Below Average

Score Report

pilulka.sk

Scanned on July 28, 2026

Magento
Vue.js
Nuxt.js
Font Awesome
PhotoSwipe
Vite
Company:Pilulka Lékárny a.s.· NACE 47730
NIS2: out of scope
Risk:30/100medium
Credit:B
Shell address
Full company profile →
Last scanned: July 28, 2026
AI verdict

Your store has solid foundations, but important gaps remain. Prioritize adding Open Graph tags and XML sitemap to improve search visibility. Security and SEO are your strongest areas.

Not subject to NIS2 cybersecurity duties.Based on NACE sector + company size, Article 21 compliance is not mandatory. Security best practices still recommended.
Supplying a NIS2-regulated company?Even outside direct scope you may inherit supply-chain duties — regulated companies cascade them to suppliers by contract (security, incident reporting, encryption). ICT and managed-service providers are in scope regardless of size.
Check supplier obligations Legal basis: NIS2 Art. 21 · CZ 264/2025 §11 · NIS2 Art. 21(2)(d)
Possible IČO mismatch

The IČO in your site footer (03615278) differs from the IČO our autocomplete found for the domain (47235225). Often a copy-pasted template footer or a recent legal entity change — verify the IČO in your footer matches your actual operating entity. Informational only, doesn't affect score.

Action plan

Fix these 3 things first

Sorted by score impact — each fix moves your overall grade up.

+15potential gain

Performance

Weight: 25% · 7 passed · 5 warnings · 5 failed · 1 SPA (verify manually)

What we found: 608ms (good: <200ms)

Why it matters: TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.

How to fix: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: 0.453 (good: <0.1) — Core Web Vital FAILING

Why it matters: CLS >0.25 fails Core Web Vitals. Users experience constant content jumping — extremely frustrating on mobile where accidental clicks lead to unwanted purchases or page changes.

How to fix: Urgent layout stability issues. 1) Add width/height to all <img> and <video>, 2) Reserve space for ads with min-height, 3) Use font-display: swap for web fonts, 4) Don't dynamically inject content above visible area.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: 4.5 MB, 199 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Evidence:PSI-lab· Confidence: high
Get Performance Optimization →

What we found: 419 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 419 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Evidence:PSI-lab· Confidence: low

What we found: 22 CSS files — too many!

Why it matters: Each CSS file blocks rendering. With 22 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

How to fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Evidence:HTML-heuristic· Confidence: high

What we found: 525ms (optimal: <200ms)

Why it matters: TTFB is the foundation — every other metric is delayed by a slow server. A 200ms vs 600ms TTFB means 400ms added to FCP, LCP, and everything else.

How to fix: Optimize server response: enable opcode caching (OPcache), add Redis/Memcached for database caching, use a CDN. Check slow database queries.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: no-cache

Why it matters: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

How to fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Evidence:HTTP-header· Confidence: high
Request quote for speed audit

What we found: 22 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: 4 external domains without preconnect

Why it matters: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

How to fix: Add <link rel='preconnect'> for key third-party domains: sdp-api.lnd.bz, translate.google.com, pilulkask.vshcdn.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Evidence:PSI-lab· Confidence: high

What we found: 770 KB of inline JavaScript

Why it matters: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.

How to fix: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
Evidence:PSI-lab· Confidence: high
Request quote for security audit

10 issues found in Performance. This is hurting your store.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Your store is losing customers every day. The issues above are costing you sales.

Critical score — request an expert audit

Hands-on review by our team: we identify root causes, prioritize fixes, and hand you an action plan. We'll send a tailored quote within 48h.

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách
59/100
Grade D
pilulka.sk
Pilulka Lékárny a.s.
Dátum auditu: July 28, 2026
Platforma: Magento
NACE: 47730
Online report: https://score.zulien.sk/r/pilulka.sk
Vygenerované 29. 7. 2026 11:14:16 · score.zulien.sk · by Zulien

Executive summary

23
Chýb
66
Upozornení
64
OK
173
Spolu kontrol

Skóre po kategóriách

KategóriaSkóreVáhaChybyUpozorneniaOK
Performance45/10025%557
SEO71/10020%3913
Security71/10015%187
Mobile49/10010%286
AI Readiness60/10010%51912
GDPR66/10010%186
Vulnerability58/10010%569
Accessibility59/100—134

Kritické zistenia

Total Blocking Time (TBT)· Performance
TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.
Cumulative Layout Shift (CLS)· Performance
CLS >0.25 fails Core Web Vitals. Users experience constant content jumping — extremely frustrating on mobile where accidental clicks lead to unwanted purchases or page changes.
Total Page Weight· Performance
Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
Unused Code (CSS + JS)· Performance
Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
CSS File Count· Performance
Each CSS file blocks rendering. With 22 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
Open Graph Tags· SEO
Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
XML Sitemap· SEO
Sitemaps help Google discover and index pages faster, especially for large stores with deep category structures.
Product Schema Richness· SEO
Incomplete product schema means no rich results in Google Shopping or search. You're competing with text-only listings against competitors with star ratings and prices in SERPs.
HSTS (Strict-Transport-Security)· Security
Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Mobile Performance Score· Mobile
A mobile score below 50 means your store takes several seconds to become usable on a phone. Slow mobile load drives users away before they see the store.
Form Input Labels (WCAG 3.3.2)· Mobile
EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.
AI Bot Access Policy· AI Readiness
AI search is a fast-growing product-discovery channel. Blocking the major AI crawlers cuts your store out of it entirely.

Performance

45/100
Váha: 25% · 7 OK · 5 upozornení · 5 chýb · spolu 18
Total Blocking Time (TBT)Zlyhalo
608ms (good: <200ms)
Prečo je to dôležité: TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.
Ako opraviť: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.
Cumulative Layout Shift (CLS)Zlyhalo
0.453 (good: <0.1) — Core Web Vital FAILING
Prečo je to dôležité: CLS >0.25 fails Core Web Vitals. Users experience constant content jumping — extremely frustrating on mobile where accidental clicks lead to unwanted purchases or page changes.
Ako opraviť: Urgent layout stability issues. 1) Add width/height to all <img> and <video>, 2) Reserve space for ads with min-height, 3) Use font-display: swap for web fonts, 4) Don't dynamically inject content above visible area.
Total Page WeightZlyhalo
4.5 MB, 199 requests — too heavy!
Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Unused Code (CSS + JS)Zlyhalo
419 KB wasted on unused code!
Prečo je to dôležité: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
Ako opraviť: You're loading 419 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
CSS File CountZlyhalo
22 CSS files — too many!
Prečo je to dôležité: Each CSS file blocks rendering. With 22 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.
Ako opraviť: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
Server Response Time (TTFB)Upozornenie
525ms (optimal: <200ms)
Prečo je to dôležité: TTFB is the foundation — every other metric is delayed by a slow server. A 200ms vs 600ms TTFB means 400ms added to FCP, LCP, and everything else.
Ako opraviť: Optimize server response: enable opcode caching (OPcache), add Redis/Memcached for database caching, use a CDN. Check slow database queries.
Cache-Control StrategyUpozornenie
no-cache
Prečo je to dôležité: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.
Ako opraviť: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
Critical CSS StrategyUpozornenie
22 CSS files without critical CSS extraction
Prečo je to dôležité: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.
Ako opraviť: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Connection Hint CoverageUpozornenie
4 external domains without preconnect
Prečo je to dôležité: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.
Ako opraviť: Add <link rel='preconnect'> for key third-party domains: sdp-api.lnd.bz, translate.google.com, pilulkask.vshcdn.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
Inline JavaScript SizeUpozornenie
770 KB of inline JavaScript
Prečo je to dôležité: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.
Ako opraviť: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
First Contentful Paint (FCP)Prešlo
1.27s
Largest Contentful Paint (LCP)Prešlo
2.31s — Core Web Vital ✓
Speed IndexPrešlo
2.80s
Text Compression (gzip/brotli)Prešlo
All text resources properly compressed
Resource Hints (Preload/Preconnect)Prešlo
6 preload, 4 preconnect hint(s)
Lazy LoadingPrešlo
24% of images use native lazy loading (197/818)
Script Loading StrategyPrešlo
100% of scripts use async/defer/module (3 async, 0 defer, 1 module)
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Kategória 1 / 8 · pilulka.sk · Zulien Score

SEO

71/100
Váha: 20% · 13 OK · 9 upozornení · 3 chýb · spolu 26
Open Graph TagsZlyhalo
Prečo je to dôležité: Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
Ako opraviť: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
XML SitemapZlyhalo
Prečo je to dôležité: Sitemaps help Google discover and index pages faster, especially for large stores with deep category structures.
Ako opraviť: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.
Product Schema RichnessZlyhalo
Missing required fields: description, image
Prečo je to dôležité: Incomplete product schema means no rich results in Google Shopping or search. You're competing with text-only listings against competitors with star ratings and prices in SERPs.
Ako opraviť: Add complete Product schema with at minimum: name, description, image, and offers (with price and availability).
H1 HeadingUpozornenie
2 H1 tags (should be exactly 1)
Prečo je to dôležité: Multiple H1 tags dilute the main topic signal. One H1 per page is the established best practice.
Ako opraviť: Consolidate to exactly one H1 tag per page. Use H2-H6 for subheadings.
Twitter/X CardsUpozornenie
Prečo je to dôležité: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.
Ako opraviť: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
Image Alt AttributesUpozornenie
Only 70% of 818 images have alt text
Prečo je to dôležité: Missing alt text means no visibility in Google Image Search, which is a real traffic source for e-commerce.
Ako opraviť: 246 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
Image Format OptimizationUpozornenie
0% next-gen formats — 2 JPEG, 43 PNG images
Prečo je to dôležité: Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.
Ako opraviť: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
Title/H1 DifferentiationUpozornenie
Title and H1 are identical
Prečo je to dôležité: Identical title and H1 wastes an opportunity to target additional keywords. Different but related title/H1 combinations rank for more keyword variations.
Ako opraviť: Make your title tag and H1 heading different but complementary. The title should include your brand and be click-optimized for SERP. The H1 should be content-focused for on-page experience.
Semantic HTML StructureUpozornenie
Only 3/6 semantic elements — missing: <article>, <nav>, <aside>
Prečo je to dôležité: Semantic HTML gives search engines clear signals about content structure. Pages with proper semantic markup earn more featured snippets and knowledge panel appearances.
Ako opraviť: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
Canonical URL ConsistencyUpozornenie
Canonical points to different URL: https://www.pilulka.sk
Prečo je to dôležité: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.
Ako opraviť: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
Empty/Dead LinksUpozornenie
23 dead links (0 empty, 23 hash-only, 0 javascript:void)
Prečo je to dôležité: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.
Ako opraviť: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
Image Dimension AttributesUpozornenie
Only 5% of images have width/height attributes
Prečo je to dôležité: Missing image dimensions are a leading cause of Cumulative Layout Shift. Google uses CLS as a Core Web Vital ranking factor.
Ako opraviť: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
Meta TitlePrešlo
33 chars — "Pilulka.sk - Zdravie s presnosťou"
Meta DescriptionPrešlo
154 chars
Content Structure (H2 Headings)Prešlo
32 H2 subheadings found
Canonical URLPrešlo
https://www.pilulka.sk
Structured Data (JSON-LD)Prešlo
1 block(s): WebSite, SearchAction, Organization, ContactPoint
JSON-LD ValidityPrešlo
1 block(s) parse cleanly
robots.txtPrešlo
Present
HTML Language AttributePrešlo
lang="sk"
FaviconPrešlo
Favicon detected
Content DepthPrešlo
3825 words — sufficient content
Deep Heading HierarchyPrešlo
H2: 32, H3: 174 — well-structured content
Internal LinkingPrešlo
754 internal links — strong site navigation
Accessibility FundamentalsPrešlo
3/4 a11y signals: 3 ARIA roles, 197 ARIA labels, lang="sk"
Text-to-HTML RatioInfo
2% ratio but 3825 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.
Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.
Kategória 2 / 8 · pilulka.sk · Zulien Score

Security

71/100
Váha: 15% · 7 OK · 8 upozornení · 1 chýb · spolu 16
HSTS (Strict-Transport-Security)Zlyhalo
Prečo je to dôležité: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Ako opraviť: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
DNSSECUpozornenie
No DNSKEY records — zone is unsigned
Prečo je to dôležité: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.
Ako opraviť: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
CAA DNS RecordUpozornenie
No CAA records — any CA can issue certificates for this domain
Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
X-Content-Type-OptionsUpozornenie
Prečo je to dôležité: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.
Ako opraviť: Add header: X-Content-Type-Options: nosniff
Referrer-PolicyUpozornenie
Prečo je to dôležité: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.
Ako opraviť: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
Permissions-PolicyUpozornenie
Prečo je to dôležité: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.
Ako opraviť: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
Cookie Security FlagsUpozornenie
1 cookie(s): 1 missing Secure, 1 missing HttpOnly, 1 missing SameSite
Prečo je to dôležité: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.
Ako opraviť: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
Technology DisclosureUpozornenie
X-Powered-By: Nuxt
Prečo je to dôležité: Exposing exact server/PHP versions lets attackers search CVE databases for specific exploits. This is the first step in most automated attacks.
Ako opraviť: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
Subresource Integrity (SRI)Upozornenie
Only 0/4 SRI-eligible third-party scripts have integrity hashes
Prečo je to dôležité: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach.
Ako opraviť: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
SSL/TLS CertificatePrešlo
Valid HTTPS connection established
HTTP → HTTPS RedirectPrešlo
HTTP properly redirects to HTTPS
Content-Security-Policy (CSP)Prešlo
Present and reasonably configured
Clickjacking ProtectionPrešlo
X-Frame-Options: DENY
security.txt (RFC 9116)Prešlo
Present at /.well-known/security.txt
CDN / WAF ProtectionPrešlo
Cloudflare detected — DDoS protection and edge caching active
Password Field SecurityPrešlo
1 password field(s) — allow password manager autofill
Kategória 3 / 8 · pilulka.sk · Zulien Score

