art. 12 · GDPR Art. 13 · GDPR Art. 14 · SK 18/2018 § 19 · SK 18/2018 § 20

Cookie PolicyUpozornenie

Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.

Terms & Conditions PageUpozornenie

Prečo je to dôležité: EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights.

Ako opraviť: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.

Third-party Data SharingUpozornenie

6 third-party domains loading scripts

Prečo je to dôležité: Every third-party script is a potential data processor under GDPR. You need a DPA with each one, and they must be disclosed to users. Excessive third parties also increase data breach risk.

Ako opraviť: Your page loads scripts from 6 external domains. Review each one: cdn-cookieyes.com, www.googletagmanager.com, www.google.com, cdn.jsdelivr.net, t.leady.com... Ensure each has a Data Processing Agreement (DPA) and is listed in your privacy policy.

Forms Without Privacy NoticeUpozornenie

4 form(s) on page with no privacy policy link

Prečo je to dôležité: GDPR Article 13 requires informing users about data processing at the point of collection. Forms without privacy notices violate the transparency principle.

Ako opraviť: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.

Right to Erasure (Data Deletion)Upozornenie

Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process. Italian DPA fined companies €20M+ for obstructing erasure requests.

Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Data Protection Officer ContactUpozornenie

Prečo je to dôležité: GDPR Article 37 requires a DPO for organizations processing personal data at scale. Even if not mandatory, having a designated privacy contact builds trust and is expected by regulators.

Ako opraviť: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.

Cookie Consent Banner (CMP)Prešlo

CookieYes detected

Tracking Scripts & ConsentPrešlo

2 tracker(s) detected with CMP: Google Analytics/GTM, Meta Pixel

Google Consent Mode v2Prešlo

Consent mode signals detected (ad_storage, analytics_storage)

Legal Contact / Imprint PagePrešlo

/o-nas

Data Encryption (No Mixed Content)Prešlo

All resources loaded over HTTPS

Newsletter ConsentPrešlo

Newsletter form with consent mechanism detected

Withdrawal of Consent MechanismPrešlo

Consent withdrawal / opt-out mechanism found

Vulnerability

48/100

Váha: 10% · 6 OK · 6 upozornení · 6 chýb · spolu 18

CMS Version DisclosureZlyhalo

"WordPress 6.7.5" exposed in meta generator

Prečo je to dôležité: Knowing your exact CMS version lets attackers search CVE databases instantly. E.g., PrestaShop 1.7.8.x is associated with known SQL injection CVEs. Hiding the version forces attackers to guess.

Ako opraviť: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.

Admin Panel at Default URLZlyhalo

Accessible at: /admin, /wp-admin

Prečo je to dôležité: Default admin URLs receive thousands of automated brute-force attempts daily. Botnets target /admin, /wp-admin, /administrator relentlessly. A renamed path blocks 99% of automated attacks.

Ako opraviť: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).

Suspicious Inline Script PatternsZlyhalo

Detected: Dynamic script injection

Prečo je to dôležité: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. The 2024 Akamai report found skimmers disguised as Google Tag Manager on thousands of e-commerce sites.

Ako opraviť: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.

DMARC Policy (Email Auth)Zlyhalo

Prečo je to dôležité: Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.

Ako opraviť: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.

Clickjacking on Sensitive PageZlyhalo

Prečo je to dôležité: Clickjacking on payment/login pages is a high-severity vulnerability. Users unknowingly submit credentials or payments through invisible iframes. PCI DSS requires frame-busting on payment pages.

Ako opraviť: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.

Server Error LeakZlyhalo

PHP/server error messages visible in page output

Prečo je to dôležité: Error messages reveal file paths, database structure, table names, and query logic. This is a goldmine for attackers — it turns a blind SQL injection into a targeted one, reducing attack time from days to minutes.

Ako opraviť: Set display_errors=Off in php.ini and log_errors=On. Configure a custom error page. Never show stack traces, SQL errors, or file paths to users.

CMS Information FilesUpozornenie

readme.html accessible — reveals version details

Prečo je to dôležité: Even if you hide the generator tag, readme.html and CHANGELOG.txt reveal exact version numbers. Attackers check these as a fallback.

Ako opraviť: Delete or block access to readme.html. These files reveal your exact CMS version and update history.

Form CSRF ProtectionUpozornenie

1/4 forms have CSRF tokens

Prečo je to dôležité: Forms without CSRF tokens allow cross-site request forgery — an attacker's site can submit orders, change settings, or modify data on behalf of your logged-in users.

Ako opraviť: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().

Open Redirect DetectionUpozornenie

URL redirect parameter found in page links

Prečo je to dôležité: Open redirects are used in phishing attacks — attackers craft URLs that appear to be your domain but redirect to a malicious site. This abuses your domain's trust.

Ako opraviť: Validate all redirect URLs server-side against a whitelist. Never allow user-controlled redirect targets without validation.

Source Maps ExposedUpozornenie

JavaScript source maps (.js.map) are publicly accessible

Prečo je to dôležité: Source maps reveal your original source code, variable names, comments, and application logic. Attackers use this to find vulnerabilities, API keys in code, and understand your authentication flow.

Ako opraviť: Remove source maps from production or block access via server config. In Vite/Webpack: set sourcemap: false for production builds.

Cross-Origin IsolationUpozornenie

Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

CDN Script Integrity (SRI)Upozornenie

1 CDN script(s) without Subresource Integrity

Prečo je to dôležité: CDN scripts without SRI can be tampered with if the CDN is compromised. The polyfill.io attack (2024, 380K+ sites) and British Airways breach (£20M fine) were both CDN supply chain attacks.

Ako opraviť: Add integrity='sha384-...' crossorigin='anonymous' to CDN scripts from: cdn.jsdelivr.net. Generate hashes at srihash.org.

Sensitive Files ExposedPrešlo

.env, .git, composer.json — all properly blocked

Install Script ExposedPrešlo

No /install/ or /setup/ paths accessible

Directory ListingPrešlo

Disabled — file structure hidden

Debug Mode / Error ExposurePrešlo

No debug indicators found in page output

SPF Record (Email Security)Prešlo

SPF configured: v=spf1 a mx include:_spf.m1.websupport.sk ?all

DKIM Signing (Email Auth)Prešlo

DKIM configured (selectors: mail)

Ďalšie kroky

Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/hype.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk