# muziker.sk — Zulien Score 67/100 (Grade C)

> Free e-commerce audit: 67/100 overall score. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://www.muziker.sk
- **Scan date:** 2026-06-07
- **Full report:** https://score.zulien.sk/hu/r/muziker.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/muziker.sk

## Score by category

| Category | Score |
|---|---|
| Performance | 65/100 |
| SEO | 79/100 |
| Security | 55/100 |
| Mobile | 70/100 |
| AI Readiness | 55/100 |
| GDPR | 67/100 |
| Vulnerability | 71/100 |

## Detailed findings

### Performance — 65/100

- **[FAIL]** Total Blocking Time (TBT) — 652ms (good: <200ms)
  - Fix: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.
- **[FAIL]** Cumulative Layout Shift (CLS) — 0.271 (good: <0.1) — Core Web Vital FAILING
  - Fix: Urgent layout stability issues. 1) Add width/height to all <img> and <video>, 2) Reserve space for ads with min-height, 3) Use font-display: swap for web fonts, 4) Don't dynamically inject content above visible area.
- **[FAIL]** Unused Code (CSS + JS) — 746 KB wasted on unused code!
  - Fix: You're loading ${unusedTotalKB} KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
- **[WARN]** Total Page Weight — 2.6 MB, 162 requests (optimal: <1.5 MB, <50 req)
  - Fix: Reduce page weight: compress images to WebP (saves 30-50%), enable text compression (gzip/brotli), lazy load below-fold images, remove unused CSS/JS.
- **[WARN]** Cache-Control Strategy — no-store
  - Fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
- **[PASS]** Server Response Time (TTFB) — 49ms
- **[PASS]** First Contentful Paint (FCP) — 0.65s
- **[PASS]** Largest Contentful Paint (LCP) — 1.25s — Core Web Vital ✓
- **[PASS]** Speed Index — 1.43s
- **[PASS]** Render-blocking Resources — No render-blocking resources found
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
- **[PASS]** Resource Hints (Preload/Preconnect) — 1 preload, 0 preconnect hint(s)
- **[PASS]** Lazy Loading — 69% of images use native lazy loading (126/183)
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
- **[PASS]** Script Loading Strategy — 91% of scripts use async/defer/module (0 async, 10 defer, 0 module)
- **[PASS]** CSS File Count — 1 CSS file(s) — well consolidated
- **[PASS]** Critical CSS Strategy — Critical CSS / async CSS loading detected

### SEO — 79/100

- **[FAIL]** H1 Heading
  - Fix: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
- **[WARN]** Meta Title — 24 chars (optimal: 30-60)
  - Fix: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.
- **[WARN]** Canonical URL — og:url present (https://www.muziker.sk/) but <link rel=canonical> missing
  - Fix: Add <link rel='canonical' href='https://www.muziker.sk/'> to <head>. og:url covers social sharing; canonical covers Google + AI crawlers explicitly.
- **[WARN]** Image Alt Attributes — Only 58% of 183 images have alt text
  - Fix: 77 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
- **[WARN]** Text-to-HTML Ratio — 5% — low content density (4411 words)
  - Fix: Add more unique text content. Write detailed product descriptions, buying guides, and FAQ sections.
- **[WARN]** Image Format Optimization — 0% next-gen formats — 59 JPEG, 27 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
- **[WARN]** Color Contrast Signal — 15 very light text colors found — potential contrast issues
  - Fix: Ensure text has minimum 4.5:1 contrast ratio against background (WCAG AA). Use tools like WebAIM Contrast Checker. Light gray text on white is the most common violation.
- **[PASS]** Meta Description — 147 chars
- **[PASS]** Content Structure (H2 Headings) — 37 H2 subheadings found
- **[PASS]** Open Graph Tags — og:description, og:image, og:type
- **[PASS]** Open Graph Image Format — image/png
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
- **[PASS]** Structured Data (JSON-LD) — 1 block(s): Organization, PostalAddress, ImageObject, WebSite
- **[PASS]** robots.txt — Present, references sitemap
- **[PASS]** XML Sitemap — Found with ~9+ URLs
- **[PASS]** HTML Language Attribute — lang="sk-SK"
- **[PASS]** Hreflang Tags (Multilingual) — 36 language(s): en-AL, de-AT, sr-BA, nl-BE, bg
- **[PASS]** Favicon — Favicon detected
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
- **[PASS]** Content Depth — 4411 words — sufficient content
- **[PASS]** Deep Heading Hierarchy — H2: 37, H3: 3 — well-structured content
- **[PASS]** Internal Linking — 100 internal links — strong site navigation
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 2823 ARIA roles, 474 ARIA labels, lang="sk-SK"

### Security — 55/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
- **[WARN]** Subresource Integrity (SRI) — Only 1/12 external scripts have integrity hashes
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' attributes to all third-party <script> tags. Use srihash.org to generate hashes.
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
- **[WARN]** Iframe Sandboxing — 1/1 iframe(s) without sandbox attribute
  - Fix: Add sandbox attribute to all <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. This restricts iframe capabilities to only what's needed.
- **[WARN]** Password Field Security — 1 password field(s) block autocomplete
  - Fix: Remove autocomplete='off' from password fields. Password managers improve security by enabling unique, strong passwords. Blocking them encourages password reuse.
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
- **[PASS]** Cookie Security Flags — No cookies set on initial response
- **[PASS]** Technology Disclosure — Server: cloudflare (no version)
- **[PASS]** CDN / WAF Protection — Cloudflare detected — DDoS protection and edge caching active

### Mobile — 70/100

- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Iba 3/12 inputs má label (25%)
  - Fix: 9 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
- **[WARN]** Mobile Performance Score — 68/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.
- **[WARN]** Touch Target Size
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
- **[WARN]** Font Size Readability
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
- **[WARN]** Apple Mobile Web App — Missing: apple-mobile-web-app-capable, status-bar-style
  - Fix: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
- **[WARN]** Form Input Types — phone fields use type='text' instead of type='tel'
  - Fix: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
- **[WARN]** Fixed Width Elements — Large fixed-width elements detected — may cause horizontal scroll
  - Fix: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
- **[WARN]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h3→h6
  - Fix: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
- **[PASS]** Responsive Design Techniques — Media queries detected
- **[PASS]** Theme Color — theme-color meta tag present
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
- **[PASS]** Responsive Images (srcset) — 111 image(s) use srcset for responsive sizing
- **[PASS]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text

### AI Readiness — 55/100

- **[FAIL]** llms.txt (AI Site Descriptor)
  - Fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
- **[FAIL]** Content Accessibility for AI — Only 4411 words visible in HTML — content may be JS-dependent
  - Fix: Your page has very little content in the HTML source. If you're using a JavaScript framework (React, Vue, Angular), implement Server-Side Rendering (SSR) or Static Site Generation (SSG).
- **[FAIL]** Heading Hierarchy for AI — 0 H1, 37 H2, 3 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
- **[FAIL]** Canonical Tag for AI Deduplication
  - Fix: Add <link rel='canonical' href='https://your-absolute-url'> to every page. This tells AI engines which URL is the authoritative version of this content.
- **[FAIL]** Image Alt Text Quality for AI — Only 5% quality alt text — 77 missing, 97 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
- **[FAIL]** Content-to-Boilerplate Ratio — Only 10% in main content — mostly boilerplate
  - Fix: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
- **[WARN]** llms-full.txt (Complete AI Content)
  - Fix: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
- **[WARN]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
- **[WARN]** Structured Content (Lists & Tables) — 158 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.
- **[WARN]** Entity Clarity & Brand Signals — 7 sameAs links but incomplete OG tags
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
- **[WARN]** Extractable Answer Blocks — 7 paragraphs, avg 14 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
- **[WARN]** Content Readability for AI — Grade 20 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
- **[WARN]** ai.txt (AI Permissions)
  - Fix: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
- **[WARN]** Customer Reviews — Aggregate — 1 source: Heureka Ověřeno
  - Fix: Single review source detected without published reviewCount. Add AggregateRating JSON-LD (ratingValue + reviewCount + bestRating) so the count is machine-readable, and add a second source (Heureka Ověřeno + Trustpilot is the SK/CZ standard).
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
- **[PASS]** Structured Data Foundation — 1 JSON-LD blocks with 6 schema types: Organization, PostalAddress, ImageObject, WebSite, SearchAction, EntryPoint
- **[PASS]** Organization Schema + Entity Linking — Organization found with 7 sameAs links — strong entity identity
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
- **[PASS]** Content Depth for AI — 4411 words — rich content for AI analysis and citation
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
- **[PASS]** Statistics & Data Presence — 6 data points found — strong citation magnet
- **[PASS]** Internal Link Density — 23 contextual internal links per 1,000 words — strong knowledge graph signal
- **[PASS]** Knowledge Graph Readiness — 3/4 entity signals — strong Knowledge Graph presence
- **[PASS]** Heureka Ověřeno Widget — Heureka trust widget detected

### GDPR — 67/100

- **[FAIL]** Cookie Consent Banner (CMP)
  - Fix: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
- **[WARN]** Personal Data Exposure in Source — 1 email(s) found in page source: meno@domena.sk
  - Fix: Remove plain-text email addresses from HTML source. Use contact forms instead, or obfuscate emails with JavaScript encoding.
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
- **[WARN]** Newsletter Consent — Newsletter signup found without visible consent checkbox
  - Fix: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.
- **[WARN]** Withdrawal of Consent Mechanism
  - Fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
- **[PASS]** Tracking Scripts & Consent — No tracking scripts detected
- **[PASS]** Privacy Policy Page — /ochrana-osobnych-udajov
- **[PASS]** Legal Contact / Imprint Page — /o-nas
- **[PASS]** Terms & Conditions Page — /vseobecne-obchodne-podmienky
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
- **[PASS]** Third-party Data Sharing — 2 third-party domain(s)
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found

### Vulnerability — 71/100

- **[FAIL]** Suspicious Inline Script Patterns — Detected: Dynamic script injection
  - Fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
- **[FAIL]** Clickjacking on Sensitive Page — Login/payment page without X-Frame-Options or CSP frame-ancestors
  - Fix: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
- **[WARN]** Form CSRF Protection — 4/5 forms have CSRF tokens
  - Fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
- **[WARN]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
- **[WARN]** Login Form Security — Login form blocks password manager autofill
  - Fix: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
- **[PASS]** Directory Listing — Disabled — file structure hidden
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 ip4:185.2.43.107 ip4:185.115.1.85 ip4:185.115.1.84 ip4:185.115.1.94 inclu
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: selector1)

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/hu/r/muziker.sk)
