# martinus.sk — Zulien Score 55/100 (Grade C)

> Free e-commerce audit: 55/100 overall score. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://martinus.sk
- **Scan date:** 2026-07-29
- **Full report:** https://score.zulien.sk/en/r/martinus.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/martinus.sk

## Audit summary

Your site has potential but needs work on search visibility and customer data protection. Start by adding meta descriptions and H2 headings to all pages immediately. Good news: your security is excellent.

## Score by category

| Category | Score |
|---|---|
| SEO | 51/100 |
| Security | 48/100 |
| AI Readiness | 43/100 |
| GDPR | 42/100 |
| Vulnerability | 97/100 |
| Accessibility | 58/100 |

## Detailed findings

### Performance

- **[PENDING]** Performance — Measuring — Google PageSpeed running in background…

### SEO — 51/100

- **[FAIL]** Meta Description
  - Fix: Write a compelling meta description (120-160 chars) with a call-to-action. Include your target keyword naturally.
  - Evidence: HTML-heuristic
- **[FAIL]** Content Structure (H2 Headings)
  - Fix: Add H2 subheadings to structure your content. Each major section should have a descriptive H2.
  - Evidence: HTML-heuristic
- **[FAIL]** Open Graph Tags
  - Fix: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
  - Evidence: HTML-heuristic
- **[FAIL]** Structured Data (JSON-LD)
  - Fix: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
  - Evidence: schema
- **[FAIL]** Image Alt Attributes — Only 0% of 2 images have alt text
  - Fix: 2 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.
  - Evidence: HTML-heuristic
- **[FAIL]** Internal Linking — No internal links found
  - Fix: Add internal links to other pages on your site. Every page should link to related content, categories, and key landing pages.
  - Evidence: HTML-heuristic
- **[FAIL]** Robots Noindex Warning — meta robots="noindex,nofollow" — page excluded from search!
  - Fix: Your page has 'noindex' which blocks it from Google entirely. Remove 'noindex' unless this page is intentionally hidden (staging, duplicates).
  - Evidence: HTML-heuristic
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL
  - Fix: Add a <link rel='canonical'> tag pointing to the preferred URL. For a single-page site this is a one-line addition in <head>.
  - Evidence: HTML-heuristic
- **[WARN]** Meta Robots Tag — "noindex,nofollow" — page is set to noindex (hidden from search)
  - Fix: If this is your live public page, remove 'noindex' from the meta robots tag immediately — it removes the page from Google. If this is intentional (staging, thank-you, or filtered page), you can ignore this.
  - Evidence: HTML-heuristic
- **[WARN]** Favicon
  - Fix: Add a favicon: <link rel='icon' href='/favicon.ico'>. Include multiple sizes for different devices (16x16, 32x32, 180x180).
  - Evidence: file-probe
- **[WARN]** Title/H1 Differentiation — Title and H1 are identical
  - Fix: Make your title tag and H1 heading different but complementary. The title should include your brand and be click-optimized for SERP. The H1 should be content-focused for on-page experience.
  - Evidence: HTML-heuristic
- **[WARN]** Semantic HTML Structure — Only 2/6 semantic elements — missing: <article>, <nav>, <header>, <aside>
  - Fix: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
  - Evidence: HTML-heuristic
- **[WARN]** Content Depth — Only 214 words — thin content
  - Fix: Add more unique, valuable content. Product pages should have 150+ word descriptions. Category pages benefit from 200+ word introductions. Blog posts need 800+ words to rank.
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 33 chars — "Making sure you&#39;re not a bot!"
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "Making sure you&#39;re not a bot!"
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with ~345+ URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="en"
  - Evidence: HTML-heuristic
- **[PASS]** Text-to-HTML Ratio — 31% (214 words)
  - Evidence: HTML-heuristic
- **[PASS]** Image Format Optimization — 100% next-gen formats (2 WebP, 0 AVIF)
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 1 ARIA roles, 1 ARIA labels, lang="en"
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 0 day(s) ago
  - Evidence: HTML-heuristic

### Security — 48/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Evidence: HTTP-header
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** HTTP → HTTPS Redirect
  - Fix: Configure a 301 redirect from http:// to https:// for all pages. In Apache: RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
  - Evidence: HTTP-header
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Cookie Security Flags — 2 cookie(s): 2 missing HttpOnly
  - Fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Evidence: HTTP-header
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** Technology Disclosure — Server: nginx (no version)
  - Evidence: HTTP-header
- **[PASS]** Subresource Integrity (SRI) — No SRI-eligible third-party scripts loaded
  - Evidence: HTML-heuristic
- **[PASS]** security.txt (RFC 9116) — Present at /.well-known/security.txt
  - Evidence: file-probe
- **[PASS]** Server Version Disclosure — Nginx — version hidden
  - Evidence: HTTP-header

### Mobile

- **[PENDING]** Mobile — Measuring — Google PageSpeed running in background…

### AI Readiness — 43/100

- **[FAIL]** Structured Data Foundation
  - Fix: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
  - Evidence: schema
- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Heading Hierarchy for AI — 1 H1, 0 H2, 0 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Entity Clarity & Brand Signals
  - Fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Evidence: HTML-heuristic
- **[FAIL]** Common Question Coverage — Answers only 0/5 key shopper questions
  - Fix: Your page barely addresses core shopper questions. Add sections covering price, shipping (options + cost), returns/refunds, availability, and payment methods — as visible text, not just in schema. Link to a dedicated FAQ, Shipping, and Returns page.
  - Evidence: HTML-heuristic
- **[FAIL]** Internal Link Density — Almost no internal links in content
  - Fix: Add contextual internal links throughout your content: link to related products, categories, guides, and FAQs. Use descriptive anchor text (not 'click here'). Target 3-5 links per 1,000 words.
  - Evidence: HTML-heuristic
- **[FAIL]** Canonical Tag for AI Deduplication
  - Fix: Add <link rel='canonical' href='https://your-absolute-url'> to every page. This tells AI engines which URL is the authoritative version of this content.
  - Evidence: HTML-heuristic
- **[FAIL]** Knowledge Graph Readiness
  - Fix: Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 0% quality alt text — 2 missing, 0 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Content Depth for AI — 214 words — add more for better AI citations
  - Fix: Expand to 500+ words: add detailed product descriptions, use cases, benefits, specifications, comparison info, and buying guides. AI needs substantial content to summarize and cite.
  - Evidence: HTML-heuristic
- **[WARN]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
  - Evidence: HTML-heuristic
- **[WARN]** Semantic HTML Structure — 2/6 elements — missing: <article>, <nav>, <header>, <aside>
  - Fix: Add: <article>, <nav>, <header>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — No structured content elements found
  - Fix: Add bulleted lists for features/benefits, numbered lists for steps/rankings, and tables for comparisons/specifications. These are the content formats AI extracts most reliably.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[INFO]** Social Proof (Testimonials / Case Studies) — None detected. For a non-commercial/informational site, testimonials and case studies are optional
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** Agent-Commerce Readiness — 50/100 — čiastočne pripravené (Prístup 100 · Porozumenie 0 · Transakcia 50)
- **[INFO]** Agent: Prístup — dostane sa agent dnu — 100/100 (2 signály/-ov)
- **[INFO]** Agent: Porozumenie — rozumie produktom — 0/100 (2 signály/-ov)
- **[INFO]** Agent: Transakcia — vie konať (kôš/podmienky) — 50/100 (1 signál)
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 214 words in raw HTML (30.7% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Extractable Answer Blocks — 6 paragraphs, avg 34 words — optimal for AI extraction
  - Evidence: HTML-heuristic
- **[PASS]** Content Readability for AI — Flesch-Kincaid Grade 12 — appropriate for technical/B2B audience
  - Evidence: HTML-heuristic
- **[PASS]** Content-to-Boilerplate Ratio — 98% of text in <main>/<article> — clean content signal
  - Evidence: HTML-heuristic

### GDPR — 42/100

- **[FAIL]** Cookie Consent Banner (CMP)
  - Fix: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
  - Evidence: HTML-heuristic
- **[FAIL]** Privacy Policy Page
  - Fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Legal Contact / Imprint Page
  - Fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Data Protection Officer Contact
  - Fix: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal of Consent Mechanism
  - Fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Evidence: HTML-heuristic
- **[INFO]** Terms & Conditions Page — No Terms & Conditions link found — for a non-commercial/informational site this is optional (no purchase or paid service to govern)
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Tracking Scripts & Consent — No tracking scripts detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic

### Vulnerability — 97/100

- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[INFO]** BIMI Brand Indicators
  - Evidence: file-probe
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 ip4:185.65.220.2/24 ip4:213.215.115.254/24 ip4:185.59.210.22 ip4:185.59.2
  - Evidence: DNS
- **[PASS]** DMARC Policy (Email Auth) — DMARC enforced: p=quarantine
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: google, k1)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Accessibility — 58/100

- **[FAIL]** Image Alt Text — 2 of 2 images have no alt attribute
  - Fix: Add descriptive alt text to every meaningful image; use alt="" for purely decorative ones so screen readers skip them.
  - Evidence: HTML-heuristic
- **[WARN]** Landmark Regions — Missing <nav>/<header> landmark
  - Fix: Wrap the primary content in <main> and use <nav>, <header>, <footer> for the page regions.
  - Evidence: HTML-heuristic
- **[WARN]** Skip Link — No skip-to-content link detected
  - Fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** Form Labels — No form inputs found on the homepage
  - Evidence: HTML-heuristic
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="en"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Heading Structure — Single <h1> with a consistent heading outline
  - Evidence: HTML-heuristic
- **[PASS]** Zoom & Scaling — Pinch-zoom is not disabled
  - Evidence: HTML-heuristic

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/en/r/martinus.sk)