Mobile

49/100
Váha: 10% · 6 OK · 8 upozornení · 2 chýb · spolu 19
Mobile Performance ScoreZlyhalo
34/100 — critically slow
Prečo je to dôležité: A mobile score below 50 means your store takes several seconds to become usable on a phone. Slow mobile load drives users away before they see the store.
Ako opraviť: Your mobile experience is severely degraded. Priority fixes: 1) Reduce JavaScript, 2) Convert all images to WebP with responsive sizing, 3) Enable aggressive caching, 4) Use a CDN.
Form Input Labels (WCAG 3.3.2)Zlyhalo
Iba 2/4 inputs má label (50%)
Prečo je to dôležité: EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.
Ako opraviť: 2 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
Touch Target SizeUpozornenie
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Prečo je to dôležité: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityUpozornenie
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
PWA FeaturesUpozornenie
Has service worker, missing web app manifest
Prečo je to dôležité: PWA-enabled stores let users install the store as an app on their home screen, boosting repeat engagement.
Ako opraviť: Add a web app manifest to enable PWA features. Add <link rel='manifest' href='/manifest.json'> with name, icons, start_url, and display: standalone.
Theme ColorUpozornenie
Prečo je to dôležité: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
Ako opraviť: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Mobile Navigation (Semantic)Upozornenie
Prečo je to dôležité: Semantic <nav> elements are essential for mobile accessibility. Screen readers use them to let users jump directly to navigation — critical on small screens where content is long.
Ako opraviť: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').
Text Overflow HandlingUpozornenie
No word-break/overflow-wrap CSS detected
Prečo je to dôležité: Long strings without word-break cause horizontal overflow on mobile — a common cause of 'content wider than viewport' failures. Compound words and URLs are frequent culprits.
Ako opraviť: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
Print StylesheetUpozornenie
Order/invoice page without print styles
Prečo je to dôležité: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.
Ako opraviť: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
Heading Hierarchy (WCAG 1.3.1)Upozornenie
Preskočené úrovne: h2→h5
Prečo je to dôležité: Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené.
Ako opraviť: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
Viewport ConfigurationPrešlo
width=device-width, initial-scale=1
Content Fits ViewportPrešlo
No horizontal scrolling needed
Responsive Design TechniquesPrešlo
Media queries detected
Responsive Images (srcset)Prešlo
365 image(s) use srcset for responsive sizing
Form Input TypesPrešlo
Optimized: 2 email, 1 search
Link Text Quality (WCAG 2.4.4)Prešlo
Všetky odkazy majú popisný text
Payment Methods DetectedInfo
Žiadna známa platobná brána nedetekovaná na homepage
Prečo je to dôležité: Viditeľné platobné ikony (Apple Pay, Google Pay, Klarna, Tatra Pay) v headeri/footeri zvyšujú conversion. Trust signal pred checkoutom.
Ako opraviť: Payment gateway detection scanuje iba homepage. Ak sú platby na /checkout alebo sú načítané JS-om až po interakcii, neuvidíme ich. Zváž pridať platobné ikony do footer-u.
Express Checkout (Apple Pay + Google Pay)Info
Apple Pay / Google Pay nedetekované na homepage — express checkout sa zvyčajne zobrazí až v košíku/checkoute
Prečo je to dôležité: Mobile conversion pri express checkout je vyšší oproti klasickej karte. V SK/CZ rastúci trend. (Sken vidí iba homepage, takže toto je hint, nie verdikt.)
Ako opraviť: Ak express checkout nemáš, pridaj Apple Pay + Google Pay cez Stripe/Adyen/Mollie. Biometric auth = -1 click checkout = vyšší conversion.
SK/CZ Local Payment MethodsInfo
Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute
Prečo je to dôležité: SK/CZ shop bez bankových tlačidiel a QR platby = masívny cart abandonment. Priemerný SK e-shop má viacero payment metód. (Sken vidí iba homepage — over manuálne v checkoute.)
Ako opraviť: Ak SK/CZ local platby nemáš, integruj GoPay alebo ComGate — obe podporujú Tatra Pay, VÚB Pay, ČSOB Pay, Raiffeisen, QR platba v jednom API. Alternatívne Barion pre CZ trh.
Kategória 4 / 8 · pilulka.sk · Zulien Score

AI Readiness

60/100
Váha: 10% · 12 OK · 19 upozornení · 5 chýb · spolu 46
AI Bot Access PolicyZlyhalo
Major AI bots BLOCKED: ClaudeBot, Google-Extended, GPTBot
Prečo je to dôležité: AI search is a fast-growing product-discovery channel. Blocking the major AI crawlers cuts your store out of it entirely.
Ako opraviť: Remove Disallow rules for ClaudeBot, Google-Extended, GPTBot in robots.txt. These are the primary crawlers for ChatGPT Search, Claude, Perplexity, and Google AI Overviews. Without access, your store is invisible to AI-powered search.
Product Schema CompletenessZlyhalo
Only 45% complete — critical fields missing
Prečo je to dôležité: AI shopping assistants need complete product data to make recommendations. With only basic fields, your products won't appear in ChatGPT Shopping, Google AI Shopping, or Bing product cards.
Ako opraviť: Your Product schema is critically incomplete. Add at minimum: name, description, image, offers (with price, priceCurrency, availability), brand, sku, and aggregateRating.
Heading Hierarchy for AIZlyhalo
2 H1, 32 H2, 174 H3 — poor structure
Prečo je to dôležité: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.
Ako opraviť: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
Content Freshness SignalsZlyhalo
Prečo je to dôležité: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
Ako opraviť: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
Image Alt Text Quality for AIZlyhalo
Only 28% quality alt text — 246 missing, 215 poor
Prečo je to dôležité: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.
Ako opraviť: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
Structured Data FoundationUpozornenie
3 distinct schema types (WebSite, BusinessEntity, Product) — add more for comprehensive AI coverage
Prečo je to dôležité: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite.
Ako opraviť: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
FAQ Schema (Direct AI Answers)Upozornenie
Prečo je to dôležité: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Breadcrumb SchemaUpozornenie
Prečo je to dôležité: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.
Ako opraviť: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
Answer-First Content FormatUpozornenie
Content doesn't start with a strong summary paragraph
Prečo je to dôležité: AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often.
Ako opraviť: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
Semantic HTML StructureUpozornenie
3/6 elements — missing: <article>, <nav>, <aside>
Prečo je to dôležité: AI crawlers don't see your CSS. They rely on semantic HTML to distinguish main content from navigation, ads, and boilerplate.
Ako opraviť: Add: <article>, <nav>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
Structured Content (Lists & Tables)Upozornenie
26 lists found — consider adding comparison tables
Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.
Ako opraviť: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
Entity Clarity & Brand SignalsUpozornenie
5 sameAs links but incomplete OG tags
Prečo je to dôležité: AI needs to confidently identify your brand entity. Open Graph and sameAs together create a cross-platform identity that AI models recognize.
Ako opraviť: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
Author Expertise Signals (E-E-A-T)Upozornenie
Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.
Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Product Feed (AI Commerce)Upozornenie
Prečo je to dôležité: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.
Ako opraviť: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
Heureka XML FeedUpozornenie
Prečo je to dôležité: Heureka.sk and Heureka.cz are the dominant price comparison engines on the SK/CZ market. Without an XML feed you're not visible on the main marketplace. No generic audit tool checks this.
Ako opraviť: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).
Extractable Answer BlocksUpozornenie
16 paragraphs, avg 210 words — too long for AI snippets
Prečo je to dôležité: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.
Ako opraviť: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
Section Length OptimizationUpozornenie
Avg section: 20 words — only 0% in 80-200 word optimal range
Prečo je to dôležité: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsUpozornenie
Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.
Ako opraviť: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
Canonical Tag for AI DeduplicationUpozornenie
Canonical points to different URL: https://www.pilulka.sk
Prečo je to dôležité: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.
Ako opraviť: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
Return Policy SchemaUpozornenie
Prečo je to dôležité: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.
Ako opraviť: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
Shipping Details SchemaUpozornenie
Prečo je to dôležité: Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver.
Ako opraviť: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
Content Readability for AIUpozornenie
Grade 20 — too complex for broad AI citation (technical threshold: 14)
Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.
Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Expert Quotations & CitationsUpozornenie
Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.
Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
WebMCP Agentic ReadinessUpozornenie
Prečo je to dôležité: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
Content Accessibility for AIPrešlo
3825 words in raw HTML (1.7% text ratio) — readable by AI crawlers without executing JS
Organization Schema + Entity LinkingPrešlo
Organization found with 5 sameAs links — strong entity identity
Site Search Schema (SearchAction)Prešlo
WebSite SearchAction configured — AI can search your store
Content Depth for AIPrešlo
3825 words — rich content for AI analysis and citation
Reviews & Ratings SchemaPrešlo
AggregateRating/Review data found — social proof for AI
Statistics & Data PresencePrešlo
5 data points found — strong citation magnet
Common Question CoveragePrešlo
Answers 4/5 key shopper questions: price, shipping, returns/refunds, payment
Internal Link DensityPrešlo
197 contextual internal links per 1,000 words — strong knowledge graph signal
Knowledge Graph ReadinessPrešlo
3/4 entity signals — strong Knowledge Graph presence
Content-to-Boilerplate RatioPrešlo
84% of text in <main>/<article> — clean content signal
AggregateRating SchemaPrešlo
Review aggregate rating schema present
Customer Reviews — AggregatePrešlo
1 source: AggregateRating schema — ★ 4.8 · 35 999 reviews
Prečo je to dôležité: Multi-source reviews with published counts compound trust: AI assistants (ChatGPT/Perplexity) and Google SGE cite shops with verifiable AggregateRating schema first; SK/CZ buyers cross-check Heureka against Trustpilot before purchase.
llms.txt (AI Site Descriptor)Info
Not present — not required for AI visibility
Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.
Ako opraviť: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
AI Plugin ManifestInfo
Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
Prečo je to dôležité: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.
Speakable Content (Voice AI)Info
Not present — optional; SpeakableSpecification has limited assistant adoption
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Prečo je to dôležité: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Agent-Commerce ReadinessInfo
54/100 — čiastočne pripravené (Prístup 50 · Porozumenie 50 · Objaviteľnosť 67 · Transakcia 50)
Prečo je to dôležité: Či dokáže autonómny nákupný AI agent (ChatGPT operator, Perplexity, budúce agentické asistenty) na vašom obchode: prísť dnu, prečítať a porozumieť produktom, objaviť celý katalóg a konať (kôš, podmienky). Toto meria málokto — a pre SK/CZ shopy nikto. Skóre spája AI-bot prístup, Product schema, produktové feedy (Merchant/Heureka/Zboží), WebMCP a nákupné podmienky do jedného agent-first pohľadu. Nadväzuje na pripravovaný verejný MCP konektor ("naskenuj tento obchod").
Agent: Prístup — dostane sa agent dnuInfo
50/100 (2 signály/-ov)
Agent: Porozumenie — rozumie produktomInfo
50/100 (3 signály/-ov)
Agent: Objaviteľnosť — nájde celý katalógInfo
67/100 (3 signály/-ov)
Agent: Transakcia — vie konať (kôš/podmienky)Info
50/100 (3 signály/-ov)
Kategória 5 / 8 · pilulka.sk · Zulien Score

GDPR

66/100
Váha: 10% · 6 OK · 8 upozornení · 1 chýb · spolu 18
Consumer Dispute Resolution LinksZlyhalo
No EU ODR platform or supervisory-authority link found
Prečo je to dôležité: EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach.
Ako opraviť: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
Nariadenie (EÚ) 524/2013 (ODR) · Smernica 2013/11/EÚ (ADR) · SK zák. 391/2015 Z.z. · CZ zák. 634/1992 Sb. § 14
Cookie PolicyUpozornenie
Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
International Data TransfersUpozornenie
3 US-based tracker(s) without consent: Google Analytics/GTM, Microsoft Clarity, Google Ads
Prečo je to dôležité: The EU-US Data Privacy Framework covers some transfers, but loading US trackers without consent remains a violation. Austrian and French DPAs have ruled Google Analytics non-compliant without proper safeguards.
Ako opraviť: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
Right to Erasure (Data Deletion)Upozornenie
Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Newsletter ConsentUpozornenie
Newsletter signup found without visible consent checkbox
Prečo je to dôležité: GDPR requires 'freely given, specific, informed' consent for marketing emails. A newsletter form without explicit opt-in violates Article 7, and pre-checked boxes are not valid consent.
Ako opraviť: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.
Withdrawal of Consent MechanismUpozornenie
Prečo je to dôležité: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.
Ako opraviť: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
Omnibus Price Disclosure (30-day low)Upozornenie
Discounts shown without a visible 'lowest price in last 30 days' reference
Prečo je to dôležité: The EU Omnibus Directive (2019/2161), enacted in SK as zák. 108/2024 and CZ via zák. 634/1992, makes the 30-day reference price MANDATORY on every advertised discount. ŠOI/ČOI actively inspect for missing disclosures — and a '−40%' off an inflated base is exactly what they target.
Ako opraviť: Whenever you advertise a price reduction, display the lowest price applied in the 30 days before the discount, next to the new price. In PrestaShop add a 30-day price-history anchor (e.g. our zu_pricehistory module) so every sale label is compliant automatically.
Withdrawal & Complaints PolicyUpozornenie
Missing: right of withdrawal (odstúpenie od zmluvy)
Prečo je to dôležité: The Consumer Rights Directive (2011/83/EU) and SK zák. 108/2024 / CZ zák. 89/2012 require pre-contractual disclosure of the 14-day withdrawal right and an accessible complaints procedure. Missing them extends customers' cancellation rights and is a standard ŠOI/ČOI finding.
Ako opraviť: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.
Online Withdrawal FunctionUpozornenie
No online withdrawal function or withdrawal information detected
Prečo je to dôležité: Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually.
Ako opraviť: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.
Privacy Policy PagePrešlo
https://www.pilulka.sk/zasady-o-ochrane-osobnych-udajov
Legal Contact / Imprint PagePrešlo
https://www.pilulka.sk/o-nas
Terms & Conditions PagePrešlo
https://pilulkask.vshcdn.net/_nuxt/default.CGVycd2Q.css
Data Encryption (No Mixed Content)Prešlo
All resources loaded over HTTPS
Third-party Data SharingPrešlo
4 third-party domain(s)
Data Protection Officer ContactPrešlo
DPO / data protection contact found
Cookie Consent Banner (CMP)Info
No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)
Prečo je to dôležité: EU regulators enforce cookie consent (CNIL fined Google €150M). If the CMP is GTM-injected this scan can't confirm it — verify manually.
Ako opraviť: Confirm a consent management platform actually loads and blocks non-essential cookies until opt-in. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Tracking Scripts & ConsentInfo
4 tracker(s) detected (Google Analytics/GTM, Microsoft Clarity, Matomo, Google Ads); no CMP visible in server HTML but GTM is present
Prečo je to dôležité: Loading tracking before consent is a direct GDPR/ePrivacy violation, but GTM-managed consent gating isn't visible server-side — verify in the browser.
Ako opraviť: Confirm these trackers are gated behind consent (GTM consent mode / CMP script blocking) before they fire. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Google Consent Mode v2Info
No Consent Mode signals in server HTML, but GTM is present — Consent Mode is commonly configured inside GTM
Prečo je to dôležité: Google requires Consent Mode v2 for EU traffic since March 2024, but GTM-side configuration is invisible to a server-side HTML scan — verify manually.
Ako opraviť: Confirm Google Consent Mode v2 default state (ad_storage/analytics_storage denied) is set in your GTM container. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Kategória 6 / 8 · pilulka.sk · Zulien Score

Vulnerability

58/100
Váha: 10% · 9 OK · 6 upozornení · 5 chýb · spolu 21
Form CSRF ProtectionZlyhalo
3 form(s) without CSRF tokens
Prečo je to dôležité: CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.
Ako opraviť: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
Suspicious Inline Script PatternsZlyhalo
Detected: Payment data exfiltration pattern, Dynamic script injection
Prečo je to dôležité: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites.
Ako opraviť: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
Payment Page SecurityZlyhalo
Payment page missing: No HSTS, No X-Content-Type-Options
Prečo je to dôležité: Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.
Ako opraviť: CRITICAL: Your payment page is missing security headers: No HSTS, No X-Content-Type-Options. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
API Key Exposure in SourceZlyhalo
1 potential API key(s) in HTML: apiKey:"eyJpIjo0NjYsImMiOjE2Nz...
Prečo je to dôležité: Exposed API keys are exploited within minutes by automated bots scanning HTML source. Stripe keys enable charges to your account, Google keys enable billing abuse, GitHub tokens compromise your repositories.
Ako opraviť: URGENT: Rotate all exposed API keys immediately! Move secrets to server-side environment variables. Never include API keys in client-side HTML or JavaScript. Use server-side proxy endpoints for API calls.
Server Error LeakZlyhalo
PHP/server error messages visible in page output
Prečo je to dôležité: Error messages reveal file paths, database structure, table names, and query logic. This is a goldmine for attackers — it turns a blind SQL injection into a targeted one, reducing attack time from days to minutes.
Ako opraviť: Set display_errors=Off in php.ini and log_errors=On. Configure a custom error page. Never show stack traces, SQL errors, or file paths to users.
CORS ConfigurationUpozornenie
Access-Control-Allow-Origin: * (allows any domain)
Prečo je to dôležité: A wildcard CORS policy allows any website to make requests to your API/pages. Combined with Access-Control-Allow-Credentials, this enables cross-origin data theft.
Ako opraviť: Replace the wildcard CORS header with specific allowed origins. Avoid Access-Control-Allow-Origin: * on pages with authentication or sensitive data.
X-Powered-By HeaderUpozornenie
Nuxt
Prečo je to dôležité: "Nuxt" reveals your server technology and version. Attackers use this to find matching CVEs.
Ako opraviť: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').
Inline JavaScript ExposureUpozornenie
770 KB of inline JavaScript
Prečo je to dôležité: Large amounts of inline JavaScript prevent proper CSP implementation and increase the risk of XSS. External scripts can be protected with SRI hashes.
Ako opraviť: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
Source Maps ExposedUpozornenie
JavaScript source maps (.js.map) are publicly accessible
Prečo je to dôležité: Source maps reveal your original source code, variable names, comments, and application logic. Attackers use this to find vulnerabilities, API keys in code, and understand your authentication flow.
Ako opraviť: Remove source maps from production or block access via server config. In Vite/Webpack: set sourcemap: false for production builds.
Cross-Origin IsolationUpozornenie
Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
Login Form SecurityUpozornenie
Login form blocks password manager autofill
Prečo je to dôležité: NIST guidelines recommend allowing password autofill. Blocking it forces users to choose weak, memorable passwords — a leading cause of credential compromise.
Ako opraviť: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
CMS Version DisclosurePrešlo
No generator tag — CMS identity hidden
Sensitive Files ExposedPrešlo
.env, .git, composer.json — all properly blocked
Install Script ExposedPrešlo
No /install/ or /setup/ paths accessible
Directory ListingPrešlo
Disabled — file structure hidden
Admin Panel at Default URLPrešlo
Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
Debug Mode / Error ExposurePrešlo
No debug indicators found in page output
SPF Record (Email Security)Prešlo
SPF configured: v=spf1 include:_spf.google.com +a +mx +ip4:5.9.109.214 +ip4:5.9.109.219 +ip4:37.
DMARC Policy (Email Auth)Prešlo
DMARC enforced: p=quarantine
DKIM Signing (Email Auth)Prešlo
DKIM configured (selectors: google, s1)
BIMI Brand IndicatorsInfo
Prečo je to dôležité: BIMI requires a VMC (Verified Mark Certificate) but adds your brand logo to recipient inboxes as a trust signal. Optional but high-impact for brand-focused shops.
Ako opraviť: Once DMARC is set to p=quarantine or p=reject with 100% enforcement, publish a BIMI record: v=BIMI1; l=https://yourdomain.com/logo.svg — adds your brand logo to recipient inboxes in Gmail and Yahoo.
Kategória 7 / 8 · pilulka.sk · Zulien Score

Accessibility

59/100
Váha: — · 4 OK · 3 upozornení · 1 chýb · spolu 9
Image Alt TextZlyhalo
246 of 818 images have no alt attribute
Prečo je to dôležité: Images without alt text are invisible to blind users and to Google Images. EN 301 549 § 9.1.1.1 (WCAG 1.1.1) requires a text alternative.
Ako opraviť: Add descriptive alt text to every meaningful image; use alt="" for decorative ones.
Form LabelsUpozornenie
2 of 4 form inputs missing a label
Prečo je to dôležité: Inputs without a programmatic label are inaccessible to assistive technology (WCAG 1.3.1 / EN 301 549 § 9.1.3.1).
Ako opraviť: Add a <label for> or aria-label to the remaining inputs.
Heading StructureUpozornenie
Heading outline issue (h1 count: 2h2→h5)
Prečo je to dôležité: A clean heading hierarchy is the primary way assistive-tech users skim a page (WCAG 1.3.1 / 2.4.6).
Ako opraviť: Use a single <h1> and don't jump heading levels (e.g. <h2> straight to <h4>).
Skip LinkUpozornenie
No skip-to-content link detected
Prečo je to dôležité: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).
Ako opraviť: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
Page LanguagePrešlo
<html lang="sk"> is set
Link TextPrešlo
Links use descriptive text
Landmark RegionsPrešlo
Semantic landmarks present (<main>, <nav>/<header>)
Zoom & ScalingPrešlo
Pinch-zoom is not disabled
EAA Legal BasisInfo
In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
Kategória 8 / 8 · pilulka.sk · Zulien Score

Ďalšie kroky

  1. Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
  2. Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
  3. Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
  4. Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/pilulka.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk