# metronet.sk — Zulien Score 70/100 (Grade B)

> Free e-commerce audit: 70/100 overall score. Platform: WordPress. Company: Metronet, s.r.o.. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://metronet.sk
- **Platform:** WordPress
- **Company:** Metronet, s.r.o.
- **Scan date:** 2026-06-23
- **Full report:** https://score.zulien.sk/en/r/metronet.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/metronet.sk

## Score by category

| Category | Score |
|---|---|
| Performance | 70/100 |
| SEO | 78/100 |
| Security | 65/100 |
| Mobile | 61/100 |
| AI Readiness | 63/100 |
| GDPR | 89/100 |
| Vulnerability | 55/100 |

## Detailed findings

### Performance — 70/100

- **[FAIL]** Total Page Weight — 3.6 MB, 140 requests — too heavy!
  - Fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Evidence: PSI-lab
- **[FAIL]** CSS File Count — 91 CSS files — too many!
  - Fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Evidence: HTML-heuristic
- **[WARN]** Largest Contentful Paint (LCP) — 3.73s (good: <2.5s) — Core Web Vital
  - Fix: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.
  - Evidence: PSI-lab
- **[WARN]** Unused Code (CSS + JS) — 180 KB unused (CSS: 45 KB, JS: 135 KB)
  - Fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
  - Evidence: PSI-lab
- **[WARN]** Font Loading Strategy — font-display: auto
  - Fix: Use font-display: swap (shows fallback immediately, swaps when loaded) or font-display: optional (best for performance — may skip custom font on slow connections).
  - Evidence: HTML-heuristic
- **[WARN]** Script Loading Strategy — Only 40% of 52 scripts use async/defer
  - Fix: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
  - Evidence: HTML-heuristic
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 91 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[WARN]** Connection Hint Coverage — 4 external domains without preconnect
  - Fix: Add <link rel='preconnect'> for key third-party domains: cdnjs.cloudflare.com, www.googletagmanager.com, t.contentsquare.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 89ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.76s
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 186ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.077 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 2.86s
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 1 preload, 0 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** Lazy Loading — 49% of images use native lazy loading (102/208)
  - Evidence: HTML-heuristic

### SEO — 78/100

- **[FAIL]** Content Structure (H2 Headings)
  - Fix: Add H2 subheadings to structure your content. Each major section should have a descriptive H2.
  - Evidence: HTML-heuristic
- **[FAIL]** XML Sitemap
  - Fix: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.
  - Evidence: file-probe
- **[WARN]** Meta Description — 116 chars (optimal: 120-160)
  - Fix: Expand your description to at least 120 characters. Include benefits, a CTA, and your target keyword.
  - Evidence: HTML-heuristic
- **[WARN]** H1 Heading — 5 H1 tags (should be exactly 1)
  - Fix: Consolidate to exactly one H1 tag per page. Use H2-H6 for subheadings.
  - Evidence: HTML-heuristic
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — Only 1% next-gen formats — 5 legacy images remain
  - Fix: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use <picture> element for browser fallback.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL Consistency — Canonical points to different URL: https://www.metronet.sk/
  - Fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Evidence: HTML-heuristic
- **[WARN]** Internal Linking — Only 3 internal links
  - Fix: Add more internal links to related content. Target 5+ internal links per page for strong site crawlability.
  - Evidence: HTML-heuristic
- **[WARN]** Empty/Dead Links — 9 dead links (0 empty, 9 hash-only, 0 javascript:void)
  - Fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Evidence: HTML-heuristic
- **[WARN]** Excessive Resource Requests — 52 JS + 91 CSS = 143 external requests
  - Fix: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 6% ratio but 3422 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 58 chars — "Optický internet a TV nielen v Banskej Bystrici \| Metro…"
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Image Format — image/webp
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://www.metronet.sk/
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 1 block(s): WebPage, ReadAction, ImageObject, BreadcrumbList
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 1 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 97% of 208 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth — 3422 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 28 ARIA roles, 36 ARIA labels, lang="sk-SK"
  - Evidence: HTML-heuristic

### Security — 65/100

- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Evidence: HTTP-header
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Technology Disclosure — X-Powered-By: PHP/8.3.31
  - Fix: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Evidence: HTTP-header
- **[WARN]** Subresource Integrity (SRI) — Only 0/2 SRI-eligible third-party scripts have integrity hashes (2 auto-updating provider script(s) excluded — SRI not applicable)
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Evidence: HTML-heuristic
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[WARN]** Iframe Sandboxing — 2/2 unknown iframe(s) without sandbox attribute
  - Fix: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
  - Evidence: DNS
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** HSTS (Strict-Transport-Security) — max-age=63072000, preload, includeSubDomains
  - Evidence: HTTP-header
- **[PASS]** Cookie Security Flags — No cookies set on initial response
  - Evidence: HTTP-header
- **[PASS]** Server Version Disclosure — openresty — version hidden
  - Evidence: HTTP-header

### Mobile — 61/100

- **[FAIL]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h1→h3, h3→h6, h3→h5
  - Fix: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Performance Score — 50/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: HTML-heuristic
- **[WARN]** Font Size Readability
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Inline CSS Size — 59 KB of inline CSS
  - Fix: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
  - Evidence: HTML-heuristic
- **[WARN]** Apple Mobile Web App — Missing: apple-mobile-web-app-capable, status-bar-style
  - Fix: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
  - Evidence: HTML-heuristic
- **[WARN]** Fixed Width Elements — Large fixed-width elements detected — may cause horizontal scroll
  - Fix: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
  - Evidence: HTML-heuristic
- **[WARN]** Form Input Labels (WCAG 3.3.2) — 15/16 inputs má label (94%)
  - Fix: 1 input elementov nemá <label for="id">, aria-label, aria-labelledby alebo title. Placeholder nie je dostatočný (WCAG 3.3.2). Pridaj <label for="email">Email</label><input id="email"> alebo <input aria-label="Email">.
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Images (srcset) — 1 image(s) use srcset for responsive sizing
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Types — Optimized: 1 email, 1 tel
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Evidence: HTML-heuristic

### AI Readiness — 63/100

- **[FAIL]** llms.txt (AI Site Descriptor)
  - Fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
  - Evidence: file-probe
- **[FAIL]** Heading Hierarchy for AI — 5 H1, 0 H2, 18 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 47% quality alt text — 6 missing, 104 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[FAIL]** Content-to-Boilerplate Ratio — Only 2% in main content — mostly boilerplate
  - Fix: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
  - Evidence: HTML-heuristic
- **[WARN]** llms-full.txt (Complete AI Content)
  - Fix: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
  - Evidence: file-probe
- **[WARN]** Organization Schema + Entity Linking — Organization schema found but no sameAs links
  - Fix: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.
  - Evidence: schema
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Structured Content (Lists & Tables) — 11 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Freshness Signals — Schema dates found but no visible date on page
  - Fix: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
  - Evidence: HTML-heuristic
- **[WARN]** Entity Clarity & Brand Signals — OG tags complete but no sameAs entity links
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 224 words — only 0% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Internal Link Density — only 1/1000w (target: 3-5)
  - Fix: Add 3-5 contextual internal links per 1,000 words using descriptive anchor text. Link to related products, categories, and guides. Replace generic anchors ('click here', 'read more') with descriptive text.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.metronet.sk/
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 18 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** ai.txt (AI Permissions)
  - Fix: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
  - Evidence: file-probe
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Social Proof (Testimonials / Case Studies)
  - Fix: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is the #1 credibility lever.
  - Evidence: HTML-heuristic
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 3422 words in raw HTML (5.8% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data Foundation — 1 JSON-LD blocks with 10 schema types: WebPage, ReadAction, ImageObject, BreadcrumbList, ListItem, WebSite
  - Evidence: schema
- **[PASS]** Breadcrumb Schema — BreadcrumbList structured data found — clear navigation hierarchy
  - Evidence: schema
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Evidence: schema
- **[PASS]** Content Depth for AI — 3422 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 53 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Extractable Answer Blocks — 20 paragraphs, avg 36 words — optimal for AI extraction
  - Evidence: HTML-heuristic
- **[PASS]** Statistics & Data Presence — 4 data points found — strong citation magnet
  - Evidence: HTML-heuristic
- **[PASS]** Knowledge Graph Readiness — 3/4 entity signals — strong Knowledge Graph presence
  - Evidence: HTML-heuristic

### GDPR — 89/100

- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[PASS]** Cookie Consent Banner (CMP) — Cookiebot detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — 2 tracker(s) detected with CMP: Google Analytics/GTM, Google Ads
  - Evidence: HTML-heuristic
- **[PASS]** Google Consent Mode v2 — Consent mode signals detected (ad_storage, analytics_storage)
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — https://www.metronet.sk/wp-content/plugins/complianz-gdpr/assets/css/c
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — https://www.metronet.sk/o-nas/
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 4 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic

### Vulnerability — 55/100

- **[FAIL]** CMS Version Disclosure — "Site Kit by Google 1.181.0" exposed in meta generator
  - Fix: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.
  - Evidence: HTML-heuristic
- **[FAIL]** Suspicious Inline Script Patterns — Detected: Dynamic script injection
  - Fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
  - Evidence: file-probe
- **[FAIL]** Payment Page Security — Payment page missing: No CSP, No X-Content-Type-Options, No clickjacking protection
  - Fix: CRITICAL: Your payment page is missing security headers: No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Evidence: file-probe
- **[FAIL]** Clickjacking on Sensitive Page — Login/payment page without X-Frame-Options or CSP frame-ancestors
  - Fix: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
  - Evidence: file-probe
- **[FAIL]** Server Error Leak — PHP/server error messages visible in page output
  - Fix: Set display_errors=Off in php.ini and log_errors=On. Configure a custom error page. Never show stack traces, SQL errors, or file paths to users.
  - Evidence: file-probe
- **[WARN]** CMS Information Files — readme.html accessible — reveals version details
  - Fix: Delete or block access to readme.html. These files reveal your exact CMS version and update history.
  - Evidence: file-probe
- **[WARN]** Form CSRF Protection — 1/2 forms have CSRF tokens
  - Fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** X-Powered-By Header — PHP/8.3.31
  - Fix: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').
  - Evidence: file-probe
- **[WARN]** Source Maps Exposed — JavaScript source maps (.js.map) are publicly accessible
  - Fix: Remove source maps from production or block access via server config. In Vite/Webpack: set sourcemap: false for production builds.
  - Evidence: file-probe
- **[WARN]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
  - Evidence: DNS
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[WARN]** CDN Script Integrity (SRI) — 1 CDN script(s) without Subresource Integrity
  - Fix: Add integrity='sha384-...' crossorigin='anonymous' to CDN scripts from: cdnjs.cloudflare.com. Generate hashes at srihash.org.
  - Evidence: file-probe
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** PHP Version — PHP 8.3.31 — current
  - Evidence: file-probe
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 ip4:95.47.178.165/32 ip4:92.245.31.66 include:amazonses.com include:_spf.
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: google, s1, mail)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/en/r/metronet.sk)
