Average

Score Report

luigisbox.sk

Scanned on October 8, 2026

WordPress
jQuery
Slick Slider
Fancybox
Cloudflare
Last scanned: October 8, 2026
AI verdict

Your site is reasonably optimized but has critical security gaps. Enable HSTS protection in WordPress settings immediately to secure data transmission. Your SEO and GDPR compliance are solid strengths.

Action plan

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

How we rank →

Quick wins

5

High impact, little work. Do these first.

Bigger projects

8

High impact, but the fix needs planning.

+3 more

Small fixes

22

Lower impact, quick to do.

+17 more

Later

24

Lower impact and more work. Plan them once the rest is done.

+19 more

Performance

Weight: 25% · 14 passed · 4 warnings · 0 failed · 2 SPA (verify manually)

What we found: 4.81s (good: <3.4s)

Why it matters: Speed Index captures the overall visual loading experience. A slow Speed Index means users watch content load piece by piece instead of seeing a complete page.

How to fix: Speed Index measures visual completeness over time. Improve it by: prioritizing above-fold content, preloading critical resources, and minimizing render-blocking assets.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: 51 KB unused (CSS: 18 KB, JS: 33 KB)

Why it matters: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
Evidence:PSI-lab· Confidence: low

Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: Custom fonts detected without preload hints

Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

4 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Full e-commerce audit — 50+ checks across 7 categories
78/100
Grade C
luigisbox.sk
Audit date: October 8, 2026
Platform: WordPress
Online report: https://score.zulien.sk/r/luigisbox.sk
Generated · score.zulien.sk · by Zulien

Executive summary

11
Failures
48
Warnings
82
OK
151
Checks total

Scores by category

CategoryScoreWeightFailuresWarningsOK
Performance91/10025%0414
SEO88/10020%0620
Security55/10015%385
Mobile85/10010%158
AI Readiness80/10010%11218
Legal & Compliance81/10010%057
Vulnerability57/10010%565
Accessibility / EAA66/10010%125

Critical findings

HSTS (Strict-Transport-Security)· Security
Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Content-Security-Policy (CSP)· Security
CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
Clickjacking Protection· Security
Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
Form Input Labels (WCAG 3.3.2)· Mobile
The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures.
Image Alt Text Quality for AI· AI Readiness
Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.
Form CSRF Protection· Vulnerability
CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.
Suspicious Inline Script Patterns· Vulnerability
These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites.
SPF Record (Email Security)· Vulnerability
Without SPF, anyone can send emails that appear to come from your domain. Since 2024, Google and Yahoo reject email from domains without SPF. Your transactional emails may land in spam.
DMARC Policy (Email Auth)· Vulnerability
Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.
Payment Page Security· Vulnerability
Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.
Form Labels· Accessibility / EAA
Unlabelled fields leave screen-reader users guessing — search, newsletter and checkout forms become unusable. EN 301 549 § 9.1.3.1 / 9.4.1.2 (WCAG 1.3.1 / 4.1.2).

Action plan by impact and effort

Every problem found, sorted by how much fixing it helps and how much work the fix takes. Start with the quick wins.

Quick wins (5)

High impact, little work. Do these first.

FindingCategoryEffort
HSTS (Strict-Transport-Security)Securityquick fix
Clickjacking ProtectionSecurityquick fix
Directory listingVulnerabilityquick fix
SPF Record (Email Security)Vulnerabilityquick fix
DMARC Policy (Email Auth)Vulnerabilityquick fix

Bigger projects (8)

High impact, but the fix needs planning.

FindingCategoryEffort
Content-Security-Policy (CSP)Securityabout a day
Form Input Labels (WCAG 3.3.2)Mobileabout a day
Image Alt Text Quality for AIAI Readinessabout a day
Form CSRF ProtectionVulnerabilityabout a day
Mixed Content ResourcesVulnerabilityabout a day
Payment Page SecurityVulnerabilityabout a day
Form LabelsAccessibility / EAAabout a day
Suspicious Inline Script PatternsVulnerabilityproject

Small fixes (22)

Lower impact, quick to do.

FindingCategoryEffort
Meta TitleSEOquick fix
XML SitemapSEOquick fix
Canonical URL ConsistencySEOquick fix
Empty/Dead LinksSEOquick fix
Sitemap Host ConsistencySEOquick fix
DNSSECSecurityquick fix
CAA DNS RecordSecurityquick fix
X-Content-Type-OptionsSecurityquick fix
Referrer-PolicySecurityquick fix
Permissions-PolicySecurityquick fix
Subresource Integrity (SRI)Securityquick fix
security.txt (RFC 9116)Securityquick fix

+10 more

Later (24)

Lower impact and more work. Plan them once the rest is done.

FindingCategoryEffort
Image Format OptimizationSEOabout a day
Touch Target SizeMobileabout a day
Font Size ReadabilityMobileabout a day
Inline CSS SizeMobileabout a day
Link Text Quality (WCAG 2.4.4)Mobileabout a day
FAQ Schema (Direct AI Answers)AI Readinessabout a day
Cookie PolicyLegal & Complianceabout a day
Terms & Conditions PageLegal & Complianceabout a day
International Data TransfersLegal & Complianceabout a day
Right to Erasure (Data Deletion)Legal & Complianceabout a day
Newsletter ConsentLegal & Complianceabout a day
Inline JavaScript ExposureVulnerabilityabout a day

+12 more

Performance

91/100
Weight: 25% · 14 OK · 4 warnings · 0 failures · 20 total
Speed IndexWarning
4.81s (good: <3.4s)
Why it matters: Speed Index captures the overall visual loading experience. A slow Speed Index means users watch content load piece by piece instead of seeing a complete page.
How to fix: Speed Index measures visual completeness over time. Improve it by: prioritizing above-fold content, preloading critical resources, and minimizing render-blocking assets.
Unused Code (CSS + JS)Warning
51 KB unused (CSS: 18 KB, JS: 33 KB)
Why it matters: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.
How to fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
Resource Hints (Preload/Preconnect)Warning
Why it matters: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.
How to fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
Font PreloadingWarning
Custom fonts detected without preload hints
Why it matters: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.
How to fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
Server Response Time (TTFB)Passed
41ms
First Contentful Paint (FCP)Passed
0.65s
Largest Contentful Paint (LCP)Passed
0.81s — Core Web Vital ✓
Total Blocking Time (TBT)Passed
40ms
Cumulative Layout Shift (CLS)Passed
0.001 — Core Web Vital ✓
Total Page WeightPassed
669 KB (56 requests)
JavaScript BudgetPassed
130 KB — within the 600 KB budget
Why it matters: JavaScript is the most expensive resource on a page: it must be downloaded, parsed and executed before the page responds to input. Staying under 600 KB is what keeps mid-range phones responsive.
Request BudgetPassed
56 requests — within the budget of 80
Why it matters: Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed.
Text Compression (gzip/brotli)Passed
All text resources properly compressed
Lazy LoadingPassed
5% of images use native lazy loading (23/425)
Font Loading StrategyPassed
font-display: swap
Cache-Control StrategyPassed
max-age=86400
HTTP/3 (QUIC) SupportPassed
HTTP/3 enabled via Alt-Svc header
Script Loading StrategyPassed
85% of scripts use async/defer/module (3 async, 14 defer, 0 module)
Third-party ServicesInfo
Not measured — PageSpeed did not return the third-party audit for this URL
Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.
How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Category 1 / 8 · luigisbox.sk · Zulien Score

SEO

88/100
Weight: 20% · 20 OK · 6 warnings · 0 failures · 27 total
Meta TitleWarning
70 chars (optimal: 30-60)
Why it matters: Truncated titles lower click-through rate because the searcher never sees the full message.
How to fix: Shorten your title to under 60 characters. Google truncates longer titles with '…', which cuts off your message.
XML SitemapWarning
Could not be retrieved in time — not verified
Why it matters: We could not confirm either way within the probe budget, so this is not a finding about your sitemap — it is a note that the check did not complete. A slow-to-generate sitemap is worth caching regardless.
How to fix: Check /sitemap.xml yourself. If it is generated on every request, cache it to a static file: a sitemap that takes seconds to build is also slow for Googlebot, which fetches it regularly.
Image Format OptimizationWarning
Only 10% next-gen formats — 2 legacy images remain
Why it matters: WebP/AVIF images are 30-70% smaller than JPEG/PNG at the same quality. This directly improves page speed, LCP, and mobile experience.
How to fix: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.
Canonical URL ConsistencyWarning
Canonical points to different URL: https://www.luigisbox.sk/
Why it matters: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.
How to fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
Empty/Dead LinksWarning
10 dead links (0 empty, 10 hash-only, 0 javascript:void)
Why it matters: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.
How to fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
Sitemap Host ConsistencyWarning
robots.txt Sitemap points to www.luigisbox.com (page is luigisbox.sk)
Why it matters: Google fetches the sitemap from the host declared in robots.txt. A staging domain there either exposes an environment that must not be indexed, or sends every crawl to the wrong host — splitting ranking signals and burning crawl budget.
How to fix: Update the Sitemap: line in robots.txt to your canonical host. A staging/dev hostname (new., staging., dev.) leaks pre-production to Google and feeds crawlers URLs that 404 or duplicate the live site.
Meta DescriptionPassed
137 chars
H1 HeadingPassed
"Pre výnimočné vyhľadávanie a odporúčanie produktov"
Content Structure (H2 Headings)Passed
9 H2 subheadings found
Open Graph TagsPassed
og:title, og:description, og:image, og:type
Open Graph Image FormatPassed
image/webp
Twitter/X CardsPassed
Card type: summary_large_image
Canonical URLPassed
https://www.luigisbox.sk/
Structured Data (JSON-LD)Passed
3 block(s): Place, PostalAddress, Organization, ImageObject
JSON-LD ValidityPassed
3 block(s) parse cleanly
robots.txtPassed
Present, references sitemap
HTML Language AttributePassed
lang="sk-SK"
Hreflang Tags (Multilingual)Passed
10 language(s): en, sk, cs, pl, de
Image Alt AttributesPassed
100% of 425 images have alt text
Meta Robots TagPassed
follow, index, max-snippet:-1, max-video-preview:-1, max-image-preview:large
FaviconPassed
Favicon detected
Semantic HTML StructurePassed
4/6 semantic elements: <nav>, <main>, <header>, <footer>
Content DepthPassed
1801 words — sufficient content
Deep Heading HierarchyPassed
H2: 9, H3: 34 — well-structured content
Internal LinkingPassed
20 internal links — strong site navigation
Accessibility FundamentalsPassed
3/4 a11y signals: 1 ARIA roles, 9 ARIA labels, lang="sk-SK"
Text-to-HTML RatioInfo
2% ratio but 1801 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
Why it matters: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.
How to fix: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.
Category 2 / 8 · luigisbox.sk · Zulien Score

Security

55/100
Weight: 15% · 5 OK · 8 warnings · 3 failures · 16 total
HSTS (Strict-Transport-Security)Failed
Why it matters: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
How to fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
Content-Security-Policy (CSP)Failed
Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
Clickjacking ProtectionFailed
Why it matters: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
How to fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
DNSSECWarning
No DNSKEY records — zone is unsigned
Why it matters: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.
How to fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
CAA DNS RecordWarning
No CAA records — any CA can issue certificates for this domain
Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
X-Content-Type-OptionsWarning
Why it matters: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.
How to fix: Add header: X-Content-Type-Options: nosniff
Referrer-PolicyWarning
Why it matters: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.
How to fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
Permissions-PolicyWarning
Why it matters: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.
How to fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
Subresource Integrity (SRI)Warning
Only 0/2 SRI-eligible third-party scripts have integrity hashes
Why it matters: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.
How to fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
security.txt (RFC 9116)Warning
Why it matters: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.
How to fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
Iframe SandboxingWarning
1/1 unknown iframe(s) without sandbox attribute
Why it matters: Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS.
How to fix: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
SSL/TLS CertificatePassed
Valid HTTPS connection established
HTTP → HTTPS RedirectPassed
HTTP properly redirects to HTTPS
Cookie Security FlagsPassed
1 cookie(s) — all have Secure, HttpOnly, SameSite
Technology DisclosurePassed
Server: cloudflare (no version)
CDN / WAF ProtectionPassed
Cloudflare detected — DDoS protection and edge caching active
Category 3 / 8 · luigisbox.sk · Zulien Score

Mobile

85/100
Weight: 10% · 8 OK · 5 warnings · 1 failures · 14 total
Form Input Labels (WCAG 3.3.2)Failed
Only 0/7 inputs have a label (0%)
Why it matters: The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures.
How to fix: 7 input elements have no label. Every input needs a matching <label for="id">Text</label> or an aria-label. A placeholder is NOT a label (WCAG 3.3.2). On a checkout or registration form this costs conversion and breaches EN 301 549 (EAA 2026).
Touch Target SizeWarning
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityWarning
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
Theme ColorWarning
Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Inline CSS SizeWarning
340 KB of inline CSS
Why it matters: Large inline CSS blocks increase initial HTML download and parsing time — especially painful on mobile with limited CPU and slower connections.
How to fix: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
Link Text Quality (WCAG 2.4.4)Warning
1 links have generic text ("click here", "more", "here"...)
Why it matters: WCAG 2.4.4: the purpose of a link must be clear from its text. Vague links hurt usability, conversion and SEO (Google reads anchor text for relevance).
How to fix: Replace 'Click here' and 'Read more' with descriptive text: 'Read more about GDPR', 'See module pricing'. Screen readers read links out of context, so a bare 'more' carries no meaning.
Viewport ConfigurationPassed
width=device-width, initial-scale=1
Mobile Performance ScorePassed
90/100 — excellent
Content Fits ViewportPassed
No horizontal scrolling needed
Responsive Design TechniquesPassed
Flexbox, CSS Grid, Media queries detected
Mobile Navigation (Semantic)Passed
<nav> element present — proper navigation landmark
Responsive Images (srcset)Passed
48 image(s) use srcset for responsive sizing
Form Input TypesPassed
Optimized: 1 email
Heading Hierarchy (WCAG 1.3.1)Passed
No skipped heading levels
Category 4 / 8 · luigisbox.sk · Zulien Score

AI Readiness

80/100
Weight: 10% · 18 OK · 12 warnings · 1 failures · 35 total
Image Alt Text Quality for AIFailed
Only 24% quality alt text — 1 missing, 207 poor
Why it matters: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.
How to fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
AI Bot Access PolicyWarning
Minor bots blocked: Bytespider, PetalBot
Why it matters: Even minor AI bots contribute to how AI models understand your brand. More AI exposure means more AI citations and product recommendations.
How to fix: You're blocking some AI crawlers (Bytespider, PetalBot). While not critical, these bots feed training data for AI models that may recommend your products.
FAQ Schema (Direct AI Answers)Warning
Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Breadcrumb SchemaWarning
Why it matters: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.
How to fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
Answer-First Content FormatWarning
Content doesn't start with a strong summary paragraph
Why it matters: AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often.
How to fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
Structured Content (Lists & Tables)Warning
33 lists found — consider adding comparison tables
Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.
How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
Content Freshness SignalsWarning
Schema dates found but no visible date on page
Why it matters: AI models weight recency in their citation algorithms. Freshness signals tell AI your content is current and reliable.
How to fix: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
Section Length OptimizationWarning
Avg section: 33 words — only 5% in 80-200 word optimal range
Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsWarning
Why it matters: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.
How to fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
Canonical Tag for AI DeduplicationWarning
Canonical points to different URL: https://www.luigisbox.sk/
Why it matters: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.
How to fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
Content Readability for AIWarning
Grade 19 — too complex for broad AI citation (technical threshold: 14)
Why it matters: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.
How to fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Expert Quotations & CitationsWarning
Why it matters: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.
How to fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
WebMCP Agentic ReadinessWarning
Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
AI agent access (live)Passed
ChatGPT-User and PerplexityBot get the same page as a browser
Content Accessibility for AIPassed
1801 words in raw HTML (2.0% text ratio) — readable by AI crawlers without executing JS
Structured Data FoundationPassed
3 JSON-LD blocks with 9 distinct schema types: Place, BusinessEntity, WebSite, ImageObject, WebPage, Person
Organization Schema + Entity LinkingPassed
Organization found with 4 sameAs links — strong entity identity
Site Search Schema (SearchAction)Passed
WebSite SearchAction configured — AI can search your store
Content Depth for AIPassed
1801 words — rich content for AI analysis and citation
Heading Hierarchy for AIPassed
Proper structure: 1 H1 → 9 H2s → 34 H3s — clear content outline
Semantic HTML StructurePassed
4/6 semantic elements: <nav>, <main>, <header>, <footer>
Entity Clarity & Brand SignalsPassed
OG tags complete + 4 sameAs links: Facebook, X/Twitter, LinkedIn, YouTube
Author Expertise Signals (E-E-A-T)Passed
Article schema with Person/author — strong expertise signal for AI
Reviews & Ratings SchemaPassed
AggregateRating/Review data found — social proof for AI
Extractable Answer BlocksPassed
47 paragraphs, avg 59 words — optimal for AI extraction
Statistics & Data PresencePassed
10 data points found — strong citation magnet
Internal Link DensityPassed
11 contextual internal links per 1,000 words — strong knowledge graph signal
Knowledge Graph ReadinessPassed
3/4 entity signals — strong Knowledge Graph presence
Content-to-Boilerplate RatioPassed
62% of text in <main>/<article> — clean content signal
AggregateRating SchemaPassed
Review aggregate rating schema present
Customer Reviews — AggregatePassed
1 source: AggregateRating schema — ★ 4.8 · 435 reviews
Why it matters: Multi-source reviews with published counts compound trust: AI assistants (ChatGPT/Perplexity) and Google SGE cite shops with verifiable AggregateRating schema first; SK/CZ buyers cross-check Heureka against Trustpilot before purchase.
llms.txt (AI Site Descriptor)Info
Valid llms.txt with 4000 chars — proper format with H1, links, summary
Why it matters: No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
Speakable Content (Voice AI)Info
Not present — optional; SpeakableSpecification has limited assistant adoption
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Category 5 / 8 · luigisbox.sk · Zulien Score

Legal & Compliance

81/100
Weight: 10% · 7 OK · 5 warnings · 0 failures · 14 total
Cookie PolicyWarning
Why it matters: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
How to fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
Terms & Conditions PageWarning
Why it matters: EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights.
How to fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
International Data TransfersWarning
2 US-based tracker(s) without consent: Google Analytics/GTM, Microsoft Clarity
Why it matters: The EU-US Data Privacy Framework covers some transfers, but loading US trackers without consent remains a violation. Austrian and French DPAs have ruled Google Analytics non-compliant without proper safeguards.
How to fix: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
Right to Erasure (Data Deletion)Warning
Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Newsletter ConsentWarning
Newsletter signup found without visible consent checkbox
Why it matters: GDPR requires 'freely given, specific, informed' consent for marketing emails. A newsletter form without explicit opt-in violates Article 7, and pre-checked boxes are not valid consent.
How to fix: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.
Google Consent Mode v2Passed
Consent mode signals detected (ad_storage, analytics_storage)
Privacy Policy PagePassed
https://www.luigisbox.sk/zasady-ochrany-osobnych-udajov/
Legal Contact / Imprint PagePassed
https://www.luigisbox.sk/o-nas/
Data Encryption (No Mixed Content)Passed
All resources loaded over HTTPS
Third-party Data SharingPassed
2 third-party domain(s)
Data Protection Officer ContactPassed
DPO / data protection contact found
Withdrawal of Consent MechanismPassed
Consent withdrawal / opt-out mechanism found
Cookie Consent Banner (CMP)Info
No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)
Why it matters: EU regulators enforce cookie consent (CNIL fined Google €150M). If the CMP is GTM-injected this scan can't confirm it — verify manually.
How to fix: Confirm a consent management platform actually loads and blocks non-essential cookies until opt-in. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Tracking Scripts & ConsentInfo
2 tracker(s) detected (Google Analytics/GTM, Microsoft Clarity); no CMP visible in server HTML but GTM is present
Why it matters: Loading tracking before consent is a direct GDPR/ePrivacy violation, but GTM-managed consent gating isn't visible server-side — verify in the browser.
How to fix: Confirm these trackers are gated behind consent (GTM consent mode / CMP script blocking) before they fire. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Category 6 / 8 · luigisbox.sk · Zulien Score

Vulnerability

57/100
Weight: 10% · 5 OK · 6 warnings · 5 failures · 16 total
Form CSRF ProtectionFailed
2 form(s) without CSRF tokens
Why it matters: CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.
How to fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
Suspicious Inline Script PatternsFailed
Detected: new Function() with decoding
Why it matters: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites.
How to fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
SPF Record (Email Security)Failed
Why it matters: Without SPF, anyone can send emails that appear to come from your domain. Since 2024, Google and Yahoo reject email from domains without SPF. Your transactional emails may land in spam.
How to fix: Add an SPF TXT record to your DNS: v=spf1 include:_spf.google.com ~all (adjust for your email provider). This tells receiving servers which IPs can send email for your domain.
DMARC Policy (Email Auth)Failed
Why it matters: Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.
How to fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
Payment Page SecurityFailed
Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection
Why it matters: Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.
How to fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
Directory listingWarning
Could not verify — /wp-includes/, /wp-content/uploads/ did not answer
Why it matters: These paths exist on every WordPress install. No answer within our time limit is not proof that listing is off, so this is not reported as a pass.
How to fix: Open the listed paths in a browser: an 'Index of /…' page means listing is on — disable it with 'Options -Indexes' (Apache) or 'autoindex off;' (Nginx). A 403 or 404 is fine.
CORS ConfigurationWarning
Access-Control-Allow-Origin: * (allows any domain)
Why it matters: A wildcard CORS policy allows any website to make requests to your API/pages. Combined with Access-Control-Allow-Credentials, this enables cross-origin data theft.
How to fix: Replace the wildcard CORS header with specific allowed origins. Avoid Access-Control-Allow-Origin: * on pages with authentication or sensitive data.
Inline JavaScript ExposureWarning
57 KB of inline JavaScript
Why it matters: Large amounts of inline JavaScript prevent proper CSP implementation and increase the risk of XSS. External scripts can be protected with SRI hashes.
How to fix: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
DKIM Signing (Email Auth)Warning
Why it matters: DKIM cryptographically signs outgoing email to prove it comes from your domain. Without DKIM, email providers downgrade trust score — transactional emails land in spam. Gmail and Yahoo require DKIM since 2024 for bulk senders.
How to fix: Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.
Cross-Origin IsolationWarning
Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
Mixed Content ResourcesWarning
1 HTTP resource(s) on HTTPS page
Why it matters: Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site.
How to fix: Replace HTTP URLs with HTTPS: http://app.luigisbox.com
CMS Version DisclosurePassed
No generator tag — CMS identity hidden
Sensitive Files ExposedPassed
.env, .git, composer.json — all properly blocked
Install Script ExposedPassed
No /install/ or /setup/ paths accessible
Admin Panel at Default URLPassed
Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
Debug Mode / Error ExposurePassed
No debug indicators found in page output
Category 7 / 8 · luigisbox.sk · Zulien Score

Accessibility / EAA

66/100
Weight: 10% · 5 OK · 2 warnings · 1 failures · 9 total
Form LabelsFailed
7 of 7 form inputs have no associated label
Why it matters: Unlabelled fields leave screen-reader users guessing — search, newsletter and checkout forms become unusable. EN 301 549 § 9.1.3.1 / 9.4.1.2 (WCAG 1.3.1 / 4.1.2).
How to fix: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.
SK § 4 zák. 351/2022 · CZ § 4 zák. 424/2023
Image Alt TextWarning
1 of 425 images missing alt text
Why it matters: Every image missing alt text is content a screen-reader user cannot access (WCAG 1.1.1 / EN 301 549 § 9.1.1.1).
How to fix: Add alt text to the remaining images (alt="" for decorative ones).
Skip LinkWarning
No skip-to-content link detected
Why it matters: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).
How to fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
Page LanguagePassed
<html lang="sk-SK"> is set
Heading StructurePassed
Single <h1> with a consistent heading outline
Link TextPassed
Links use descriptive text
Landmark RegionsPassed
Semantic landmarks present (<main>, <nav>/<header>)
Zoom & ScalingPassed
Pinch-zoom is not disabled
EAA Legal BasisInfo
In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
Category 8 / 8 · luigisbox.sk · Zulien Score

Next steps

  1. Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
  2. Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
  3. Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
  4. Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/luigisbox.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk