# luigisbox.sk — Zulien Score 78/100 (Grade B)

> Free e-commerce audit: 78/100 overall score. Platform: WordPress. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://luigisbox.sk
- **Platform:** WordPress
- **Scan date:** 2026-10-08
- **Full report:** https://score.zulien.sk/hu/r/luigisbox.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/luigisbox.sk

## Audit summary

Your site is reasonably optimized but has critical security gaps. Enable HSTS protection in WordPress settings immediately to secure data transmission. Your SEO and GDPR compliance are solid strengths.

## Score by category

| Category | Score |
|---|---|
| Performance | 91/100 |
| SEO | 88/100 |
| Security | 55/100 |
| Mobile | 85/100 |
| AI Readiness | 80/100 |
| GDPR | 81/100 |
| Vulnerability | 57/100 |
| Accessibility | 66/100 |

## Detailed findings

### Performance — 91/100

- **[WARN]** Speed Index — 4.81s (good: <3.4s)
  - Fix: Speed Index measures visual completeness over time. Improve it by: prioritizing above-fold content, preloading critical resources, and minimizing render-blocking assets.
  - Evidence: PSI-lab
- **[WARN]** Unused Code (CSS + JS) — 51 KB unused (CSS: 18 KB, JS: 33 KB)
  - Fix: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
  - Evidence: PSI-lab
- **[WARN]** Resource Hints (Preload/Preconnect)
  - Fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
  - Evidence: HTML-heuristic
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 41ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.65s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 0.81s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 40ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.001 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Page Weight — 669 KB (56 requests)
  - Evidence: PSI-lab
- **[PASS]** JavaScript Budget — 130 KB — within the 600 KB budget
  - Evidence: PSI-lab · 130 KB JavaScript · confidence: high
- **[PASS]** Request Budget — 56 requests — within the budget of 80
  - Evidence: PSI-lab · 56 requests · confidence: high
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Lazy Loading — 5% of images use native lazy loading (23/425)
  - Evidence: HTML-heuristic
- **[PASS]** Font Loading Strategy — font-display: swap
  - Evidence: HTML-heuristic
- **[PASS]** Cache-Control Strategy — max-age=86400
  - Evidence: HTTP-header
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header
- **[PASS]** Script Loading Strategy — 85% of scripts use async/defer/module (3 async, 14 defer, 0 module)
  - Evidence: HTML-heuristic

### SEO — 88/100

- **[WARN]** Meta Title — 70 chars (optimal: 30-60)
  - Fix: Shorten your title to under 60 characters. Google truncates longer titles with '…', which cuts off your message.
  - Evidence: HTML-heuristic
- **[WARN]** XML Sitemap — Could not be retrieved in time — not verified
  - Fix: Check /sitemap.xml yourself. If it is generated on every request, cache it to a static file: a sitemap that takes seconds to build is also slow for Googlebot, which fetches it regularly.
  - Evidence: file-probe
- **[WARN]** Image Format Optimization — Only 10% next-gen formats — 2 legacy images remain
  - Fix: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL Consistency — Canonical points to different URL: https://www.luigisbox.sk/
  - Fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Evidence: HTML-heuristic
- **[WARN]** Empty/Dead Links — 10 dead links (0 empty, 10 hash-only, 0 javascript:void)
  - Fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Evidence: HTML-heuristic
- **[WARN]** Sitemap Host Consistency — robots.txt Sitemap points to www.luigisbox.com (page is luigisbox.sk)
  - Fix: Update the Sitemap: line in robots.txt to your canonical host. A staging/dev hostname (new., staging., dev.) leaks pre-production to Google and feeds crawlers URLs that 404 or duplicate the live site.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 2% ratio but 1801 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Description — 137 chars
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "Pre výnimočné vyhľadávanie a odporúčanie produktov"
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 9 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Image Format — image/webp
  - Evidence: HTML-heuristic
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://www.luigisbox.sk/
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 3 block(s): Place, PostalAddress, Organization, ImageObject
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 3 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Hreflang Tags (Multilingual) — 10 language(s): en, sk, cs, pl, de
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 100% of 425 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — follow, index, max-snippet:-1, max-video-preview:-1, max-image-preview:large
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth — 1801 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 9, H3: 34 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 20 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 1 ARIA roles, 9 ARIA labels, lang="sk-SK"
  - Evidence: HTML-heuristic

### Security — 55/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Evidence: HTTP-header
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Subresource Integrity (SRI) — Only 0/2 SRI-eligible third-party scripts have integrity hashes
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Evidence: HTML-heuristic
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** Iframe Sandboxing — 1/1 unknown iframe(s) without sandbox attribute
  - Fix: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** Cookie Security Flags — 1 cookie(s) — all have Secure, HttpOnly, SameSite
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: cloudflare (no version)
  - Evidence: HTTP-header
- **[PASS]** CDN / WAF Protection — Cloudflare detected — DDoS protection and edge caching active
  - Evidence: HTTP-header

### Mobile — 85/100

- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Only 0/7 inputs have a label (0%)
  - Fix: 7 input elements have no label. Every input needs a matching <label for="id">Text</label> or an aria-label. A placeholder is NOT a label (WCAG 3.3.2). On a checkout or registration form this costs conversion and breaches EN 301 549 (EAA 2026).
  - Evidence: HTML-heuristic
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Inline CSS Size — 340 KB of inline CSS
  - Fix: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
  - Evidence: HTML-heuristic
- **[WARN]** Link Text Quality (WCAG 2.4.4) — 1 links have generic text ("click here", "more", "here"...)
  - Fix: Replace 'Click here' and 'Read more' with descriptive text: 'Read more about GDPR', 'See module pricing'. Screen readers read links out of context, so a bare 'more' carries no meaning.
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Performance Score — 90/100 — excellent
  - Evidence: PSI-lab
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Images (srcset) — 48 image(s) use srcset for responsive sizing
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Types — Optimized: 1 email
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy (WCAG 1.3.1) — No skipped heading levels
  - Evidence: HTML-heuristic

### AI Readiness — 80/100

- **[FAIL]** Image Alt Text Quality for AI — Only 24% quality alt text — 1 missing, 207 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** AI Bot Access Policy — Minor bots blocked: Bytespider, PetalBot
  - Fix: You're blocking some AI crawlers (Bytespider, PetalBot). While not critical, these bots feed training data for AI models that may recommend your products.
  - Evidence: file-probe
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Breadcrumb Schema
  - Fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
  - Evidence: schema
- **[WARN]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — 33 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Freshness Signals — Schema dates found but no visible date on page
  - Fix: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 33 words — only 5% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.luigisbox.sk/
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 19 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Valid llms.txt with 4000 chars — proper format with H1, links, summary
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** Speakable Content (Voice AI) — Not present — optional; SpeakableSpecification has limited assistant adoption
  - Evidence: HTML-heuristic
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[PASS]** AI agent access (live) — ChatGPT-User and PerplexityBot get the same page as a browser
  - Evidence: file-probe · ChatGPT-User, PerplexityBot: same page as a browser · https://luigisbox.sk
- **[PASS]** Content Accessibility for AI — 1801 words in raw HTML (2.0% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data Foundation — 3 JSON-LD blocks with 9 distinct schema types: Place, BusinessEntity, WebSite, ImageObject, WebPage, Person
  - Evidence: schema
- **[PASS]** Organization Schema + Entity Linking — Organization found with 4 sameAs links — strong entity identity
  - Evidence: schema
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Evidence: schema
- **[PASS]** Content Depth for AI — 1801 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy for AI — Proper structure: 1 H1 → 9 H2s → 34 H3s — clear content outline
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Entity Clarity & Brand Signals — OG tags complete + 4 sameAs links: Facebook, X/Twitter, LinkedIn, YouTube
  - Evidence: HTML-heuristic
- **[PASS]** Author Expertise Signals (E-E-A-T) — Article schema with Person/author — strong expertise signal for AI
  - Evidence: HTML-heuristic
- **[PASS]** Reviews & Ratings Schema — AggregateRating/Review data found — social proof for AI
  - Evidence: schema
- **[PASS]** Extractable Answer Blocks — 47 paragraphs, avg 59 words — optimal for AI extraction
  - Evidence: HTML-heuristic
- **[PASS]** Statistics & Data Presence — 10 data points found — strong citation magnet
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 11 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Knowledge Graph Readiness — 3/4 entity signals — strong Knowledge Graph presence
  - Evidence: HTML-heuristic
- **[PASS]** Content-to-Boilerplate Ratio — 62% of text in <main>/<article> — clean content signal
  - Evidence: HTML-heuristic
- **[PASS]** AggregateRating Schema — Review aggregate rating schema present
  - Evidence: schema
- **[PASS]** Customer Reviews — Aggregate — 1 source: AggregateRating schema — ★ 4.8 · 435 reviews
  - Evidence: HTML-heuristic

### GDPR — 81/100

- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** International Data Transfers — 2 US-based tracker(s) without consent: Google Analytics/GTM, Microsoft Clarity
  - Fix: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Newsletter Consent — Newsletter signup found without visible consent checkbox
  - Fix: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.
  - Evidence: HTML-heuristic
- **[INFO]** Cookie Consent Banner (CMP) — No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)
  - Evidence: HTML-heuristic · 1 GTM container(s) detected · confidence: low
- **[INFO]** Tracking Scripts & Consent — 2 tracker(s) detected (Google Analytics/GTM, Microsoft Clarity); no CMP visible in server HTML but GTM is present
  - Evidence: HTML-heuristic · 1 GTM container(s) detected · confidence: low
- **[PASS]** Google Consent Mode v2 — Consent mode signals detected (ad_storage, analytics_storage)
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — https://www.luigisbox.sk/zasady-ochrany-osobnych-udajov/
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — https://www.luigisbox.sk/o-nas/
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 2 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic

### Vulnerability — 57/100

- **[FAIL]** Form CSRF Protection — 2 form(s) without CSRF tokens
  - Fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Evidence: HTML-heuristic · confidence: low
- **[FAIL]** Suspicious Inline Script Patterns — Detected: new Function() with decoding
  - Fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
  - Evidence: file-probe
- **[FAIL]** SPF Record (Email Security)
  - Fix: Add an SPF TXT record to your DNS: v=spf1 include:_spf.google.com ~all (adjust for your email provider). This tells receiving servers which IPs can send email for your domain.
  - Evidence: DNS
- **[FAIL]** DMARC Policy (Email Auth)
  - Fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
  - Evidence: DNS
- **[FAIL]** Payment Page Security — Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection
  - Fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Evidence: file-probe
- **[WARN]** Directory listing — Could not verify — /wp-includes/, /wp-content/uploads/ did not answer
  - Fix: Open the listed paths in a browser: an 'Index of /…' page means listing is on — disable it with 'Options -Indexes' (Apache) or 'autoindex off;' (Nginx). A 403 or 404 is fine.
  - Evidence: file-probe · /wp-includes/ (HTTP 0) · confidence: low
- **[WARN]** CORS Configuration — Access-Control-Allow-Origin: * (allows any domain)
  - Fix: Replace the wildcard CORS header with specific allowed origins. Avoid Access-Control-Allow-Origin: * on pages with authentication or sensitive data.
  - Evidence: file-probe
- **[WARN]** Inline JavaScript Exposure — 57 KB of inline JavaScript
  - Fix: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** DKIM Signing (Email Auth)
  - Fix: Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.
  - Evidence: file-probe
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[WARN]** Mixed Content Resources — 1 HTTP resource(s) on HTTPS page
  - Fix: Replace HTTP URLs with HTTPS: http://app.luigisbox.com
  - Evidence: file-probe
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Accessibility — 66/100

- **[FAIL]** Form Labels — 7 of 7 form inputs have no associated label
  - Fix: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.
  - Evidence: HTML-heuristic
- **[WARN]** Image Alt Text — 1 of 425 images missing alt text
  - Fix: Add alt text to the remaining images (alt="" for decorative ones).
  - Evidence: HTML-heuristic
- **[WARN]** Skip Link — No skip-to-content link detected
  - Fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="sk-SK"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Heading Structure — Single <h1> with a consistent heading outline
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Evidence: HTML-heuristic
- **[PASS]** Zoom & Scaling — Pinch-zoom is not disabled
  - Evidence: HTML-heuristic

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/hu/r/luigisbox.sk)