Below Average

Score Report

zlatokov.sk

Scanned on August 10, 2026

Sellio
Bootstrap 5.3.7
Font Awesome
Swiper
Toastr
Vite
Caddy
Company:ZLATOKOV SK, a.s.· NACE 4777
NIS2: out of scope
Risk:10/100low
Credit:A+
VAT registered
Shell address
Top 13% in sector
Full company profile →
Last scanned: August 10, 2026
AI verdict

Your site has fundamental security gaps and poor accessibility. Immediately add security headers (HSTS, CSP) to protect visitors. On the bright side, your GDPR compliance is solid.

Not subject to NIS2 cybersecurity duties.Based on NACE sector + company size, Article 21 compliance is not mandatory. Security best practices still recommended.
Supplying a NIS2-regulated company?Even outside direct scope you may inherit supply-chain duties — regulated companies cascade them to suppliers by contract (security, incident reporting, encryption). ICT and managed-service providers are in scope regardless of size.
Check supplier obligations Legal basis: NIS2 Art. 21 · SK 366/2024 §21 · NIS2 Art. 21(2)(d)
Action plan

Fix these 3 things first

Sorted by score impact — each fix moves your overall grade up.

+15potential gain

Performance

Weight: 25% · 11 passed · 5 warnings · 3 failed · 3 SPA (verify manually)

What we found: 5.2 MB, 145 requests — too heavy!

Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.

How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Evidence:PSI-lab· Confidence: high
Get Performance Optimization →

What we found: 145 requests — well past both the 80 budget and the cohort median of 140

Why it matters: Past ~140 requests the browser spends its time on connection and queueing overhead rather than rendering. The best shop in our benchmark renders with 37.

How to fix: Start with what loads before first paint: bundle the CSS/JS, sprite the icons, lazy-load every below-fold image, and remove duplicate tag-manager containers loading the same vendor twice.
Evidence:PSI-lab145 requests· Confidence: high

What we found: 373 KB wasted on unused code!

Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Note: This check uses heuristic detection and may produce false positives. Manual verification recommended.

How to fix: You're loading 373 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
Evidence:PSI-lab· Confidence: low

What we found: 674 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked

Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.

How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
Evidence:PSI-lab674 KB JavaScript· Confidence: high

What we found: 63 images without lazy loading

Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.

How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
Evidence:HTML-heuristic· Confidence: high
Request quote for speed audit

What we found: 7 CSS files loaded

Why it matters: Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load.

How to fix: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
Evidence:HTML-heuristic· Confidence: high

What we found: 7 CSS files without critical CSS extraction

Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Evidence:PSI-lab· Confidence: high
Request quote for speed audit

What we found: 568 KB of inline JavaScript

Why it matters: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.

How to fix: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
Evidence:PSI-lab· Confidence: high
Request quote for security audit

8 issues found in Performance. Room for improvement.

Your store doesn't qualify for the Zulien Score Badge yet. Score 80+ to earn it!

📧 Re-scan reminders

We'll email you monthly when it's time to re-scan and track your improvements.

🚀 Improve your score

Our PrestaShop modules can fix most of these issues automatically.

Free 15-min consultation · No commitment

Share & Export

Ready to improve your score?

Your store is losing customers every day. The issues above are costing you sales.

Fix it yourself

Browse our modules to fix these issues in 2 clicks.

Browse Zulien Modules

Let us fix it for you

Describe your goal and we'll send a quote within 48h — no call needed.

Get a written quote

Reply within 48h · No sales call

This is an automated heuristic estimate, not a professional audit. Findings reflect publicly observable signals at scan time and may include false positives.Learn about our methodologyReport inaccuracyRemove this report
Full e-commerce audit — 50+ checks across 7 categories
64/100
Grade D
zlatokov.sk
ZLATOKOV SK, a.s.
Audit date: August 10, 2026
Platform: Sellio
NACE: 4777
Online report: https://score.zulien.sk/r/zlatokov.sk
Generated · score.zulien.sk · by Zulien

Executive summary

24
Failures
66
Warnings
62
OK
175
Checks total

Scores by category

CategoryScoreWeightFailuresWarningsOK
Performance81/10025%3511
SEO73/10020%2915
Security50/10015%3104
Mobile60/10010%1106
AI Readiness51/10010%6226
Legal & Compliance75/10010%169
Vulnerability73/10010%339
Accessibility / EAA16/100—512

Critical findings

Total Page Weight· Performance
Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
Request Budget· Performance
Past ~140 requests the browser spends its time on connection and queueing overhead rather than rendering. The best shop in our benchmark renders with 37.
Unused Code (CSS + JS)· Performance
Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
H1 Heading· SEO
The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords.
Open Graph Tags· SEO
Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
HSTS (Strict-Transport-Security)· Security
Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
Content-Security-Policy (CSP)· Security
CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
Clickjacking Protection· Security
Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
Form Input Labels (WCAG 3.3.2)· Mobile
The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures.
Organization Schema + Entity Linking· AI Readiness
Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
Heading Hierarchy for AI· AI Readiness
AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.
Content Freshness Signals· AI Readiness
With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

Performance

81/100
Weight: 25% · 11 OK · 5 warnings · 3 failures · 22 total
Total Page WeightFailed
5.2 MB, 145 requests — too heavy!
Why it matters: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales.
How to fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
Request BudgetFailed
145 requests — well past both the 80 budget and the cohort median of 140
Why it matters: Past ~140 requests the browser spends its time on connection and queueing overhead rather than rendering. The best shop in our benchmark renders with 37.
How to fix: Start with what loads before first paint: bundle the CSS/JS, sprite the icons, lazy-load every below-fold image, and remove duplicate tag-manager containers loading the same vendor twice.
Unused Code (CSS + JS)Failed
373 KB wasted on unused code!
Why it matters: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.
How to fix: You're loading 373 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
JavaScript BudgetWarning
674 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked
Why it matters: Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB.
How to fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
Lazy LoadingWarning
63 images without lazy loading
Why it matters: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download.
How to fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
CSS File CountWarning
7 CSS files loaded
Why it matters: Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load.
How to fix: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
Critical CSS StrategyWarning
7 CSS files without critical CSS extraction
Why it matters: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.
How to fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
Inline JavaScript SizeWarning
568 KB of inline JavaScript
Why it matters: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.
How to fix: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
Server Response Time (TTFB)Passed
40ms
First Contentful Paint (FCP)Passed
1.32s
Largest Contentful Paint (LCP)Passed
2.48s — Core Web Vital ✓
Total Blocking Time (TBT)Passed
19ms
Cumulative Layout Shift (CLS)Passed
0.004 — Core Web Vital ✓
Speed IndexPassed
1.47s
Text Compression (gzip/brotli)Passed
All text resources properly compressed
Resource Hints (Preload/Preconnect)Passed
9 preload, 0 preconnect hint(s)
HTTP/3 (QUIC) SupportPassed
HTTP/3 enabled via Alt-Svc header
Script Loading StrategyPassed
100% of scripts use async/defer/module (1 async, 0 defer, 1 module)
Font PreloadingPassed
6 font(s) preloaded — faster text rendering
Third-party ServicesInfo
Not measured — PageSpeed did not return the third-party audit for this URL
Why it matters: We report this as unmeasured rather than as zero third parties, because those are very different findings.
How to fix: Re-run the scan, or check the third-party summary directly at PageSpeed Insights.
Render-blocking ResourcesInfo
Not measured — PageSpeed did not return the render-blocking audit for this URL
How to fix: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.
Cache-Control StrategyInfo
Not measured — no Cache-Control on the HTML document; static-asset caching was not sampled
Why it matters: Asset caching can eliminate a large share of requests for repeat visitors. We only see the HTML response here, so this is a hint, not a verdict.
How to fix: Ensure static assets (CSS/JS/images) are served with 'Cache-Control: max-age=31536000, immutable' and versioned filenames. HTML can stay 'max-age=0, must-revalidate'.
Category 1 / 8 · zlatokov.sk · Zulien Score

SEO

73/100
Weight: 20% · 15 OK · 9 warnings · 2 failures · 27 total
H1 HeadingFailed
Why it matters: The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords.
How to fix: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
Open Graph TagsFailed
Why it matters: Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards.
How to fix: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
Meta DescriptionWarning
227 chars (optimal: 120-160)
Why it matters: Google truncates descriptions over 160 chars. Mobile shows even less (~120 chars).
How to fix: Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.
Twitter/X CardsWarning
Why it matters: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.
How to fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
Image Alt AttributesWarning
Only 67% of 63 images have alt text
Why it matters: Missing alt text means no visibility in Google Image Search, which is a real traffic source for e-commerce.
How to fix: 21 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
Image Format OptimizationWarning
Only 48% next-gen formats — 0 legacy images remain
Why it matters: WebP/AVIF images are 30-70% smaller than JPEG/PNG at the same quality. This directly improves page speed, LCP, and mobile experience.
How to fix: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.
Semantic HTML StructureWarning
Only 3/6 semantic elements — missing: <article>, <main>, <aside>
Why it matters: Semantic HTML gives search engines clear signals about content structure. Pages with proper semantic markup earn more featured snippets and knowledge panel appearances.
How to fix: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
Sitemap in robots.txtWarning
robots.txt exists but doesn't reference your sitemap
Why it matters: While Google can find sitemaps via Search Console, referencing it in robots.txt ensures all search engines (Bing, Yandex, Baidu) can discover it automatically.
How to fix: Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.
Accessibility FundamentalsWarning
2/4 a11y signals — missing: ARIA labels, skip navigation link
Why it matters: The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO, as Google treats it as a ranking signal.
How to fix: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
Product Schema RichnessWarning
Missing recommended: aggregateRating, review, gtin
Why it matters: Complete product schema enables rich snippets that lift organic click-through. Products with reviews/ratings in search results see meaningfully higher CTR.
How to fix: Add aggregateRating, review, gtin to your Product schema. These fields enable rich snippets with star ratings, price, availability, and brand in search results.
Image Dimension AttributesWarning
Only 35% of images have width/height attributes
Why it matters: Missing image dimensions are a leading cause of Cumulative Layout Shift. Google uses CLS as a Core Web Vital ranking factor.
How to fix: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
Meta TitlePassed
57 chars — "Zlaté šperky s dušou: Ručne vyrobené príbehy od roku 19…"
Content Structure (H2 Headings)Passed
9 H2 subheadings found
Canonical URLPassed
https://zlatokov.sk
Structured Data (JSON-LD)Passed
1 block(s): Store, ImageObject
JSON-LD ValidityPassed
1 block(s) parse cleanly
robots.txtPassed
Present
XML SitemapPassed
Found with at least 897 URLs (large sitemap — only the start was read)
HTML Language AttributePassed
lang="sk"
Hreflang Tags (Multilingual)Passed
2 language(s): sk-SK, x-default
Meta Robots TagPassed
index, follow
FaviconPassed
Favicon detected
Content DepthPassed
744 words — sufficient content
Deep Heading HierarchyPassed
H2: 9, H3: 19 — well-structured content
Internal LinkingPassed
43 internal links — strong site navigation
Sitemap FreshnessPassed
Newest <lastmod> 0 day(s) ago
Text-to-HTML RatioInfo
1% ratio but 744 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
Why it matters: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.
How to fix: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.
Category 2 / 8 · zlatokov.sk · Zulien Score

Security

50/100
Weight: 15% · 4 OK · 10 warnings · 3 failures · 17 total
HSTS (Strict-Transport-Security)Failed
Why it matters: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi.
How to fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
Content-Security-Policy (CSP)Failed
Why it matters: CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection.
How to fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
Clickjacking ProtectionFailed
Why it matters: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.
How to fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
DNSSECWarning
No DNSKEY records — zone is unsigned
Why it matters: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.
How to fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
CAA DNS RecordWarning
No CAA records — any CA can issue certificates for this domain
Why it matters: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).
How to fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
X-Content-Type-OptionsWarning
Why it matters: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.
How to fix: Add header: X-Content-Type-Options: nosniff
Referrer-PolicyWarning
Why it matters: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.
How to fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
Permissions-PolicyWarning
Why it matters: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.
How to fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
Cookie Security FlagsWarning
1 cookie(s): 1 missing Secure, 1 missing HttpOnly, 1 missing SameSite
Why it matters: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.
How to fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
Technology DisclosureWarning
X-Powered-By: Nuxt
Why it matters: Exposing exact server/PHP versions lets attackers search CVE databases for specific exploits. This is the first step in most automated attacks.
How to fix: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
security.txt (RFC 9116)Warning
Why it matters: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all.
How to fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
CDN / WAF ProtectionWarning
Why it matters: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts.
How to fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
Cookie Prefix SecurityWarning
1 session cookie(s) without __Secure- or __Host- prefix
Why it matters: Cookie prefixes are an extra defense layer — browsers enforce that __Host- cookies are Secure, from the exact domain, and have Path=/. This prevents subdomain cookie injection.
How to fix: Use __Host- prefix for session cookies: __Host-session=abc; Secure; Path=/; HttpOnly. The prefix enforces Secure flag and prevents cookie injection attacks.
SSL/TLS CertificatePassed
Valid HTTPS connection established
HTTP → HTTPS RedirectPassed
HTTP properly redirects to HTTPS
Subresource Integrity (SRI)Passed
All cross-origin scripts are auto-updating provider scripts where SRI does not apply
Server Version DisclosurePassed
Caddy — version hidden
Category 3 / 8 · zlatokov.sk · Zulien Score

Mobile

60/100
Weight: 10% · 6 OK · 10 warnings · 1 failures · 18 total
Form Input Labels (WCAG 3.3.2)Failed
Only 0/3 inputs have a label (0%)
Why it matters: The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures.
How to fix: 3 input elements have no label. Every input needs a matching <label for="id">Text</label> or an aria-label. A placeholder is NOT a label (WCAG 3.3.2). On a checkout or registration form this costs conversion and breaches EN 301 549 (EAA 2026).
Viewport ConfigurationWarning
Present, but maximum-scale=1 disables pinch-to-zoom
Why it matters: Preventing pinch-to-zoom is an accessibility violation (WCAG 1.4.4). Users with vision impairments need zoom.
How to fix: Remove 'maximum-scale=1' and 'user-scalable=no' from your viewport meta tag. Use: <meta name='viewport' content='width=device-width, initial-scale=1'>
Mobile Performance ScoreWarning
57/100 (target: 90+)
Why it matters: Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop.
How to fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
Touch Target SizeWarning
Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
Why it matters: Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.
How to fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
Font Size ReadabilityWarning
Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
Why it matters: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience.
How to fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
PWA FeaturesWarning
Why it matters: PWAs combine the best of web and native apps. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access.
How to fix: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.
Theme ColorWarning
Why it matters: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional.
How to fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
Inline CSS SizeWarning
345 KB of inline CSS
Why it matters: Large inline CSS blocks increase initial HTML download and parsing time — especially painful on mobile with limited CPU and slower connections.
How to fix: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
Responsive Images (srcset)Warning
63 images without responsive sizing
Why it matters: Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.
How to fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
SK/CZ Local Payment MethodsWarning
Only 2 SK/CZ methods (Tatra Pay, QR platba / Pay by square)
Why it matters: A large share of Slovak online payments goes through local bank buttons or QR payment. Cards only means high cart abandonment on the SK market.
How to fix: Add more SK/CZ local methods: ComGate, GoPay, Barion, Besteron, PayU. Slovak customers prefer bank buttons and QR payment over cards.
Heading Hierarchy (WCAG 1.3.1)Warning
Preskočené úrovne: h2→h4
Why it matters: Skipped heading levels (h1 straight to h3) break screen-reader navigation and signal poor document structure to Google. SEO suffers too.
How to fix: Keep headings in order h1 → h2 → h3 → h4 with no skipped levels. Screen readers use the heading hierarchy to navigate. If you want smaller text at the same level, use a CSS class rather than a lower heading tag.
Content Fits ViewportPassed
No horizontal scrolling needed
Responsive Design TechniquesPassed
Flexbox, CSS Grid, Media queries detected
Mobile Navigation (Semantic)Passed
<nav> element present — proper navigation landmark
Form Input TypesPassed
Optimized: 1 email
Payment Methods DetectedPassed
2 method(s): Tatra Pay, QR platba / Pay by square
Link Text Quality (WCAG 2.4.4)Passed
Všetky odkazy majú popisný text
Express Checkout (Apple Pay + Google Pay)Info
Apple Pay / Google Pay nedetekované na homepage — express checkout sa zvyčajne zobrazí až v košíku/checkoute
Why it matters: Mobile conversion with express checkout beats manual card entry, and it is a growing trend in SK/CZ. (The scan only sees the homepage, so treat this as a hint rather than a verdict.)
How to fix: If you have no express checkout, add Apple Pay and Google Pay via Stripe, Adyen or Mollie. Biometric auth removes a click from checkout, which lifts conversion.
Category 4 / 8 · zlatokov.sk · Zulien Score

AI Readiness

51/100
Weight: 10% · 6 OK · 22 warnings · 6 failures · 47 total
Organization Schema + Entity LinkingFailed
Why it matters: Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.
How to fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
Heading Hierarchy for AIFailed
0 H1, 9 H2, 19 H3 — poor structure
Why it matters: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.
How to fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
Content Freshness SignalsFailed
Why it matters: With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.
How to fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
Entity Clarity & Brand SignalsFailed
Why it matters: AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors.
How to fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
Knowledge Graph ReadinessFailed
Why it matters: Without Knowledge Graph signals, AI treats your brand as unverified. You won't get a Google Knowledge Panel, and AI assistants can't confidently attribute information to your brand.
How to fix: Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.
Image Alt Text Quality for AIFailed
Only 11% quality alt text — 21 missing, 21 poor
Why it matters: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.
How to fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
Structured Data FoundationWarning
Only 1 distinct schema type (BusinessEntity) — insufficient for AI visibility
Why it matters: Single-schema sites get minimal AI coverage. AI models need multiple data signals to confidently recommend your store.
How to fix: One schema type is not enough. Add at minimum: Organization (identity), Product (commerce), BreadcrumbList (navigation), WebSite+SearchAction (discoverability), FAQPage (Q&A answering).
Product Schema CompletenessWarning
79% complete — missing: aggregateRating, priceValidUntil, gtin/mpn
Why it matters: Incomplete Product schema means AI shows partial product info. Google Shopping and AI assistants skip products missing price, availability, or images — your competitors with complete schemas win.
How to fix: Add missing Product schema fields: aggregateRating, priceValidUntil, gtin/mpn. Each field improves how AI presents your products. Especially add aggregateRating, since products with ratings show more prominently in AI shopping results.
FAQ Schema (Direct AI Answers)Warning
Why it matters: ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI.
How to fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
Breadcrumb SchemaWarning
Why it matters: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.
How to fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
Site Search Schema (SearchAction)Warning
Why it matters: SearchAction enables Google's sitelinks search box and allows AI shopping assistants to search your catalog directly. It's how AI agents find specific products in your store.
How to fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
Answer-First Content FormatWarning
Content doesn't start with a strong summary paragraph
Why it matters: AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often.
How to fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
Semantic HTML StructureWarning
3/6 elements — missing: <article>, <main>, <aside>
Why it matters: AI crawlers don't see your CSS. They rely on semantic HTML to distinguish main content from navigation, ads, and boilerplate.
How to fix: Add: <article>, <main>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
Structured Content (Lists & Tables)Warning
15 lists found — consider adding comparison tables
Why it matters: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text.
How to fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
Author Expertise Signals (E-E-A-T)Warning
Why it matters: AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content.
How to fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
Product Feed (AI Commerce)Warning
Why it matters: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.
How to fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
Heureka XML FeedWarning
Why it matters: Heureka.sk and Heureka.cz are the dominant price comparison engines on the SK/CZ market. Without an XML feed you're not visible on the main marketplace. No generic audit tool checks this.
How to fix: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).
Extractable Answer BlocksWarning
11 paragraphs, avg 15 words — too short for citation
Why it matters: AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable.
How to fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
Statistics & Data PresenceWarning
No statistical data found in content
Why it matters: Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics.
How to fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
Section Length OptimizationWarning
Avg section: 59 words — only 22% in 80-200 word optimal range
Why it matters: For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance.
How to fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
Q&A Format HeadingsWarning
Why it matters: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.
How to fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
Return Policy SchemaWarning
Why it matters: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.
How to fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
Shipping Details SchemaWarning
Why it matters: Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver.
How to fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
Content Readability for AIWarning
Grade 20 — too complex for broad AI citation (technical threshold: 14)
Why it matters: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often.
How to fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
Expert Quotations & CitationsWarning
Why it matters: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.
How to fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
WebMCP Agentic ReadinessWarning
Why it matters: WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.
How to fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
Content-to-Boilerplate RatioWarning
No <main> or <article> elements — AI can't isolate content from boilerplate
Why it matters: Without semantic containers, AI crawlers must guess where content starts and navigation ends. This leads to poor content extraction and fewer citations.
How to fix: Add <main> around your primary content and <article> around self-contained content blocks. This creates clear boundaries for AI content extraction.
Trust WidgetWarning
No trust widget (Heureka / Trustpilot / AggregateRating) detected
Why it matters: SK/CZ buyers trust Heureka Ověřeno more than other trust signals. LLMs (ChatGPT, Perplexity) and Google SGE cite shops with AggregateRating schema first.
How to fix: For SK/CZ shops: install the Heureka Ověřeno zákazníky widget (free for verified sellers — https://sluzby.heureka.sk). Alternatives: Trustpilot, Google Reviews with AggregateRating schema. Place the trust widget on product + category + footer.
AI Bot Access PolicyPassed
No AI bot restrictions (allowed by default)
Content Accessibility for AIPassed
744 words in raw HTML (0.5% text ratio) — readable by AI crawlers without executing JS
Content Depth for AIPassed
744 words — rich content for AI analysis and citation
Common Question CoveragePassed
Answers 4/5 key shopper questions: price, shipping, returns/refunds, payment
Internal Link DensityPassed
58 contextual internal links per 1,000 words — strong knowledge graph signal
Canonical Tag for AI DeduplicationPassed
Self-referencing canonical — clean signal for AI
llms.txt (AI Site Descriptor)Info
Not present — not required for AI visibility
Why it matters: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Without it, AI assistants have no guided overview of your store.
How to fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.
llms-full.txt (Complete AI Content)Info
Not present — not required for AI visibility
Why it matters: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.
Reviews & Ratings SchemaInfo
No review schema on this homepage — review/rating schema typically lives on product pages
Why it matters: Review schema is product-page-specific, so its absence here is expected, not a defect.
How to fix: Scan a product URL to audit review schema. On product pages add AggregateRating (ratingValue, reviewCount, bestRating) and individual Review schemas.
AI Plugin ManifestInfo
Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
Why it matters: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.
GTIN/EAN CoverageInfo
No product feed was sampled — GTIN/EAN coverage could not be verified
Why it matters: GTIN is how an AI shopping agent matches your product to the same product in other shops. Without a feed we cannot measure it — this is not a finding against you.
How to fix: Publish a Google Merchant or Heureka product feed with GTIN/EAN populated, then re-scan to measure coverage.
Speakable Content (Voice AI)Info
Not present — optional; SpeakableSpecification has limited assistant adoption
Delivery PromiseInfo
No delivery timing was found in the text of the sampled product page
Why it matters: Customers decide at the product page. Timing that only lives in a terms page is not part of that decision. Note: this reads page text, so unusual phrasing can be missed — verify before acting.
How to fix: Show expected delivery on the product page itself, not only in the shipping-terms page: a weekday or date plus the order cut-off time.
ai.txt (AI Permissions)Info
Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
Why it matters: ai.txt is an emerging standard for fine-grained AI permissions beyond robots.txt. It gives you control over how AI uses your content.
Agent-Commerce ReadinessInfo
58/100 — partly ready (Access 100 · Understand 33 · Discover 50 · Transact 50)
Why it matters: Whether an autonomous shopping agent (a ChatGPT operator, Perplexity, the assistants coming next) can do four things on your shop: get in, read and understand the products, discover the whole catalogue, and act (cart, terms). Almost nobody measures this, and for SK/CZ shops nobody does.
Agent: Access — can an agent get inInfo
100/100 (2 signals)
Agent: Understand — can it read the productsInfo
33/100 (3 signals)
Agent: Discover — can it find the whole catalogueInfo
50/100 (3 signals)
Agent: Transact — can it act (cart, terms)Info
50/100 (3 signals)
Category 5 / 8 · zlatokov.sk · Zulien Score

Legal & Compliance

75/100
Weight: 10% · 9 OK · 6 warnings · 1 failures · 20 total
Consumer Dispute Resolution LinksFailed
No EU ODR platform or supervisory-authority link found
Why it matters: EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach.
How to fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
Nariadenie (EÚ) 524/2013 (ODR) · Smernica 2013/11/EÚ (ADR) · SK zák. 391/2015 Z.z. · CZ zák. 634/1992 Sb. § 14
Cookie PolicyWarning
Why it matters: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.
How to fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
International Data TransfersWarning
1 US-based tracker(s) without consent: Google Analytics/GTM
Why it matters: The EU-US Data Privacy Framework covers some transfers, but loading US trackers without consent remains a violation. Austrian and French DPAs have ruled Google Analytics non-compliant without proper safeguards.
How to fix: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
Right to Erasure (Data Deletion)Warning
Why it matters: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding.
How to fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
Newsletter ConsentWarning
Newsletter signup found without visible consent checkbox
Why it matters: GDPR requires 'freely given, specific, informed' consent for marketing emails. A newsletter form without explicit opt-in violates Article 7, and pre-checked boxes are not valid consent.
How to fix: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.
Age VerificationWarning
Age-restricted content detected without age gate
Why it matters: EU member states require age verification for age-restricted products. German JuSchG (Youth Protection Act) and similar laws mandate age gates. Missing them risks regulatory action and marketplace delisting.
How to fix: Implement age verification for alcohol, tobacco, gambling, or adult content. Use a date-of-birth check or age confirmation modal before accessing the site.
GPSR Manufacturer InfoWarning
No manufacturer/importer identification found on the sampled product page
Why it matters: GPSR (Regulation (EU) 2023/988) has been enforceable since 13 December 2024 and requires the responsible economic operator to be identifiable on the offer. IMPORTANT: this is a text heuristic over ONE sampled product page — it is an orientation signal, not a legal assessment. Verify against your own catalogue before acting.
How to fix: On every product page state the manufacturer's name, postal address and an electronic contact (email or web form). For goods made outside the EU, also name the EU importer. Structured `manufacturer` in Product schema satisfies this cleanly and is machine-readable.
Privacy Policy PagePassed
/ochrana-osobnych-udajov
Legal Contact / Imprint PagePassed
/o-nas
Terms & Conditions PagePassed
/vseobecne-obchodne-podmienky
Data Encryption (No Mixed Content)Passed
All resources loaded over HTTPS
Third-party Data SharingPassed
1 third-party domain(s)
Data Protection Officer ContactPassed
DPO / data protection contact found
Withdrawal of Consent MechanismPassed
Consent withdrawal / opt-out mechanism found
Omnibus Price Disclosure (30-day low)Passed
Discount with a 30-day reference price detected
Withdrawal & Complaints PolicyPassed
Withdrawal right + complaints procedure referenced
Cookie Consent Banner (CMP)Info
No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)
Why it matters: EU regulators enforce cookie consent (CNIL fined Google €150M). If the CMP is GTM-injected this scan can't confirm it — verify manually.
How to fix: Confirm a consent management platform actually loads and blocks non-essential cookies until opt-in. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Tracking Scripts & ConsentInfo
1 tracker(s) detected (Google Analytics/GTM); no CMP visible in server HTML but GTM is present
Why it matters: Loading tracking before consent is a direct GDPR/ePrivacy violation, but GTM-managed consent gating isn't visible server-side — verify in the browser.
How to fix: Confirm these trackers are gated behind consent (GTM consent mode / CMP script blocking) before they fire. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Google Consent Mode v2Info
No Consent Mode signals in server HTML, but GTM is present — Consent Mode is commonly configured inside GTM
Why it matters: Google requires Consent Mode v2 for EU traffic since March 2024, but GTM-side configuration is invisible to a server-side HTML scan — verify manually.
How to fix: Confirm Google Consent Mode v2 default state (ad_storage/analytics_storage denied) is set in your GTM container. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.
Online Withdrawal FunctionInfo
No explicit online withdrawal button in the server HTML — it may live in the logged-in account/order area, which this scan can't reach. Verify it's present.
Why it matters: Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually.
How to fix: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.
Category 6 / 8 · zlatokov.sk · Zulien Score

Vulnerability

73/100
Weight: 10% · 9 OK · 3 warnings · 3 failures · 15 total
Form CSRF ProtectionFailed
1 form(s) without CSRF tokens
Why it matters: CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.
How to fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
DMARC Policy (Email Auth)Failed
Why it matters: Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems.
How to fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
Payment Page SecurityFailed
Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection
Why it matters: Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance.
How to fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
X-Powered-By HeaderWarning
Nuxt
Why it matters: "Nuxt" reveals your server technology and version. Attackers use this to find matching CVEs.
How to fix: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').
Inline JavaScript ExposureWarning
568 KB of inline JavaScript
Why it matters: Large amounts of inline JavaScript prevent proper CSP implementation and increase the risk of XSS. External scripts can be protected with SRI hashes.
How to fix: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
Cross-Origin IsolationWarning
Why it matters: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.
How to fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
CMS Version DisclosurePassed
No generator tag — CMS identity hidden
Sensitive Files ExposedPassed
.env, .git, composer.json — all properly blocked
Install Script ExposedPassed
No /install/ or /setup/ paths accessible
Directory ListingPassed
Disabled — file structure hidden
Admin Panel at Default URLPassed
Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
Debug Mode / Error ExposurePassed
No debug indicators found in page output
Bootstrap VersionPassed
Bootstrap 5.3.7
SPF Record (Email Security)Passed
SPF configured: v=spf1 include:zlatokov.onice.io ~all
DKIM Signing (Email Auth)Passed
DKIM configured (selectors: google)
Category 7 / 8 · zlatokov.sk · Zulien Score

Accessibility / EAA

16/100
Weight: — · 2 OK · 1 warnings · 5 failures · 9 total
Image Alt TextFailed
21 of 63 images have no alt attribute
Why it matters: Images without alt text are invisible to blind users and to Google Images. EN 301 549 § 9.1.1.1 (WCAG 1.1.1) requires a text alternative.
How to fix: Add descriptive alt text to every meaningful image; use alt="" for decorative ones.
Form LabelsFailed
3 of 3 form inputs have no associated label
Why it matters: Unlabelled fields leave screen-reader users guessing — search, newsletter and checkout forms become unusable. EN 301 549 § 9.1.3.1 / 9.4.1.2 (WCAG 1.3.1 / 4.1.2).
How to fix: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.
Heading StructureFailed
The page has no <h1> heading
Why it matters: Screen-reader users navigate by headings; a missing outline forces linear reading. EN 301 549 § 9.1.3.1 / 9.2.4.6 (WCAG 1.3.1 / 2.4.6).
How to fix: Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.
Landmark RegionsFailed
No <main> landmark region found
Why it matters: Landmarks let assistive-tech users jump straight to the main content and skip repeated navigation. EN 301 549 § 9.1.3.1 (WCAG 1.3.1).
How to fix: Wrap the primary content in <main> and use <nav>, <header>, <footer> for regions.
Zoom & ScalingFailed
The viewport meta tag disables pinch-zoom (user-scalable=no / maximum-scale=1)
Why it matters: Blocking zoom stops low-vision users from enlarging text on mobile — a direct EN 301 549 § 9.1.4.4 (WCAG 1.4.4) failure and a common EAA audit finding.
How to fix: Remove user-scalable=no and maximum-scale from the viewport tag: <meta name="viewport" content="width=device-width, initial-scale=1">.
Skip LinkWarning
No skip-to-content link detected
Why it matters: Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1).
How to fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
Page LanguagePassed
<html lang="sk"> is set
Link TextPassed
Links use descriptive text
EAA Legal BasisInfo
In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
Category 8 / 8 · zlatokov.sk · Zulien Score

Next steps

  1. Start with the failures — every red item carries a How to fix note. Prioritise Security and Legal & Compliance, which carry statutory consequences.
  2. Re-run the audit after fixing — run a fresh scan at score.zulien.sk and compare the score.
  3. Get help with the harder ones — for a deep audit or an expert assessment, see inger.sk.
  4. Track NIS2 and GDPR compliance — if your shop falls under NIS2 (turnover over €10M or more than 50 staff), you need a formal compliance framework.

Online report

The full interactive version, with clickable links and the option to re-scan, is here:

https://score.zulien.sk/r/zlatokov.sk

Disclaimer: This report is generated automatically by Zulien Score. Its findings come from publicly available data and technical analysis. For a legally binding assessment (of GDPR compliance, for instance) we recommend consulting a DPO or a lawyer specialising in data protection. Zulien Score is not a licensed legal or audit firm.
Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk