Below Average

Score Report

kelo.sk

Scanned on August 3, 2026

WooCommerce (WP 7.0.2)
jQuery
Font Awesome
Owl Carousel
Video.js
Company:jachta.sk s.r.o.· NACE 7020
NIS2: out of scope
Risk:25/100low
Credit:A
VAT registered
Top 50% in sector
Full company profile →
Last scanned: August 3, 2026
AI verdict

Your store works but has significant room for improvement. Start by adding meta descriptions and H1 headings to all product pages—they're essential for search engines and customers. Your security foundation is solid and your server setup is functional.

Not subject to NIS2 cybersecurity duties.Based on NACE sector + company size, Article 21 compliance is not mandatory. Security best practices still recommended.
Supplying a NIS2-regulated company?Even outside direct scope you may inherit supply-chain duties — regulated companies cascade them to suppliers by contract (security, incident reporting, encryption). ICT and managed-service providers are in scope regardless of size.
Check supplier obligations Legal basis: NIS2 Art. 21 · SK 366/2024 §21 · NIS2 Art. 21(2)(d)
Action plan

Fix these 3 things first

Sorted by score impact — each fix moves your overall grade up.

+18potential gain

Performance

Weight: 25% · 9 passed · 6 warnings · 5 failed · 2 SPA (verify manually)

What we found: 4.7 MB, 80 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Evidence:PSI-lab· Confidence: high
Get Performance Optimization →

What we found: 1414 KB — more than double the 600 KB budget

Why it matters: Above 1 200 KB the parse and execute cost alone stalls mid-range phones for seconds before anything is interactive. For reference, the best shop in our benchmark ships 410 KB and won its award on mobile experience.

How to fix: Audit what ships on a product page: split the bundle by route, defer every third-party tag until interaction or consent, and remove plugins whose bundle you cannot account for. Measure again after each removal.
Evidence:PSI-lab1414 KB JavaScript· Confidence: high
Get Performance Optimization →

What we found: 897 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 897 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Evidence:PSI-lab· Confidence: low

What we found: Only 24% of 37 scripts optimized — most are render-blocking

Why it matters: 28 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
Evidence:HTML-heuristic· Confidence: high
Get Performance Optimization →

What we found: 19 CSS files — too many!

Why it matters: Each CSS file blocks rendering. With 19 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Evidence:HTML-heuristic· Confidence: high

What we found: 370ms (good: <200ms)

Why it matters: TBT measures how long the main thread is blocked. During this time, clicks and taps don't respond — your store feels frozen. This directly impacts perceived quality.

How to fix: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: Google Fonts detected without font-display

Why it matters: Without font-display, custom fonts cause Flash of Invisible Text (FOIT) — text is completely hidden during font download. On slow connections this can last 3+ seconds.

How to fix: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: max-age=0, no-cache, no-store, must-revalidate

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Evidence:HTTP-header· Confidence: high
Request quote for speed audit

What we found: Custom fonts detected without preload hints

Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: 19 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

11 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Your store is losing customers every day. The issues above are costing you sales.

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Full e-commerce audit — 50+ checks across 7 categories
64/100
Grade D
kelo.sk
jachta.sk s.r.o.
Audit date: August 3, 2026
Platform: WooCommerce (WP 7.0.2)
NACE: 7020
Online report: https://score.zulien.sk/r/kelo.sk
Generated · score.zulien.sk · by Zulien

Executive summary

26
Failures
57
Warnings
58
OK
162
Checks total

Scores by category

CategoryScoreWeightFailuresWarningsOK
Performance71/10025%569
SEO64/10020%4613
Security59/10015%367
Mobile67/10010%0107
AI Readiness49/10010%9178
Legal & Compliance60/10010%276
Vulnerability70/10010%358

Critical findings

Total Page Weight· Performance
Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
JavaScript Budget· Performance
Above 1 200 KB the parse and execute cost alone stalls mid-range phones for seconds before anything is interactive. For reference, the best shop in our benchmark ships 410 KB and won its award on mobile experience.
Unused Code (CSS + JS)· Performance
Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
Script Loading Strategy· Performance
28 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.
CSS File Count· Performance
Each CSS file blocks rendering. With 19 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
Meta Description· SEO
Without a meta description, Google auto-generates one — often poorly. A custom description gives you control over the SERP snippet and improves click-through.
H1 Heading· SEO
The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords.
Open Graph Tags· SEO
Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
Structured Data (JSON-LD)· SEO
Pages with structured data can earn rich snippets in Google — star ratings, prices, availability — which lift click-through.
HSTS (Strict-Transport-Security)· Security
Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Content-Security-Policy (CSP)· Security
CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
Clickjacking Protection· Security
Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Performance

71/100
Weight: 25% · 9 OK · 6 warnings · 5 failures · 22 total
Total Page WeightFailed
4.7 MB, 80 requests — too heavy!
Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
JavaScript BudgetFailed
1414 KB — more than double the 600 KB budget
Why it matters: Above 1 200 KB the parse and execute cost alone stalls mid-range phones for seconds before anything is interactive. For reference, the best shop in our benchmark ships 410 KB and won its award on mobile experience.
How to fix: Audit what ships on a product page: split the bundle by route, defer every third-party tag until interaction or consent, and remove plugins whose bundle you cannot account for. Measure again after each removal.
Unused Code (CSS + JS)Failed
897 KB wasted on unused code!
Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
How to fix: You're loading 897 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Script Loading StrategyFailed
Only 24% of 37 scripts optimized — most are render-blocking
Why it matters: 28 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.
How to fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
CSS File CountFailed
19 CSS files — too many!
Why it matters: Each CSS file blocks rendering. With 19 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Total Blocking Time (TBT)Warning
370ms (good: <200ms)
Why it matters: TBT measures how long the main thread is blocked. During this time, clicks and taps don't respond — your store feels frozen. This directly impacts perceived quality.
How to fix: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.
Resource Hints (Preload/Preconnect)Warning
Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.
How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
Font Loading StrategyWarning
Google Fonts detected without font-display
Why it matters: Without font-display, custom fonts cause Flash of Invisible Text (FOIT) — text is completely hidden during font download. On slow connections this can last 3+ seconds.
How to fix: Add &display=swap to your Google Fonts URL, or add font-display: swap to your @font-face declarations.
Cache-Control StrategyWarning
max-age=0, no-cache, no-store, must-revalidate
Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.
How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Font PreloadingWarning
Custom fonts detected without preload hints
Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Critical CSS StrategyWarning
19 CSS files without critical CSS extraction
Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.
How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Server Response Time (TTFB)Passed
47ms
First Contentful Paint (FCP)Passed
0.79s
Largest Contentful Paint (LCP)Passed
1.80s — Core Web Vital ✓
Cumulative Layout Shift (CLS)Passed
0.013 — Core Web Vital ✓
Speed IndexPassed
1.65s
Request BudgetPassed
80 requests — within the budget of 80
Why it matters: Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed.
Text Compression (gzip/brotli)Passed
All text resources properly compressed
Lazy LoadingPassed
48% of images use native lazy loading (14/29)
HTTP/3 (QUIC) SupportPassed
HTTP/3 enabled via Alt-Svc header
Third-party ServicesInfo
Not measured — PageSpeed did not return the third-party audit for this URL
Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.
How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Category 1 / 7 · kelo.sk · Zulien Score

SEO

64/100
Weight: 20% · 13 OK · 6 warnings · 4 failures · 24 total
Meta DescriptionFailed
Why it matters: Without a meta description, Google auto-generates one — often poorly. A custom description gives you control over the SERP snippet and improves click-through.
How to fix: Write a compelling meta description (120-160 chars) with a call-to-action. Include your target keyword naturally.
H1 HeadingFailed
Why it matters: The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords.
How to fix: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
Open Graph TagsFailed
Why it matters: Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
How to fix: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
Structured Data (JSON-LD)Failed
Why it matters: Pages with structured data can earn rich snippets in Google — star ratings, prices, availability — which lift click-through.
How to fix: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
Meta TitleWarning
7 chars (optimal: 30-60)
Why it matters: Short titles waste valuable ranking real estate in search results.
How to fix: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.
Twitter/X CardsWarning
Why it matters: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.
How to fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
Image Format OptimizationWarning
Only 14% next-gen formats — 10 legacy images remain
Why it matters: WebP/AVIF images are 30-70% smaller than JPEG/PNG at the same quality. This directly improves page speed, LCP, and mobile experience.
How to fix: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.
Empty/Dead LinksWarning
9 dead links (1 empty, 8 hash-only, 0 javascript:void)
Why it matters: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.
How to fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
Product Schema RichnessWarning
Missing recommended: brand, aggregateRating, review, gtin
Why it matters: Complete product schema enables rich snippets that lift organic click-through. Products with reviews/ratings in search results see meaningfully higher CTR.
How to fix: Add brand, aggregateRating, review, gtin to your Product schema. These fields enable rich snippets with star ratings, price, availability, and brand in search results.
Excessive Resource RequestsWarning
37 JS + 19 CSS = 56 external requests
Why it matters: Google's crawl budget is limited. Sites with excessive resources get crawled less frequently and experience slower indexation of new content.
How to fix: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.
Content Structure (H2 Headings)Passed
10 H2 subheadings found
Canonical URLPassed
https://kelo.sk/
robots.txtPassed
Present, references sitemap
XML SitemapPassed
Found with 7 URLs
HTML Language AttributePassed
lang="sk-SK"
Image Alt AttributesPassed
100% of 29 images have alt text
Meta Robots TagPassed
max-image-preview:large
FaviconPassed
Favicon detected
Semantic HTML StructurePassed
4/6 semantic elements: <article>, <header>, <footer>, <aside>
Content DepthPassed
665 words — sufficient content
Deep Heading HierarchyPassed
H2: 10, H3: 17 — well-structured content
Internal LinkingPassed
19 internal links — strong site navigation
Accessibility FundamentalsPassed
3/4 a11y signals: 54 ARIA roles, 18 ARIA labels, lang="sk-SK"
Text-to-HTML RatioInfo
2% ratio but 665 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
Why it matters: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.
How to fix: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.
Category 2 / 7 · kelo.sk · Zulien Score

Security

59/100
Weight: 15% · 7 OK · 6 warnings · 3 failures · 16 total
HSTS (Strict-Transport-Security)Failed
Why it matters: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
How to fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
Content-Security-Policy (CSP)Failed
Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
Clickjacking ProtectionFailed
Why it matters: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
How to fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
CAA DNS RecordWarning
No CAA records — any CA can issue certificates for this domain
Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
X-Content-Type-OptionsWarning
Why it matters: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.
How to fix: Add header: X-Content-Type-Options: nosniff
Referrer-PolicyWarning
Why it matters: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.
How to fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
Permissions-PolicyWarning
Why it matters: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.
How to fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
security.txt (RFC 9116)Warning
Why it matters: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.
How to fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
CDN / WAF ProtectionWarning
Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.
How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
SSL/TLS CertificatePassed
Valid HTTPS connection established
DNSSECPassed
Zone is DNSSEC-signed (DNSKEY published)
Why it matters: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.
HTTP → HTTPS RedirectPassed
HTTP properly redirects to HTTPS
Cookie Security FlagsPassed
No cookies set on initial response
Technology DisclosurePassed
Server: openresty (no version)
Subresource Integrity (SRI)Passed
All cross-origin scripts are auto-updating provider scripts where SRI does not apply
Server Version DisclosurePassed
openresty — version hidden
Category 3 / 7 · kelo.sk · Zulien Score

Mobile

67/100
Weight: 10% · 7 OK · 10 warnings · 0 failures · 20 total
Mobile Performance ScoreWarning
61/100 (target: 90+)
Why it matters: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.
How to fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
Touch Target SizeWarning
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityWarning
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
PWA FeaturesWarning
Why it matters: PWAs combine the best of web and native apps. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access.
How to fix: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.
Theme ColorWarning
Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Mobile Navigation (Semantic)Warning
Why it matters: Semantic <nav> elements are essential for mobile accessibility. Screen readers use them to let users jump directly to navigation — critical on small screens where content is long.
How to fix: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').
Apple Mobile Web AppWarning
Missing: apple-mobile-web-app-capable, status-bar-style
Why it matters: These tags enable 'Add to Home Screen' on iOS with a full-screen experience. A polished home screen presence increases return visits.
How to fix: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
Mobile Sticky CTAWarning
Add-to-cart button found but no sticky/fixed positioning detected
Why it matters: Mobile users scroll extensively. A sticky add-to-cart bar keeps the primary action visible. Without it, users must scroll back up to purchase — many won't.
How to fix: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.
Print StylesheetWarning
Order/invoice page without print styles
Why it matters: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.
How to fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
Heading Hierarchy (WCAG 1.3.1)Warning
Preskočené úrovne: h2→h4, h2→h5
Why it matters: Skipped heading levels (h1 straight to h3) break screen-reader navigation and signal poor document structure to Google. SEO suffers too.
How to fix: Keep headings in order h1 → h2 → h3 → h4 with no skipped levels. Screen readers use the heading hierarchy to navigate. If you want smaller text at the same level, use a CSS class rather than a lower heading tag.
Viewport ConfigurationPassed
width=device-width, initial-scale=1
Content Fits ViewportPassed
No horizontal scrolling needed
Responsive Design TechniquesPassed
Flexbox, CSS Grid, Media queries detected
Responsive Images (srcset)Passed
26 image(s) use srcset for responsive sizing
Form Input TypesPassed
Optimized: 4 search
Form Input Labels (WCAG 3.3.2)Passed
4/4 inputs majú label
Link Text Quality (WCAG 2.4.4)Passed
Všetky odkazy majú popisný text
Payment Methods DetectedInfo
Žiadna známa platobná brána nedetekovaná na homepage
Why it matters: Viditeľné platobné ikony (Apple Pay, Google Pay, Klarna, Tatra Pay) v headeri/footeri zvyšujú conversion. Trust signal pred checkoutom.
How to fix: Payment gateway detection only scans the homepage. If payments live on /checkout or are loaded by JS after an interaction, we cannot see them. Consider adding payment icons to the footer.
Express Checkout (Apple Pay + Google Pay)Info
Apple Pay / Google Pay nedetekované na homepage — express checkout sa zvyčajne zobrazí až v košíku/checkoute
Why it matters: Mobile conversion with express checkout beats manual card entry, and it is a growing trend in SK/CZ. (The scan only sees the homepage, so treat this as a hint rather than a verdict.)
How to fix: If you have no express checkout, add Apple Pay and Google Pay via Stripe, Adyen or Mollie. Biometric auth removes a click from checkout, which lifts conversion.
SK/CZ Local Payment MethodsInfo
Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute
Why it matters: An SK/CZ shop without bank buttons and QR payment sees heavy cart abandonment; the average Slovak e-shop offers several payment methods. (The scan only sees the homepage — verify in your checkout.)
How to fix: If you do not offer SK/CZ local payments, integrate GoPay or ComGate — both cover Tatra Pay, VÚB Pay, ČSOB Pay, Raiffeisen and QR payment through one API. Barion is an alternative for the CZ market.
Category 4 / 7 · kelo.sk · Zulien Score

AI Readiness

49/100
Weight: 10% · 8 OK · 17 warnings · 9 failures · 48 total
Structured Data FoundationFailed
Why it matters: Without structured data, your store is invisible to AI commerce. Google AI Overviews, ChatGPT Shopping, Perplexity, and Bing Copilot all rely on schema markup to understand and recommend products.
How to fix: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
Organization Schema + Entity LinkingFailed
Why it matters: Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
How to fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
Heading Hierarchy for AIFailed
0 H1, 10 H2, 17 H3 — poor structure
Why it matters: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.
How to fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
Content Freshness SignalsFailed
Why it matters: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
How to fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
Entity Clarity & Brand SignalsFailed
Why it matters: AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.
How to fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
Common Question CoverageFailed
Answers only 1/5 key shopper questions: shipping
Why it matters: AI assistants answer shopping queries by fanning out into price/shipping/returns/availability/payment sub-questions. A page that answers none of them is invisible in AI shopping answers and reads as untrustworthy to buyers.
How to fix: Your page barely addresses core shopper questions. Add sections covering price, shipping (options + cost), returns/refunds, availability, and payment methods — as visible text, not just in schema. Link to a dedicated FAQ, Shipping, and Returns page.
Knowledge Graph ReadinessFailed
Why it matters: Without Knowledge Graph signals, AI treats your brand as unverified. You won't get a Google Knowledge Panel, and AI assistants can't confidently attribute information to your brand.
How to fix: Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.
Image Alt Text Quality for AIFailed
Only 0% quality alt text — 0 missing, 2 poor
Why it matters: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.
How to fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
Content-to-Boilerplate RatioFailed
Only 20% in main content — mostly boilerplate
Why it matters: Token density measures useful content vs noise. Pages with under 30% content ratio are hard for AI to parse — it can't find your content in the boilerplate.
How to fix: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
Product Schema CompletenessWarning
71% complete — missing: brand, aggregateRating, itemCondition, gtin/mpn
Why it matters: Incomplete Product schema means AI shows partial product info. Google Shopping and AI assistants skip products missing price, availability, or images — your competitors with complete schemas win.
How to fix: Add missing Product schema fields: brand, aggregateRating, itemCondition, gtin/mpn. Each field improves how AI presents your products. Especially add aggregateRating, since products with ratings show more prominently in AI shopping results.
FAQ Schema (Direct AI Answers)Warning
Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Breadcrumb SchemaWarning
Why it matters: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.
How to fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
Site Search Schema (SearchAction)Warning
Why it matters: SearchAction enables Google's sitelinks search box and allows AI shopping assistants to search your catalog directly. It's how AI agents find specific products in your store.
How to fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
Answer-First Content FormatWarning
Content doesn't start with a strong summary paragraph
Why it matters: AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often.
How to fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
Author Expertise Signals (E-E-A-T)Warning
Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.
How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Product Feed (AI Commerce)Warning
Why it matters: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.
How to fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
Heureka XML FeedWarning
Why it matters: Heureka.sk and Heureka.cz are the dominant price comparison engines on the SK/CZ market. Without an XML feed you're not visible on the main marketplace. No generic audit tool checks this.
How to fix: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).
Extractable Answer BlocksWarning
3 paragraphs, avg 6 words — too short for citation
Why it matters: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.
How to fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
Statistics & Data PresenceWarning
No statistical data found in content
Why it matters: Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics.
How to fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
Section Length OptimizationWarning
Avg section: 101 words — only 0% in 80-200 word optimal range
Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsWarning
Why it matters: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.
How to fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
Return Policy SchemaWarning
Why it matters: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.
How to fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
Shipping Details SchemaWarning
Why it matters: Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver.
How to fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
Expert Quotations & CitationsWarning
Why it matters: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.
How to fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
WebMCP Agentic ReadinessWarning
Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
Trust WidgetWarning
No trust widget (Heureka / Trustpilot / AggregateRating) detected
Why it matters: SK/CZ buyers trust Heureka Ověřeno more than other trust signals. LLMs (ChatGPT, Perplexity) and Google SGE cite shops with AggregateRating schema first.
How to fix: For SK/CZ shops: install the Heureka Ověřeno zákazníky widget (free for verified sellers — https://sluzby.heureka.sk). Alternatives: Trustpilot, Google Reviews with AggregateRating schema. Place the trust widget on product + category + footer.
AI Bot Access PolicyPassed
No AI bot restrictions (allowed by default)
Content Accessibility for AIPassed
665 words in raw HTML (2.2% text ratio) — readable by AI crawlers without executing JS
Content Depth for AIPassed
665 words — rich content for AI analysis and citation
Semantic HTML StructurePassed
4/6 semantic elements: <article>, <header>, <footer>, <aside>
Structured Content (Lists & Tables)Passed
10 lists + 10 tables — AI-friendly structured content
Internal Link DensityPassed
29 contextual internal links per 1,000 words — strong knowledge graph signal
Canonical Tag for AI DeduplicationPassed
Self-referencing canonical — clean signal for AI
Content Readability for AIPassed
Flesch-Kincaid Grade 8 — appropriate for technical/B2B audience
llms.txt (AI Site Descriptor)Info
Not present — not required for AI visibility
Why it matters: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.
How to fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
Variant Modelling (ProductGroup)Info
Variant selectors visible on the page — check whether variants are modelled as a ProductGroup
Why it matters: ProductGroup keeps ratings and pricing consolidated on one product entity, which is how AI shopping surfaces compare products.
How to fix: If this product has real variants (size, colour), express them as ProductGroup + hasVariant + variesBy rather than one flat Product.
Reviews & Ratings SchemaInfo
No review schema on this homepage — review/rating schema typically lives on product pages
Why it matters: Review schema is product-page-specific, so its absence here is expected, not a defect.
How to fix: Scan a product URL to audit review schema. On product pages add AggregateRating (ratingValue, reviewCount, bestRating) and individual Review schemas.
AI Plugin ManifestInfo
Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
Why it matters: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.
GTIN/EAN CoverageInfo
No product feed was sampled — GTIN/EAN coverage could not be verified
Why it matters: GTIN is how an AI shopping agent matches your product to the same product in other shops. Without a feed we cannot measure it — this is not a finding against you.
How to fix: Publish a Google Merchant or Heureka product feed with GTIN/EAN populated, then re-scan to measure coverage.
Speakable Content (Voice AI)Info
Not present — optional; SpeakableSpecification has limited assistant adoption
Delivery PromiseInfo
No delivery timing was found in the text of the sampled product page
Why it matters: Customers decide at the product page. Timing that only lives in a terms page is not part of that decision. Note: this reads page text, so unusual phrasing can be missed — verify before acting.
How to fix: Show expected delivery on the product page itself, not only in the shipping-terms page: a weekday or date plus the order cut-off time.
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Agent-Commerce ReadinessInfo
54/100 — čiastočne pripravené (Prístup 100 · Porozumenie 17 · Objaviteľnosť 50 · Transakcia 50)
Why it matters: Či dokáže autonómny nákupný AI agent (ChatGPT operator, Perplexity, budúce agentické asistenty) na vašom obchode: prísť dnu, prečítať a porozumieť produktom, objaviť celý katalóg a konať (kôš, podmienky). Toto meria málokto — a pre SK/CZ shopy nikto. Skóre spája AI-bot prístup, Product schema, produktové feedy (Merchant/Heureka/Zboží), WebMCP a nákupné podmienky do jedného agent-first pohľadu. Nadväzuje na pripravovaný verejný MCP konektor ("naskenuj tento obchod").
Agent: Prístup — dostane sa agent dnuInfo
100/100 (2 signály/-ov)
Agent: Porozumenie — rozumie produktomInfo
17/100 (3 signály/-ov)
Agent: Objaviteľnosť — nájde celý katalógInfo
50/100 (3 signály/-ov)
Agent: Transakcia — vie konať (kôš/podmienky)Info
50/100 (3 signály/-ov)
Category 5 / 7 · kelo.sk · Zulien Score

Legal & Compliance

60/100
Weight: 10% · 6 OK · 7 warnings · 2 failures · 15 total
Cookie Consent Banner (CMP)Failed
Why it matters: Since 2024, EU regulators actively enforce cookie consent. A non-compliant cookie banner is one of the most frequently fined GDPR offences.
How to fix: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
GDPR Art. 6(1)(a) · GDPR Art. 7 · SK 18/2018 § 14
Consumer Dispute Resolution LinksFailed
No EU ODR platform or supervisory-authority link found
Why it matters: EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach.
How to fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
Nariadenie (EÚ) 524/2013 (ODR) · Smernica 2013/11/EÚ (ADR) · SK zák. 391/2015 Z.z. · CZ zák. 634/1992 Sb. § 14
Terms & Conditions PageWarning
Why it matters: EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights.
How to fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
Data Encryption (No Mixed Content)Warning
Why it matters: Mixed content means some data is transmitted unencrypted. This violates GDPR's data security requirements and triggers browser 'Not Secure' warnings that hurt conversions.
How to fix: Replace all http:// resource URLs with https://. Check images, scripts, stylesheets, and iframes. GDPR Article 32 requires 'appropriate technical measures' including encryption.
Right to Erasure (Data Deletion)Warning
Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Withdrawal of Consent MechanismWarning
Why it matters: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.
How to fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
Withdrawal & Complaints PolicyWarning
Missing: right of withdrawal (odstúpenie od zmluvy)
Why it matters: The Consumer Rights Directive (2011/83/EU) and SK zák. 108/2024 / CZ zák. 89/2012 require pre-contractual disclosure of the 14-day withdrawal right and an accessible complaints procedure. Missing them extends customers' cancellation rights and is a standard ŠOI/ČOI finding.
How to fix: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.
Online Withdrawal FunctionWarning
No online withdrawal function or withdrawal information detected
Why it matters: Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually.
How to fix: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.
GPSR Manufacturer InfoWarning
No manufacturer/importer identification found on the sampled product page
Why it matters: GPSR (Regulation (EU) 2023/988) has been enforceable since 13 December 2024 and requires the responsible economic operator to be identifiable on the offer. IMPORTANT: this is a text heuristic over ONE sampled product page — it is an orientation signal, not a legal assessment. Verify against your own catalogue before acting.
How to fix: On every product page state the manufacturer's name, postal address and an electronic contact (email or web form). For goods made outside the EU, also name the EU importer. Structured `manufacturer` in Product schema satisfies this cleanly and is machine-readable.
Tracking Scripts & ConsentPassed
No tracking scripts detected
Privacy Policy PagePassed
https://kelo.sk/zasady-osobnych-udajov-a-cookies
Cookie PolicyPassed
Separate cookie policy detected
Legal Contact / Imprint PagePassed
https://kelo.sk/o-nas
Third-party Data SharingPassed
1 third-party domain(s)
Data Protection Officer ContactPassed
DPO / data protection contact found
Category 6 / 7 · kelo.sk · Zulien Score

Vulnerability

70/100
Weight: 10% · 8 OK · 5 warnings · 3 failures · 17 total
CMS Version DisclosureFailed
"WordPress 7.0.2" exposed in meta generator
Why it matters: Knowing your exact CMS version lets attackers search CVE databases instantly. E.g., PrestaShop 1.7.8.x is associated with known SQL injection CVEs. Hiding the version forces attackers to guess.
How to fix: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.
Form CSRF ProtectionFailed
4 form(s) without CSRF tokens
Why it matters: CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.
How to fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
Suspicious Inline Script PatternsFailed
Detected: Dynamic script injection
Why it matters: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites.
How to fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
CMS Information FilesWarning
readme.html accessible — reveals version details
Why it matters: Even if you hide the generator tag, readme.html and CHANGELOG.txt reveal exact version numbers. Attackers check these as a fallback.
How to fix: Delete or block access to readme.html. These files reveal your exact CMS version and update history.
Open Redirect DetectionWarning
URL redirect parameter found in page links
Why it matters: Open redirects are used in phishing attacks — attackers craft URLs that appear to be your domain but redirect to a malicious site. This abuses your domain's trust.
How to fix: Validate all redirect URLs server-side against a whitelist. Never allow user-controlled redirect targets without validation.
WordPress User EnumerationWarning
/wp-json/wp/v2/users exposes user accounts
Why it matters: Exposed usernames are the first step in brute force attacks. Attackers get valid usernames, then target them with password attacks. Combined with xmlrpc.php, this is a common WordPress attack chain.
How to fix: Restrict the REST API users endpoint. Add to functions.php: add_filter('rest_endpoints', function($endpoints) { unset($endpoints['/wp/v2/users']); return $endpoints; }); Or use a security plugin.
Cross-Origin IsolationWarning
Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
Mixed Content ResourcesWarning
1 HTTP resource(s) on HTTPS page
Why it matters: Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site.
How to fix: Replace HTTP URLs with HTTPS: http://gmpg.org/xfn/11
Sensitive Files ExposedPassed
.env, .git, composer.json — all properly blocked
Install Script ExposedPassed
No /install/ or /setup/ paths accessible
Directory ListingPassed
Disabled — file structure hidden
Admin Panel at Default URLPassed
Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
Debug Mode / Error ExposurePassed
No debug indicators found in page output
SPF Record (Email Security)Passed
SPF configured: v=spf1 a mx include:_spf.m1.websupport.sk -all
DMARC Policy (Email Auth)Passed
DMARC enforced: p=quarantine
DKIM Signing (Email Auth)Passed
DKIM configured (selectors: selector1, selector2, mail)
BIMI Brand IndicatorsInfo
Why it matters: BIMI requires a VMC (Verified Mark Certificate) but adds your brand logo to recipient inboxes as a trust signal. Optional but high-impact for brand-focused shops.
How to fix: Once DMARC is set to p=quarantine or p=reject with 100% enforcement, publish a BIMI record: v=BIMI1; l=https://yourdomain.com/logo.svg — adds your brand logo to recipient inboxes in Gmail and Yahoo.
Category 7 / 7 · kelo.sk · Zulien Score

Next steps

  1. Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
  2. Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
  3. Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
  4. Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/kelo.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk