# zlatokov.sk — Zulien Score 64/100 (Grade C)

> Free e-commerce audit: 64/100 overall score. Platform: Sellio. Company: ZLATOKOV SK, a.s.. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://zlatokov.sk
- **Platform:** Sellio
- **Company:** ZLATOKOV SK, a.s.
- **Scan date:** 2026-08-10
- **Full report:** https://score.zulien.sk/hu/r/zlatokov.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/zlatokov.sk

## Audit summary

Your site has fundamental security gaps and poor accessibility. Immediately add security headers (HSTS, CSP) to protect visitors. On the bright side, your GDPR compliance is solid.

## Score by category

| Category | Score |
|---|---|
| Performance | 81/100 |
| SEO | 73/100 |
| Security | 50/100 |
| Mobile | 60/100 |
| AI Readiness | 51/100 |
| GDPR | 75/100 |
| Vulnerability | 73/100 |
| Accessibility | 16/100 |

## Detailed findings

### Performance — 81/100

- **[FAIL]** Total Page Weight — 5.2 MB, 145 requests — too heavy!
  - Fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Evidence: PSI-lab
- **[FAIL]** Request Budget — 145 requests — well past both the 80 budget and the cohort median of 140
  - Fix: Start with what loads before first paint: bundle the CSS/JS, sprite the icons, lazy-load every below-fold image, and remove duplicate tag-manager containers loading the same vendor twice.
  - Evidence: PSI-lab · 145 requests · confidence: high
- **[FAIL]** Unused Code (CSS + JS) — 373 KB wasted on unused code!
  - Fix: You're loading 373 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[WARN]** JavaScript Budget — 674 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked
  - Fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
  - Evidence: PSI-lab · 674 KB JavaScript · confidence: high
- **[WARN]** Lazy Loading — 63 images without lazy loading
  - Fix: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
  - Evidence: HTML-heuristic
- **[WARN]** CSS File Count — 7 CSS files loaded — HTTP/2+/3 multiplexing reduces the per-file connection cost
  - Fix: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 7 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[WARN]** Inline JavaScript Size — 568 KB of inline JavaScript
  - Fix: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
  - Evidence: PSI-lab
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Cache-Control Strategy — Not measured — no Cache-Control on the HTML document; static-asset caching was not sampled
  - Evidence: HTTP-header
- **[PASS]** Server Response Time (TTFB) — 40ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 1.32s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 2.48s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 19ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.004 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 1.47s
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 9 preload, 0 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header
- **[PASS]** Script Loading Strategy — 100% of scripts use async/defer/module (1 async, 0 defer, 1 module)
  - Evidence: HTML-heuristic
- **[PASS]** Font Preloading — 6 font(s) preloaded — faster text rendering
  - Evidence: HTML-heuristic

### SEO — 73/100

- **[FAIL]** H1 Heading
  - Fix: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
  - Evidence: HTML-heuristic
- **[FAIL]** Open Graph Tags
  - Fix: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
  - Evidence: HTML-heuristic
- **[WARN]** Meta Description — 227 chars (optimal: 120-160)
  - Fix: Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.
  - Evidence: HTML-heuristic
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Evidence: HTML-heuristic
- **[WARN]** Image Alt Attributes — Only 67% of 63 images have alt text
  - Fix: 21 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — Only 48% next-gen formats — 0 legacy images remain
  - Fix: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.
  - Evidence: HTML-heuristic
- **[WARN]** Semantic HTML Structure — Only 3/6 semantic elements — missing: <article>, <main>, <aside>
  - Fix: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
  - Evidence: HTML-heuristic
- **[WARN]** Sitemap in robots.txt — robots.txt exists but doesn't reference your sitemap
  - Fix: Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.
  - Evidence: HTML-heuristic
- **[WARN]** Accessibility Fundamentals — 2/4 a11y signals — missing: ARIA labels, skip navigation link
  - Fix: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
  - Evidence: HTML-heuristic
- **[WARN]** Product Schema Richness — Missing recommended: aggregateRating, review, gtin
  - Fix: Add aggregateRating, review, gtin to your Product schema. These fields enable rich snippets with star ratings, price, availability, and brand in search results.
  - Evidence: schema · https://zlatokov.sk/produkty/zlaty-prsten-flowers-i · confidence: medium
- **[WARN]** Image Dimension Attributes — Only 35% of images have width/height attributes
  - Fix: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 1% ratio but 744 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 57 chars — "Zlaté šperky s dušou: Ručne vyrobené príbehy od roku 19…"
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 9 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://zlatokov.sk
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 1 block(s): Store, ImageObject
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 1 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with at least 897 URLs (only the start was read)
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk"
  - Evidence: HTML-heuristic
- **[PASS]** Hreflang Tags (Multilingual) — 2 language(s): sk-SK, x-default
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — index, follow
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Content Depth — 744 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 9, H3: 19 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 43 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 0 day(s) ago
  - Evidence: HTML-heuristic

### Security — 50/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Evidence: HTTP-header
- **[WARN]** DNSSEC — No DNSKEY records — zone is unsigned
  - Fix: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Evidence: DNS
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Cookie Security Flags — 1 cookie(s): 1 missing Secure, 1 missing HttpOnly, 1 missing SameSite
  - Fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Evidence: HTTP-header
- **[WARN]** Technology Disclosure — X-Powered-By: Nuxt
  - Fix: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Evidence: HTTP-header
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[WARN]** Cookie Prefix Security — 1 session cookie(s) without __Secure- or __Host- prefix
  - Fix: Use __Host- prefix for session cookies: __Host-session=abc; Secure; Path=/; HttpOnly. The prefix enforces Secure flag and prevents cookie injection attacks.
  - Evidence: HTTP-header · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** Subresource Integrity (SRI) — All cross-origin scripts are auto-updating provider scripts where SRI does not apply
  - Evidence: HTML-heuristic
- **[PASS]** Server Version Disclosure — Caddy — version hidden
  - Evidence: HTTP-header

### Mobile — 60/100

- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Iba 0/3 inputs má label (0%)
  - Fix: 3 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
  - Evidence: HTML-heuristic
- **[WARN]** Viewport Configuration — Present, but maximum-scale=1 disables pinch-to-zoom
  - Fix: Remove 'maximum-scale=1' and 'user-scalable=no' from your viewport meta tag. Use: <meta name='viewport' content='width=device-width, initial-scale=1'>
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Performance Score — 57/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[WARN]** PWA Features
  - Fix: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Inline CSS Size — 345 KB of inline CSS
  - Fix: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
  - Evidence: HTML-heuristic
- **[WARN]** Responsive Images (srcset) — 63 images without responsive sizing
  - Fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Evidence: HTML-heuristic
- **[WARN]** SK/CZ Local Payment Methods — Iba 2 SK/CZ metód (Tatra Pay, QR platba / Pay by square)
  - Fix: Pridaj ďalšie SK/CZ local methods: ComGate, GoPay, Barion, Besteron, PayU. SK zákazníci preferujú bankové tlačidlá a QR platbu pred kartou.
  - Evidence: HTML-heuristic
- **[WARN]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h2→h4
  - Fix: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
  - Evidence: HTML-heuristic
- **[INFO]** Express Checkout (Apple Pay + Google Pay) — Apple Pay / Google Pay nedetekované na homepage — express checkout sa zvyčajne zobrazí až v košíku/checkoute
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Types — Optimized: 1 email
  - Evidence: HTML-heuristic
- **[PASS]** Payment Methods Detected — 2 method(s): Tatra Pay, QR platba / Pay by square
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Evidence: HTML-heuristic

### AI Readiness — 51/100

- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Heading Hierarchy for AI — 0 H1, 9 H2, 19 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Entity Clarity & Brand Signals
  - Fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Evidence: HTML-heuristic
- **[FAIL]** Knowledge Graph Readiness
  - Fix: Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 11% quality alt text — 21 missing, 21 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Data Foundation — Only 1 distinct schema type (BusinessEntity) — insufficient for AI visibility
  - Fix: One schema type is not enough. Add at minimum: Organization (identity), Product (commerce), BreadcrumbList (navigation), WebSite+SearchAction (discoverability), FAQPage (Q&A answering).
  - Evidence: schema
- **[WARN]** Product Schema Completeness — 79% complete — missing: aggregateRating, priceValidUntil, gtin/mpn (sampled product page: https://zlatokov.sk/produkty/zlaty-prsten-flowers-i)
  - Fix: Add missing Product schema fields: aggregateRating, priceValidUntil, gtin/mpn. Each field improves how AI presents your products. Especially add aggregateRating, since products with ratings show more prominently in AI shopping results.
  - Evidence: schema · https://zlatokov.sk/produkty/zlaty-prsten-flowers-i · confidence: medium
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Breadcrumb Schema
  - Fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
  - Evidence: schema
- **[WARN]** Site Search Schema (SearchAction)
  - Fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
  - Evidence: schema
- **[WARN]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
  - Evidence: HTML-heuristic
- **[WARN]** Semantic HTML Structure — 3/6 elements — missing: <article>, <main>, <aside>
  - Fix: Add: <article>, <main>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — 15 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Product Feed (AI Commerce)
  - Fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
  - Evidence: file-probe · probed /feed/products.xml, /google-shopping.xml, /export/google-shopping.xml — none returned a product feed
- **[WARN]** Heureka XML Feed
  - Fix: Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).
  - Evidence: file-probe
- **[WARN]** Extractable Answer Blocks — 11 paragraphs, avg 15 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 59 words — only 22% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Return Policy Schema
  - Fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
  - Evidence: schema
- **[WARN]** Shipping Details Schema
  - Fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
  - Evidence: schema
- **[WARN]** Content Readability for AI — Grade 20 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Content-to-Boilerplate Ratio — No <main> or <article> elements — AI can't isolate content from boilerplate
  - Fix: Add <main> around your primary content and <article> around self-contained content blocks. This creates clear boundaries for AI content extraction.
  - Evidence: HTML-heuristic
- **[WARN]** Trust Widget — Žiaden trust widget (Heureka / Trustpilot / AggregateRating) nedetekovaný
  - Fix: Pre SK/CZ shopy: inštaluj Heureka Ověřeno zákazníky widget (zadarmo pre overených predajcov — https://sluzby.heureka.sk). Alternatívne: Trustpilot, Google Reviews s AggregateRating schema. Trust widget na product + kategória + footer.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** Reviews & Ratings Schema — No review schema on this homepage — review/rating schema typically lives on product pages
  - Evidence: schema
- **[INFO]** AI Plugin Manifest — Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
  - Evidence: file-probe
- **[INFO]** GTIN/EAN Coverage — No product feed was sampled — GTIN/EAN coverage could not be verified
  - Evidence: HTML-heuristic
- **[INFO]** Speakable Content (Voice AI) — Not present — optional; SpeakableSpecification has limited assistant adoption
  - Evidence: HTML-heuristic
- **[INFO]** Delivery Promise — No delivery timing was found in the text of the sampled product page
  - Evidence: HTML-heuristic · https://zlatokov.sk/produkty/zlaty-prsten-flowers-i · confidence: low
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[INFO]** Agent-Commerce Readiness — 58/100 — partly ready (Access 100 · Understand 33 · Discover 50 · Transact 50)
- **[INFO]** Agent: Access — 100/100 (2 signals)
- **[INFO]** Agent: Understand — 33/100 (3 signals)
- **[INFO]** Agent: Discover — 50/100 (3 signals)
- **[INFO]** Agent: Transact — 50/100 (3 signals)
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 744 words in raw HTML (0.5% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth for AI — 744 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Common Question Coverage — Answers 4/5 key shopper questions: price, shipping, returns/refunds, payment
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 58 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Canonical Tag for AI Deduplication — Self-referencing canonical — clean signal for AI
  - Evidence: HTML-heuristic

### GDPR — 75/100

- **[FAIL]** Consumer Dispute Resolution Links — No EU ODR platform or supervisory-authority link found
  - Fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** International Data Transfers — 1 US-based tracker(s) without consent: Google Analytics/GTM
  - Fix: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Newsletter Consent — Newsletter signup found without visible consent checkbox
  - Fix: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.
  - Evidence: HTML-heuristic
- **[WARN]** Age Verification — Age-restricted content detected without age gate
  - Fix: Implement age verification for alcohol, tobacco, gambling, or adult content. Use a date-of-birth check or age confirmation modal before accessing the site.
  - Evidence: HTML-heuristic
- **[WARN]** GPSR Manufacturer Info — No manufacturer/importer identification found on the sampled product page
  - Fix: On every product page state the manufacturer's name, postal address and an electronic contact (email or web form). For goods made outside the EU, also name the EU importer. Structured `manufacturer` in Product schema satisfies this cleanly and is machine-readable.
  - Evidence: HTML-heuristic · https://zlatokov.sk/produkty/zlaty-prsten-flowers-i · confidence: low
- **[INFO]** Cookie Consent Banner (CMP) — No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)
  - Evidence: HTML-heuristic · 1 GTM container(s) detected · confidence: low
- **[INFO]** Tracking Scripts & Consent — 1 tracker(s) detected (Google Analytics/GTM); no CMP visible in server HTML but GTM is present
  - Evidence: HTML-heuristic · 1 GTM container(s) detected · confidence: low
- **[INFO]** Google Consent Mode v2 — No Consent Mode signals in server HTML, but GTM is present — Consent Mode is commonly configured inside GTM
  - Evidence: HTML-heuristic · 1 GTM container(s) detected · confidence: low
- **[INFO]** Online Withdrawal Function — No explicit online withdrawal button in the server HTML — it may live in the logged-in account/order area, which this scan can't reach. Verify it's present.
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Privacy Policy Page — /ochrana-osobnych-udajov
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — /o-nas
  - Evidence: HTML-heuristic
- **[PASS]** Terms & Conditions Page — /vseobecne-obchodne-podmienky
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Third-party Data Sharing — 1 third-party domain(s)
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic
- **[PASS]** Omnibus Price Disclosure (30-day low) — Discount with a 30-day reference price detected
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Withdrawal & Complaints Policy — Withdrawal right + complaints procedure referenced
  - Evidence: HTML-heuristic

### Vulnerability — 73/100

- **[FAIL]** Form CSRF Protection — 1 form(s) without CSRF tokens
  - Fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Evidence: HTML-heuristic · confidence: low
- **[FAIL]** DMARC Policy (Email Auth)
  - Fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
  - Evidence: DNS
- **[FAIL]** Payment Page Security — Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection
  - Fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Evidence: file-probe
- **[WARN]** X-Powered-By Header — Nuxt
  - Fix: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').
  - Evidence: file-probe
- **[WARN]** Inline JavaScript Exposure — 568 KB of inline JavaScript
  - Fix: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** Bootstrap Version — Bootstrap 5.3.7
  - Evidence: file-probe
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 include:zlatokov.onice.io ~all
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: google)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).

### Accessibility — 16/100

- **[FAIL]** Image Alt Text — 21 of 63 images have no alt attribute
  - Fix: Add descriptive alt text to every meaningful image; use alt="" for purely decorative ones so screen readers skip them.
  - Evidence: HTML-heuristic
- **[FAIL]** Form Labels — 3 of 3 form inputs have no associated label
  - Fix: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.
  - Evidence: HTML-heuristic
- **[FAIL]** Heading Structure — The page has no <h1> heading
  - Fix: Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.
  - Evidence: HTML-heuristic
- **[FAIL]** Landmark Regions — No <main> landmark region found
  - Fix: Wrap the primary content in <main> and use <nav>, <header>, <footer> for the page regions.
  - Evidence: HTML-heuristic
- **[FAIL]** Zoom & Scaling — The viewport meta tag disables pinch-zoom (user-scalable=no / maximum-scale=1)
  - Fix: Remove user-scalable=no and maximum-scale from the viewport tag: <meta name="viewport" content="width=device-width, initial-scale=1">.
  - Evidence: HTML-heuristic
- **[WARN]** Skip Link — No skip-to-content link detected
  - Fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="sk"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/hu/r/zlatokov.sk)
