Last scanned: October 8, 2026
B0/100
Score Report
kagency.comScanned on October 8, 2026
Unknown
jQuery 3.7.1
Bootstrap
Font Awesome
Swiper
reCAPTCHA
Nginx
Last scanned: October 8, 2026
AI verdict
Your store performs well overall, but needs attention to security and AI readiness. Add CSRF protection to forms immediately. Your accessibility and SEO are excellent.
Action plan
How we rank →Action plan by impact and effort
Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.
Quick wins
0High impact, little work. Do these first.
Nothing here.
Bigger projects
4High impact, but the fix needs planning.
Small fixes
18Lower impact, quick to do.
+13 more
Later
32Lower impact and more work. Plan them once the rest is done.
+27 more
89/100
Performance
Weight: 25% · 11 passed · 5 warnings · 3 failed · 2 SPA (verify manually)
Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Evidence: PSI-lab · Confidence: high
What we found: 3.3 MB, 61 requests — too heavy!
Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Evidence:PSI-lab· Confidence: high
Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
How to fix: You're loading 521 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Evidence: PSI-lab · Confidence: low
What we found: 521 KB wasted on unused code!
Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.
How to fix: You're loading 521 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Evidence:PSI-lab· Confidence: low
Why it matters: Each CSS file blocks rendering. With 11 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Evidence: HTML-heuristic · Confidence: high
What we found: 11 CSS files — too many!
Why it matters: Each CSS file blocks rendering. With 11 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Evidence:HTML-heuristic· Confidence: high
Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.
How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
Evidence: PSI-lab · 1028 KB JavaScript · Confidence: high
What we found: 1028 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked
Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.
How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
Evidence:PSI-lab1028 KB JavaScript· Confidence: high
Why it matters: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.
How to fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
Evidence: HTML-heuristic · Confidence: high
What we found: Only 58% of 12 scripts use async/defer
Why it matters: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.
How to fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
Evidence:HTML-heuristic· Confidence: high
Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Evidence: HTML-heuristic · Confidence: high
What we found: Custom fonts detected without preload hints
Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Evidence:HTML-heuristic· Confidence: high
Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.
How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Evidence: PSI-lab · Confidence: high
What we found: 11 CSS files without critical CSS extraction
Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.
How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Evidence:PSI-lab· Confidence: high
Why it matters: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.
How to fix: Add <link rel='preconnect'> for key third-party domains: consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Evidence: PSI-lab · Confidence: high
What we found: 7 external domains without preconnect
Why it matters: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.
How to fix: Add <link rel='preconnect'> for key third-party domains: consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Evidence:PSI-lab· Confidence: high
Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.
How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.
Evidence: PSI-lab · Confidence: high
How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Evidence: PSI-lab · Confidence: high
🏆 Your store qualifies for the Zulien Score Badge!
Add this badge to your store to show customers it's optimized.
Get embed code
<a href="https://score.zulien.sk/r/kagency.com?utm_source=embed&utm_medium=badge&utm_campaign=kagency.com" target="_blank" rel="noopener"><img src="https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/badge?domain=kagency.com&size=medium&theme=dark" alt="Zulien Score — kagency.com (B)" width="280" height="72" loading="lazy" /></a>
This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Zulien Score
Full e-commerce audit — 50+ checks across 7 categories
84/100
Grade B
kagency.com
Executive summary
6
Failures
48
Warnings
82
OK
143
Checks total
Scores by category
| Category | Score | Weight | Failures | Warnings | OK |
|---|---|---|---|---|---|
| Performance | 89/100 | 25% | 3 | 5 | 11 |
| SEO | 90/100 | 20% | 0 | 5 | 20 |
| Security | 81/100 | 15% | 0 | 6 | 10 |
| Mobile | 66/100 | 10% | 0 | 7 | 8 |
| AI Readiness | 71/100 | 10% | 2 | 14 | 12 |
| Legal & Compliance | 75/100 | 10% | 0 | 7 | 5 |
| Vulnerability | 88/100 | 10% | 1 | 3 | 9 |
| Accessibility / EAA | 96/100 | 10% | 0 | 1 | 7 |
Critical findings
Total Page Weight· Performance
Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
Unused Code (CSS + JS)· Performance
Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
CSS File Count· Performance
Each CSS file blocks rendering. With 11 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
Organization Schema + Entity Linking· AI Readiness
Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
Content Freshness Signals· AI Readiness
With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
Form CSRF Protection· Vulnerability
CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.
Action plan by impact and effort
Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.
Bigger projects (4)
High impact, but the fix needs planning.
| Finding | Category | Effort |
|---|---|---|
| Organization Schema + Entity Linking | AI Readiness | about a day |
| Form CSRF Protection | Vulnerability | about a day |
| Total Page Weight | Performance | project |
| Unused Code (CSS + JS) | Performance | project |
Small fixes (18)
Lower impact, quick to do.
| Finding | Category | Effort |
|---|---|---|
| Meta Description | SEO | quick fix |
| Canonical URL Consistency | SEO | quick fix |
| Empty/Dead Links | SEO | quick fix |
| DNSSEC | Security | quick fix |
| CAA DNS Record | Security | quick fix |
| Subresource Integrity (SRI) | Security | quick fix |
| security.txt (RFC 9116) | Security | quick fix |
| Theme Color | Mobile | quick fix |
| Form Input Types | Mobile | quick fix |
| Canonical Tag for AI Deduplication | AI Readiness | quick fix |
| Legal Contact / Imprint Page | Legal & Compliance | quick fix |
| Data Protection Officer Contact | Legal & Compliance | quick fix |
+6 more
Later (32)
Lower impact and more work. Plan them once the rest is done.
| Finding | Category | Effort |
|---|---|---|
| Script Loading Strategy | Performance | about a day |
| Image Format Optimization | SEO | about a day |
| Accessibility Fundamentals | SEO | about a day |
| Content-Security-Policy (CSP) | Security | about a day |
| CDN / WAF Protection | Security | about a day |
| Touch Target Size | Mobile | about a day |
| Font Size Readability | Mobile | about a day |
| Responsive Images (srcset) | Mobile | about a day |
| Structured Data Foundation | AI Readiness | about a day |
| FAQ Schema (Direct AI Answers) | AI Readiness | about a day |
| Image Alt Text Quality for AI | AI Readiness | about a day |
| Cookie Policy | Legal & Compliance | about a day |
+20 more
Performance
89/100
Total Page WeightFailed
3.3 MB, 61 requests — too heavy!
Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Unused Code (CSS + JS)Failed
521 KB wasted on unused code!
Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
How to fix: You're loading 521 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
CSS File CountFailed
11 CSS files — too many!
Why it matters: Each CSS file blocks rendering. With 11 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
JavaScript BudgetWarning
1028 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked
Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.
How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
Script Loading StrategyWarning
Only 58% of 12 scripts use async/defer
Why it matters: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.
How to fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
Font PreloadingWarning
Custom fonts detected without preload hints
Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Critical CSS StrategyWarning
11 CSS files without critical CSS extraction
Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.
How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Connection Hint CoverageWarning
7 external domains without preconnect
Why it matters: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.
How to fix: Add <link rel='preconnect'> for key third-party domains: consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Server Response Time (TTFB)Passed
16ms
First Contentful Paint (FCP)Passed
0.71s
Largest Contentful Paint (LCP)Passed
1.11s — Core Web Vital ✓
Total Blocking Time (TBT)Passed
61ms
Cumulative Layout Shift (CLS)Passed
0.002 — Core Web Vital ✓
Speed IndexPassed
0.93s
Request BudgetPassed
61 requests — within the budget of 80
Why it matters: Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed.
Text Compression (gzip/brotli)Passed
All text resources properly compressed
Resource Hints (Preload/Preconnect)Passed
1 preload, 2 preconnect hint(s)
Lazy LoadingPassed
82% of images use native lazy loading (75/92)
Font Loading StrategyPassed
font-display: swap
Third-party ServicesInfo
Not measured — PageSpeed did not return the third-party audit for this URL
Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.
How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
SEO
90/100
Meta DescriptionWarning
10 chars (optimal: 120-160)
Why it matters: Short descriptions waste SERP real estate and miss the chance to persuade searchers to click.
How to fix: Expand your description to at least 120 characters. Include benefits, a CTA, and your target keyword.
Image Format OptimizationWarning
0% next-gen formats — 25 JPEG, 36 PNG images
Why it matters: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.
How to fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
Canonical URL ConsistencyWarning
Canonical points to different URL: https://www.kagency.com/
Why it matters: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.
How to fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
Empty/Dead LinksWarning
7 dead links (0 empty, 7 hash-only, 0 javascript:void)
Why it matters: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.
How to fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
Accessibility FundamentalsWarning
2/4 a11y signals — missing: ARIA roles, skip navigation link
Why it matters: The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO, as Google treats it as a ranking signal.
How to fix: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
Meta TitlePassed
60 chars — "Agence web Nantes - Création de sites internet et e-com…"
H1 HeadingPassed
"L’agence web pour créer votre site internet à Nantes"
Content Structure (H2 Headings)Passed
10 H2 subheadings found
Open Graph TagsPassed
og:title, og:image, og:type
Open Graph Image FormatPassed
image/jpeg
Twitter/X CardsPassed
Card type: summary_large_image
Canonical URLPassed
https://www.kagency.com/
Structured Data (JSON-LD)Passed
2 block(s): WebSite, SearchAction, EntryPoint, ProfessionalService
JSON-LD ValidityPassed
2 block(s) parse cleanly
robots.txtPassed
Present, references sitemap
XML SitemapPassed
Found with 479 URLs
HTML Language AttributePassed
lang="fr"
Image Alt AttributesPassed
100% of 92 images have alt text
Meta Robots TagPassed
index, follow
FaviconPassed
Favicon detected
Semantic HTML StructurePassed
4/6 semantic elements: <nav>, <main>, <header>, <footer>
Content DepthPassed
1983 words — sufficient content
Deep Heading HierarchyPassed
H2: 10, H3: 56 — well-structured content
Internal LinkingPassed
77 internal links — strong site navigation
Sitemap FreshnessPassed
Newest <lastmod> 107 day(s) ago
Text-to-HTML RatioInfo
14% ratio but 1983 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
Why it matters: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.
How to fix: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.
Security
81/100
DNSSECWarning
No DNSKEY records — zone is unsigned
Why it matters: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.
How to fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
CAA DNS RecordWarning
No CAA records — any CA can issue certificates for this domain
Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
Content-Security-Policy (CSP)Warning
Present but uses 'unsafe-inline'
Why it matters: 'unsafe-inline' allows injected scripts to execute — defeating the main purpose of CSP. Major XSS protection is bypassed.
How to fix: Remove 'unsafe-inline' by using nonces or hashes for inline scripts. Remove 'unsafe-eval' by eliminating eval() calls. These exceptions weaken CSP significantly.
Subresource Integrity (SRI)Warning
Only 3/9 SRI-eligible third-party scripts have integrity hashes (2 auto-updating provider script(s) excluded — SRI not applicable)
Why it matters: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.
How to fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
security.txt (RFC 9116)Warning
Why it matters: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.
How to fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
CDN / WAF ProtectionWarning
Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.
How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
SSL/TLS CertificatePassed
Valid HTTPS connection established
HTTP → HTTPS RedirectPassed
HTTP properly redirects to HTTPS
HSTS (Strict-Transport-Security)Passed
max-age=31536000, preload, includeSubDomains
Clickjacking ProtectionPassed
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
X-Content-Type-OptionsPassed
nosniff
Referrer-PolicyPassed
strict-origin-when-cross-origin
Permissions-PolicyPassed
geolocation=(), camera=(), microphone=()
Cookie Security FlagsPassed
No cookies set on initial response
Technology DisclosurePassed
Server: nginx (no version)
Server Version DisclosurePassed
Nginx — version hidden
Mobile
66/100
Mobile Performance ScoreWarning
56/100 (target: 90+)
Why it matters: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.
How to fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
Desktop/Mobile Performance GapWarning
Desktop: 98 vs Mobile: 56 (42 point gap)
Why it matters: Google uses mobile-first indexing — your mobile score IS your SEO score. A big gap means your desktop optimizations aren't reaching mobile users, who are the majority of your traffic.
How to fix: Your desktop experience is significantly better than mobile. Focus on: reducing JavaScript (mobile CPUs are slower), serving responsive images (smaller files for smaller screens), and minimizing main-thread work.
Touch Target SizeWarning
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityWarning
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
Theme ColorWarning
Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Responsive Images (srcset)Warning
92 images without responsive sizing
Why it matters: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.
How to fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
Form Input TypesWarning
phone fields use type='text' instead of type='tel'
Why it matters: Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors and speeds up form completion.
How to fix: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
Viewport ConfigurationPassed
width=device-width, initial-scale=1
Content Fits ViewportPassed
No horizontal scrolling needed
Responsive Design TechniquesPassed
Media queries detected
Mobile Navigation (Semantic)Passed
<nav> element present — proper navigation landmark
Apple Mobile Web AppPassed
2/3 Apple mobile meta tags configured
Form Input Labels (WCAG 3.3.2)Passed
6/6 inputs have a label
Heading Hierarchy (WCAG 1.3.1)Passed
No skipped heading levels
Link Text Quality (WCAG 2.4.4)Passed
All links have descriptive text
AI Readiness
71/100
Organization Schema + Entity LinkingFailed
Why it matters: Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
How to fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
Content Freshness SignalsFailed
Why it matters: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
How to fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
Structured Data FoundationWarning
2 distinct schema types (WebSite, ProfessionalService) — add more for comprehensive AI coverage
Why it matters: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite.
How to fix: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
FAQ Schema (Direct AI Answers)Warning
Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Structured Content (Lists & Tables)Warning
13 lists found — consider adding comparison tables
Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.
How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
Entity Clarity & Brand SignalsWarning
2 sameAs links but incomplete OG tags
Why it matters: AI needs to confidently identify your brand entity. Open Graph and sameAs together create a cross-platform identity that AI models recognize.
How to fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
Author Expertise Signals (E-E-A-T)Warning
Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.
How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Extractable Answer BlocksWarning
43 paragraphs, avg 19 words — too short for citation
Why it matters: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.
How to fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
Statistics & Data PresenceWarning
No statistical data found in content
Why it matters: Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics.
How to fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
Section Length OptimizationWarning
Avg section: 42 words — only 14% in 80-200 word optimal range
Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsWarning
1 question heading(s) — add more
Why it matters: AI search engines like Perplexity and ChatGPT match user questions to heading-answer pairs. Q&A format headings are directly extractable by AI and trigger FAQ-style rich results.
How to fix: Phrase H2/H3 headings as questions: 'How does...?', 'What is...?', 'Why should...?' followed by a direct 1-2 sentence answer. This is a leading format AI assistants use to generate responses.
Canonical Tag for AI DeduplicationWarning
Canonical points to different URL: https://www.kagency.com/
Why it matters: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.
How to fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
Knowledge Graph ReadinessWarning
1/4 signals — missing: @id in JSON-LD, consistent brand name (title/schema/OG), Organization schema
Why it matters: @id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity.
How to fix: Add: @id in JSON-LD, consistent brand name (title/schema/OG), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
Content Readability for AIWarning
Grade 20 — too complex for broad AI citation (technical threshold: 14)
Why it matters: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.
How to fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Image Alt Text Quality for AIWarning
66% good, 30 poor, 0 missing
Why it matters: AI uses alt text to understand images for visual search (Google Lens, Bing Visual Search), product recommendations, and accessibility. Quality alt text opens more discovery channels.
How to fix: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.
WebMCP Agentic ReadinessWarning
Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
AI Bot Access PolicyPassed
No AI bot restrictions (allowed by default)
AI agent access (live)Passed
ChatGPT-User and PerplexityBot get the same page as a browser
Content Accessibility for AIPassed
1983 words in raw HTML (13.8% text ratio) — readable by AI crawlers without executing JS
Site Search Schema (SearchAction)Passed
WebSite SearchAction configured — AI can search your store
Content Depth for AIPassed
1983 words — rich content for AI analysis and citation
Answer-First Content FormatPassed
First paragraph: 37 words — good content density above the fold
Heading Hierarchy for AIPassed
Proper structure: 1 H1 → 10 H2s → 56 H3s — clear content outline
Semantic HTML StructurePassed
4/6 semantic elements: <nav>, <main>, <header>, <footer>
Internal Link DensityPassed
39 contextual internal links per 1,000 words — strong knowledge graph signal
Expert Quotations & CitationsPassed
29 blockquotes/citations found — strong authority signal
Content-to-Boilerplate RatioPassed
88% of text in <main>/<article> — clean content signal
Social Proof (Testimonials / Case Studies)Passed
Strong social proof: testimonials, case studies / portfolio, 29 quotations
llms.txt (AI Site Descriptor)Info
Valid llms.txt with 4000 chars — proper format with H1, links, summary
Why it matters: No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Legal & Compliance
75/100
Cookie PolicyWarning
Why it matters: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
How to fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
Legal Contact / Imprint PageWarning
Why it matters: In DACH countries, a missing Impressum can trigger fines and competitor cease-and-desist letters. For all EU stores, identifying the data controller is a GDPR Article 13 requirement.
How to fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
Terms & Conditions PageWarning
Why it matters: EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights.
How to fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
Third-party Data SharingWarning
7 third-party domains loading scripts
Why it matters: Every third-party script is a potential data processor under GDPR. You need a DPA with each one, and they must be disclosed to users. Excessive third parties also increase data breach risk.
How to fix: Your page loads scripts from 7 external domains. Review each one: consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, unpkg.com... Ensure each has a Data Processing Agreement (DPA) and is listed in your privacy policy.
Right to Erasure (Data Deletion)Warning
Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Data Protection Officer ContactWarning
Why it matters: GDPR Article 37 requires a DPO for organizations processing personal data at scale. Even if not mandatory, having a designated privacy contact builds trust and is expected by regulators.
How to fix: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
Withdrawal of Consent MechanismWarning
Why it matters: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.
How to fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
Cookie Consent Banner (CMP)Passed
Cookiebot detected
Tracking Scripts & ConsentPassed
1 tracker(s) detected with CMP: Matomo
Privacy Policy PagePassed
https://www.kagency.com/politique-de-confidentialite
Data Encryption (No Mixed Content)Passed
All resources loaded over HTTPS
Newsletter ConsentPassed
Newsletter form with consent mechanism detected
Vulnerability
88/100
Form CSRF ProtectionFailed
1 form(s) without CSRF tokens
Why it matters: CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.
How to fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
package.json ExposedWarning
package.json accessible — reveals all dependencies and versions
Why it matters: package.json reveals your exact dependency versions, allowing attackers to search for known CVEs in each library. It's a complete vulnerability roadmap.
How to fix: Block access to package.json via .htaccess or server config. It should never be served to the public.
DMARC Policy (Email Auth)Warning
DMARC set to p=none (monitoring only, no enforcement)
Why it matters: DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes.
How to fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
Cross-Origin IsolationWarning
Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
CMS Version DisclosurePassed
No generator tag — CMS identity hidden
Sensitive Files ExposedPassed
.env, .git, composer.json — all properly blocked
Install Script ExposedPassed
No /install/ or /setup/ paths accessible
Directory ListingPassed
Disabled — file structure hidden
Admin Panel at Default URLPassed
Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
Debug Mode / Error ExposurePassed
No debug indicators found in page output
jQuery VersionPassed
jQuery 3.7.1
SPF Record (Email Security)Passed
SPF configured: v=spf1 a:spf-senders.oceamail.com ip4:80.74.68.89 ip4:80.74.64.0/24 ip4:80.74.78
DKIM Signing (Email Auth)Passed
DKIM configured (selectors: default)
Accessibility / EAA
96/100
Skip LinkWarning
No skip-to-content link detected
Why it matters: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).
How to fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
Page LanguagePassed
<html lang="fr"> is set
Image Alt TextPassed
All 92 images have alt attributes
Form LabelsPassed
All 6 form inputs are labelled
Heading StructurePassed
Single <h1> with a consistent heading outline
Link TextPassed
Links use descriptive text
Landmark RegionsPassed
Semantic landmarks present (<main>, <nav>/<header>)
Zoom & ScalingPassed
Pinch-zoom is not disabled
EAA Legal BasisInfo
In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
Next steps
Online report
The full interactive version, with clickable links and the option to re-scan, is here:
https://score.zulien.sk/r/kagency.com
Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk