# lunys.sk — Zulien Score 68/100 (Grade C)

> Free e-commerce audit: 68/100 overall score. Platform: Magento. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://lunys.sk
- **Platform:** Magento
- **Scan date:** 2026-07-02
- **Full report:** https://score.zulien.sk/hu/r/lunys.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/lunys.sk

## Score by category

| Category | Score |
|---|---|
| Performance | 63/100 |
| SEO | 75/100 |
| Security | 78/100 |
| Mobile | 61/100 |
| AI Readiness | 56/100 |
| GDPR | 72/100 |
| Vulnerability | 65/100 |

## Detailed findings

### Performance — 63/100

- **[FAIL]** Total Blocking Time (TBT) — 2056ms (good: <200ms)
  - Fix: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.
  - Evidence: PSI-lab
- **[FAIL]** Total Page Weight — 4.1 MB, 123 requests — too heavy!
  - Fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Evidence: PSI-lab
- **[FAIL]** Unused Code (CSS + JS) — 1271 KB wasted on unused code!
  - Fix: You're loading 1271 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[FAIL]** Script Loading Strategy — Only 25% of 4 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.
  - Evidence: HTML-heuristic
- **[WARN]** Resource Hints (Preload/Preconnect)
  - Fix: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
  - Evidence: HTML-heuristic
- **[WARN]** Cache-Control Strategy — no-store, no-cache, must-revalidate
  - Fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
  - Evidence: HTTP-header
- **[WARN]** CSS File Count — 4 CSS files loaded
  - Fix: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 4 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 21ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.67s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 1.35s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.002 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 2.52s
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Lazy Loading — 3% of images use native lazy loading (10/306)
  - Evidence: HTML-heuristic

### SEO — 75/100

- **[FAIL]** H1 Heading
  - Fix: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
  - Evidence: HTML-heuristic
- **[FAIL]** Open Graph Image Format — og:image returned text/html
  - Fix: Make sure the og:image URL returns an image (Content-Type: image/png or image/jpeg). Common cause: returning HTML or JSON from a broken redirect.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Attributes — Only 29% of 306 images have alt text
  - Fix: 217 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — 0% next-gen formats — 0 JPEG, 22 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Evidence: HTML-heuristic
- **[WARN]** Semantic HTML Structure — Only 3/6 semantic elements — missing: <article>, <nav>, <aside>
  - Fix: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL Consistency — Canonical points to different URL: https://www.lunys.sk/
  - Fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Evidence: HTML-heuristic
- **[WARN]** Sitemap in robots.txt — robots.txt exists but doesn't reference your sitemap
  - Fix: Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.
  - Evidence: HTML-heuristic
- **[WARN]** Accessibility Fundamentals — 2/4 a11y signals — missing: ARIA labels, skip navigation link
  - Fix: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
  - Evidence: HTML-heuristic
- **[WARN]** Image Dimension Attributes — Only 14% of images have width/height attributes
  - Fix: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 4% ratio but 2719 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 38 chars — "Skratka k lepším potravinám \| LUNYS.sk"
  - Evidence: HTML-heuristic
- **[PASS]** Meta Description — 149 chars
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 4 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://www.lunys.sk/
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 3 block(s): WebSite, Organization, SearchAction
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 3 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with ~1+ URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk"
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — index, follow
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Content Depth — 2719 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 4, H3: 7 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 77 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Empty/Dead Links — 2 minor dead link(s) — acceptable
  - Evidence: HTML-heuristic

### Security — 78/100

- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** Cookie Security Flags — 4 cookie(s): 3 missing Secure, 3 missing HttpOnly, 4 missing SameSite
  - Fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Evidence: HTTP-header
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[WARN]** Iframe Sandboxing — 1/1 unknown iframe(s) without sandbox attribute
  - Fix: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
  - Evidence: DNS
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** HSTS (Strict-Transport-Security) — max-age=31536000, preload, includeSubDomains
  - Evidence: HTTP-header
- **[PASS]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN
  - Evidence: HTTP-header
- **[PASS]** X-Content-Type-Options — nosniff
  - Evidence: HTTP-header
- **[PASS]** Referrer-Policy — strict-origin-when-cross-origin
  - Evidence: HTTP-header
- **[PASS]** Permissions-Policy — microphone=(self), camera=(self)
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: nginx (no version)
  - Evidence: HTTP-header
- **[PASS]** Subresource Integrity (SRI) — All cross-origin scripts are auto-updating provider scripts where SRI does not apply
  - Evidence: HTML-heuristic
- **[PASS]** Server Version Disclosure — Nginx — version hidden
  - Evidence: HTTP-header
- **[PASS]** Password Field Security — 1 password field(s) — allow password manager autofill
  - Evidence: HTTP-header

### Mobile — 61/100

- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Iba 10/45 inputs má label (22%)
  - Fix: 35 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
  - Evidence: HTML-heuristic
- **[WARN]** Viewport Configuration — Present, but maximum-scale=1 disables pinch-to-zoom
  - Fix: Remove 'maximum-scale=1' and 'user-scalable=no' from your viewport meta tag. Use: <meta name='viewport' content='width=device-width, initial-scale=1'>
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Performance Score — 60/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: HTML-heuristic
- **[WARN]** Font Size Readability
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: HTML-heuristic
- **[WARN]** PWA Features — Has manifest, missing service worker
  - Fix: Add a service worker to enable PWA features. Register a service worker for offline caching and faster repeat visits.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Navigation (Semantic)
  - Fix: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').
  - Evidence: HTML-heuristic
- **[WARN]** Apple Mobile Web App — Web manifest found but no Apple-specific meta tags
  - Fix: iOS Safari doesn't fully support web manifests. Add Apple-specific meta tags for the best iOS experience: apple-mobile-web-app-capable, apple-touch-icon, and status-bar-style.
  - Evidence: HTML-heuristic
- **[WARN]** Form Input Types — phone fields use type='text' instead of type='tel'
  - Fix: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Sticky CTA — Add-to-cart button found but no sticky/fixed positioning detected
  - Fix: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.
  - Evidence: HTML-heuristic
- **[WARN]** Text Overflow Handling — No word-break/overflow-wrap CSS detected
  - Fix: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
  - Evidence: HTML-heuristic
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Evidence: HTML-heuristic
- **[WARN]** Express Checkout (Apple Pay + Google Pay) — Iba Apple Pay detekovaný — chýba Google Pay
  - Fix: Pridaj Google Pay cez Stripe, Adyen alebo Mollie. Mobile conversion rate rastie o 10-20 % keď je express checkout dostupný.
  - Evidence: HTML-heuristic
- **[WARN]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h2→h4
  - Fix: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
  - Evidence: HTML-heuristic
- **[INFO]** SK/CZ Local Payment Methods — Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Images (srcset) — 42 image(s) use srcset for responsive sizing
  - Evidence: HTML-heuristic
- **[PASS]** Payment Methods Detected — 1 method(s): Apple Pay
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Evidence: HTML-heuristic

### AI Readiness — 56/100

- **[FAIL]** llms.txt (AI Site Descriptor)
  - Fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
  - Evidence: file-probe
- **[FAIL]** Heading Hierarchy for AI — 0 H1, 4 H2, 7 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 11% quality alt text — 217 missing, 54 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** llms-full.txt (Complete AI Content)
  - Fix: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
  - Evidence: file-probe
- **[WARN]** Structured Data Foundation — 3 schema types found (WebSite, Organization, SearchAction) — add more for comprehensive AI coverage
  - Fix: Expand your structured data: add Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage schemas. Sites with 4+ schema types are 36% more likely to appear in AI search summaries.
  - Evidence: schema
- **[WARN]** Organization Schema + Entity Linking — Organization schema found but no sameAs links
  - Fix: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.
  - Evidence: schema
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Breadcrumb Schema
  - Fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
  - Evidence: schema
- **[WARN]** Semantic HTML Structure — 3/6 elements — missing: <article>, <nav>, <aside>
  - Fix: Add: <article>, <nav>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — No structured content elements found
  - Fix: Add bulleted lists for features/benefits, numbered lists for steps/rankings, and tables for comparisons/specifications. These are the content formats AI extracts most reliably.
  - Evidence: HTML-heuristic
- **[WARN]** Entity Clarity & Brand Signals — OG tags complete but no sameAs entity links
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** AI Plugin Manifest
  - Fix: Create /.well-known/ai-plugin.json if you have an API. This enables direct AI agent integration (ChatGPT Actions, custom GPTs). Include: name_for_model, description_for_model, auth config, and link to OpenAPI spec.
  - Evidence: file-probe
- **[WARN]** Product Feed (AI Commerce)
  - Fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
  - Evidence: file-probe · probed /feed/products.xml, /google-shopping.xml, /export/google-shopping.xml — none returned a product feed
- **[WARN]** Heureka XML Feed
  - Fix: Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).
  - Evidence: file-probe
- **[WARN]** Speakable Content (Voice AI)
  - Fix: Add SpeakableSpecification schema to identify content sections suitable for voice assistants (Google Assistant, Alexa, Siri). Mark your product summaries and FAQs as speakable.
  - Evidence: HTML-heuristic
- **[WARN]** Extractable Answer Blocks — 5 paragraphs, avg 151 words — too long for AI snippets
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 203 words — only 0% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.lunys.sk/
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Evidence: HTML-heuristic
- **[WARN]** Return Policy Schema
  - Fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
  - Evidence: schema
- **[WARN]** Shipping Details Schema
  - Fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
  - Evidence: schema
- **[WARN]** Knowledge Graph Readiness — 2/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn)
  - Fix: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 20 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** ai.txt (AI Permissions)
  - Fix: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
  - Evidence: file-probe
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Content-to-Boilerplate Ratio — 38% in main content area — too much boilerplate
  - Fix: Move more content into <main> or <article> elements. Reduce navigation text, footer content, and sidebar noise. AI crawlers extract content from semantic containers and discard the rest.
  - Evidence: HTML-heuristic
- **[WARN]** Customer Reviews — Aggregate — 1 source: Heureka Ověřeno
  - Fix: Single review source detected without published reviewCount. Add AggregateRating JSON-LD (ratingValue + reviewCount + bestRating) so the count is machine-readable, and add a second source (Heureka Ověřeno + Trustpilot is the SK/CZ standard).
  - Evidence: HTML-heuristic
- **[INFO]** Product Schema Completeness — No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit
  - Evidence: schema
- **[INFO]** Reviews & Ratings Schema — No review schema on this homepage — review/rating schema typically lives on product pages
  - Evidence: schema
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 2719 words in raw HTML (3.8% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Evidence: schema
- **[PASS]** Content Depth for AI — 2719 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 722 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Statistics & Data Presence — 30 data points found — strong citation magnet
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 28 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Heureka Ověřeno Widget — Heureka trust widget detected
  - Evidence: HTML-heuristic

### GDPR — 72/100

- **[FAIL]** Google Consent Mode v2
  - Fix: Implement Google Consent Mode v2 with gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied' }). Required since March 2024 for EU audiences.
  - Evidence: HTML-heuristic
- **[FAIL]** Consumer Dispute Resolution Links — No EU ODR platform or supervisory-authority link found
  - Fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Personal Data Exposure in Source — 2 personal email(s) in page source: zakaznik@lunys.sk, objednavkypp@lunys.sk
  - Fix: Remove person-named email addresses (e.g. firstname.lastname@) from the public HTML. Use role mailboxes (info@, sales@) or a contact form instead.
  - Evidence: HTML-heuristic · zakaznik@lunys.sk, objednavkypp@lunys.sk · confidence: low
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Age Verification — Age-restricted content detected without age gate
  - Fix: Implement age verification for alcohol, tobacco, gambling, or adult content. Use a date-of-birth check or age confirmation modal before accessing the site.
  - Evidence: HTML-heuristic
- **[WARN]** Omnibus Price Disclosure (30-day low) — Discounts shown without a visible 'lowest price in last 30 days' reference
  - Fix: Whenever you advertise a price reduction, display the lowest price applied in the 30 days before the discount, next to the new price. In PrestaShop add a 30-day price-history anchor (e.g. our zu_pricehistory module) so every sale label is compliant automatically.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** Withdrawal & Complaints Policy — Missing: right of withdrawal (odstúpenie od zmluvy)
  - Fix: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.
  - Evidence: HTML-heuristic
- **[PASS]** Cookie Consent Banner (CMP) — Cookiebot detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — 2 tracker(s) detected with CMP: Google Analytics/GTM, Hotjar
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — /ochrana-sukromia
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — https://www.lunys.sk/o-nas
  - Evidence: HTML-heuristic
- **[PASS]** Terms & Conditions Page — https://www.lunys.sk/vseobecne-obchodne-podmienky-a27
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 1 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic

### Vulnerability — 65/100

- **[FAIL]** Admin Panel at Default URL — Accessible at: /admin
  - Fix: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).
  - Evidence: file-probe
- **[FAIL]** Payment Page Security — Payment page missing: No CSP
  - Fix: CRITICAL: Your payment page is missing security headers: No CSP. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Evidence: file-probe
- **[WARN]** Form CSRF Protection — 31/32 forms have CSRF tokens
  - Fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** Inline JavaScript Exposure — 52 KB of inline JavaScript
  - Fix: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
  - Evidence: DNS
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[WARN]** Inline Event Handlers — 28 inline event handlers (onclick, onmouseover, etc.)
  - Fix: Move inline event handlers to external JavaScript files using addEventListener(). Inline handlers prevent proper CSP implementation (require 'unsafe-inline') and increase XSS attack surface.
  - Evidence: HTML-heuristic
- **[WARN]** Login Form Security — Login form blocks password manager autofill
  - Fix: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
  - Evidence: file-probe
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 ip4:185.59.208.196 ip4:5.178.48.82 ip4:213.151.240.75 ip4:185.25.248.40 i
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: k2, selector1, mail)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/hu/r/lunys.sk)
