# kagency.com — Zulien Score 84/100 (Grade A)

> Free e-commerce audit: 84/100 overall score. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://kagency.com
- **Scan date:** 2026-10-08
- **Full report:** https://score.zulien.sk/en/r/kagency.com
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/kagency.com

## Audit summary

Your store performs well overall, but needs attention to security and AI readiness. Add CSRF protection to forms immediately. Your accessibility and SEO are excellent.

## Score by category

| Category | Score |
|---|---|
| Performance | 89/100 |
| SEO | 90/100 |
| Security | 81/100 |
| Mobile | 66/100 |
| AI Readiness | 71/100 |
| GDPR | 75/100 |
| Vulnerability | 88/100 |
| Accessibility | 96/100 |

## Detailed findings

### Performance — 89/100

- **[FAIL]** Total Page Weight — 3.3 MB, 61 requests — too heavy!
  - Fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Evidence: PSI-lab
- **[FAIL]** Unused Code (CSS + JS) — 521 KB wasted on unused code!
  - Fix: You're loading 521 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[FAIL]** CSS File Count — 11 CSS files — too many!
  - Fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Evidence: HTML-heuristic
- **[WARN]** JavaScript Budget — 1028 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked
  - Fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
  - Evidence: PSI-lab · 1028 KB JavaScript · confidence: high
- **[WARN]** Script Loading Strategy — Only 58% of 12 scripts use async/defer
  - Fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
  - Evidence: HTML-heuristic
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 11 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[WARN]** Connection Hint Coverage — 7 external domains without preconnect
  - Fix: Add <link rel='preconnect'> for key third-party domains: consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
  - Evidence: PSI-lab
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 16ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.71s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 1.11s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 61ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.002 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 0.93s
  - Evidence: PSI-lab
- **[PASS]** Request Budget — 61 requests — within the budget of 80
  - Evidence: PSI-lab · 61 requests · confidence: high
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 1 preload, 2 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** Lazy Loading — 82% of images use native lazy loading (75/92)
  - Evidence: HTML-heuristic
- **[PASS]** Font Loading Strategy — font-display: swap
  - Evidence: HTML-heuristic

### SEO — 90/100

- **[WARN]** Meta Description — 10 chars (optimal: 120-160)
  - Fix: Expand your description to at least 120 characters. Include benefits, a CTA, and your target keyword.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — 0% next-gen formats — 25 JPEG, 36 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL Consistency — Canonical points to different URL: https://www.kagency.com/
  - Fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Evidence: HTML-heuristic
- **[WARN]** Empty/Dead Links — 7 dead links (0 empty, 7 hash-only, 0 javascript:void)
  - Fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Evidence: HTML-heuristic
- **[WARN]** Accessibility Fundamentals — 2/4 a11y signals — missing: ARIA roles, skip navigation link
  - Fix: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 14% ratio but 1983 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 60 chars — "Agence web Nantes - Création de sites internet et e-com…"
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "L’agence web pour créer votre site internet à Nantes"
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 10 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Image Format — image/jpeg
  - Evidence: HTML-heuristic
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://www.kagency.com/
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 2 block(s): WebSite, SearchAction, EntryPoint, ProfessionalService
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 2 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with 479 URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="fr"
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 100% of 92 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — index, follow
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth — 1983 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 10, H3: 56 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 77 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 107 day(s) ago
  - Evidence: HTML-heuristic

### Security — 81/100

- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** Content-Security-Policy (CSP) — Present but uses 'unsafe-inline'
  - Fix: Remove 'unsafe-inline' by using nonces or hashes for inline scripts. Remove 'unsafe-eval' by eliminating eval() calls. These exceptions weaken CSP significantly.
  - Evidence: HTTP-header
- **[WARN]** Subresource Integrity (SRI) — Only 3/9 SRI-eligible third-party scripts have integrity hashes (2 auto-updating provider script(s) excluded — SRI not applicable)
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Evidence: HTML-heuristic
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** HSTS (Strict-Transport-Security) — max-age=31536000, preload, includeSubDomains
  - Evidence: HTTP-header
- **[PASS]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN, SAMEORIGIN
  - Evidence: HTTP-header
- **[PASS]** X-Content-Type-Options — nosniff
  - Evidence: HTTP-header
- **[PASS]** Referrer-Policy — strict-origin-when-cross-origin
  - Evidence: HTTP-header
- **[PASS]** Permissions-Policy — geolocation=(), camera=(), microphone=()
  - Evidence: HTTP-header
- **[PASS]** Cookie Security Flags — No cookies set on initial response
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: nginx (no version)
  - Evidence: HTTP-header
- **[PASS]** Server Version Disclosure — Nginx — version hidden
  - Evidence: HTTP-header

### Mobile — 66/100

- **[WARN]** Mobile Performance Score — 56/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Desktop/Mobile Performance Gap — Desktop: 98 vs Mobile: 56 (42 point gap)
  - Fix: Your desktop experience is significantly better than mobile. Focus on: reducing JavaScript (mobile CPUs are slower), serving responsive images (smaller files for smaller screens), and minimizing main-thread work.
  - Evidence: HTML-heuristic
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Responsive Images (srcset) — 92 images without responsive sizing
  - Fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Evidence: HTML-heuristic
- **[WARN]** Form Input Types — phone fields use type='text' instead of type='tel'
  - Fix: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Apple Mobile Web App — 2/3 Apple mobile meta tags configured
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Labels (WCAG 3.3.2) — 6/6 inputs have a label
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy (WCAG 1.3.1) — No skipped heading levels
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — All links have descriptive text
  - Evidence: HTML-heuristic

### AI Readiness — 71/100

- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Data Foundation — 2 distinct schema types (WebSite, ProfessionalService) — add more for comprehensive AI coverage
  - Fix: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
  - Evidence: schema
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Structured Content (Lists & Tables) — 13 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Entity Clarity & Brand Signals — 2 sameAs links but incomplete OG tags
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Extractable Answer Blocks — 43 paragraphs, avg 19 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 42 words — only 14% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings — 1 question heading(s) — add more
  - Fix: Phrase H2/H3 headings as questions: 'How does...?', 'What is...?', 'Why should...?' followed by a direct 1-2 sentence answer. This is a leading format AI assistants use to generate responses.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.kagency.com/
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Evidence: HTML-heuristic
- **[WARN]** Knowledge Graph Readiness — 1/4 signals — missing: @id in JSON-LD, consistent brand name (title/schema/OG), Organization schema
  - Fix: Add: @id in JSON-LD, consistent brand name (title/schema/OG), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 20 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Image Alt Text Quality for AI — 66% good, 30 poor, 0 missing
  - Fix: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Valid llms.txt with 4000 chars — proper format with H1, links, summary
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** AI agent access (live) — ChatGPT-User and PerplexityBot get the same page as a browser
  - Evidence: file-probe · ChatGPT-User, PerplexityBot: same page as a browser · https://kagency.com
- **[PASS]** Content Accessibility for AI — 1983 words in raw HTML (13.8% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Evidence: schema
- **[PASS]** Content Depth for AI — 1983 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 37 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy for AI — Proper structure: 1 H1 → 10 H2s → 56 H3s — clear content outline
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 39 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Expert Quotations & Citations — 29 blockquotes/citations found — strong authority signal
  - Evidence: HTML-heuristic
- **[PASS]** Content-to-Boilerplate Ratio — 88% of text in <main>/<article> — clean content signal
  - Evidence: HTML-heuristic
- **[PASS]** Social Proof (Testimonials / Case Studies) — Strong social proof: testimonials, case studies / portfolio, 29 quotations
  - Evidence: HTML-heuristic

### GDPR — 75/100

- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Legal Contact / Imprint Page
  - Fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Third-party Data Sharing — 7 third-party domains loading scripts
  - Fix: Your page loads scripts from 7 external domains. Review each one: consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, unpkg.com... Ensure each has a Data Processing Agreement (DPA) and is listed in your privacy policy.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Data Protection Officer Contact
  - Fix: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal of Consent Mechanism
  - Fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Evidence: HTML-heuristic
- **[PASS]** Cookie Consent Banner (CMP) — Cookiebot detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — 1 tracker(s) detected with CMP: Matomo
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — https://www.kagency.com/politique-de-confidentialite
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Evidence: HTML-heuristic

### Vulnerability — 88/100

- **[FAIL]** Form CSRF Protection — 1 form(s) without CSRF tokens
  - Fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** package.json Exposed — package.json accessible — reveals all dependencies and versions
  - Fix: Block access to package.json via .htaccess or server config. It should never be served to the public.
  - Evidence: file-probe
- **[WARN]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
  - Evidence: DNS
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** jQuery Version — jQuery 3.7.1
  - Evidence: file-probe
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 a:spf-senders.oceamail.com ip4:80.74.68.89 ip4:80.74.64.0/24 ip4:80.74.78
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: default)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Accessibility — 96/100

- **[WARN]** Skip Link — No skip-to-content link detected
  - Fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="fr"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Text — All 92 images have alt attributes
  - Evidence: HTML-heuristic
- **[PASS]** Form Labels — All 6 form inputs are labelled
  - Evidence: HTML-heuristic
- **[PASS]** Heading Structure — Single <h1> with a consistent heading outline
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Evidence: HTML-heuristic
- **[PASS]** Zoom & Scaling — Pinch-zoom is not disabled
  - Evidence: HTML-heuristic

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/en/r/kagency.com)