# biocentrumplus.sk — Zulien Score 72/100 (Grade B)

> Free e-commerce audit: 72/100 overall score. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://biocentrumplus.sk
- **Scan date:** 2026-10-08
- **Full report:** https://score.zulien.sk/pl/r/biocentrumplus.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/biocentrumplus.sk

## Audit summary

Your site runs well overall, but has security and technical gaps to close. Add HTTPS protection (HSTS) to all pages as your top priority. Your accessibility for users with disabilities is excellent.

## Score by category

| Category | Score |
|---|---|
| Performance | 81/100 |
| SEO | 82/100 |
| Security | 60/100 |
| Mobile | 51/100 |
| AI Readiness | 57/100 |
| GDPR | 75/100 |
| Vulnerability | 62/100 |
| Accessibility | 93/100 |

## Detailed findings

### Performance — 81/100

- **[FAIL]** Unused Code (CSS + JS) — 390 KB wasted on unused code!
  - Fix: You're loading 390 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[FAIL]** Script Loading Strategy — Only 33% of 9 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
  - Evidence: HTML-heuristic
- **[WARN]** Total Blocking Time (TBT) — 212ms (good: <200ms)
  - Fix: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.
  - Evidence: PSI-lab
- **[WARN]** Total Page Weight — 2.0 MB, 81 requests (optimal: <1.5 MB, <50 req)
  - Fix: Reduce page weight: compress images to WebP (saves 30-50%), enable text compression (gzip/brotli), lazy load below-fold images, remove unused CSS/JS.
  - Evidence: PSI-lab
- **[WARN]** JavaScript Budget — 646 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked
  - Fix: Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.
  - Evidence: PSI-lab · 646 KB JavaScript · confidence: high
- **[WARN]** Request Budget — 81 requests — over the budget of 80, but at or below the median of the award-winning shops we benchmarked (140)
  - Fix: Bundle CSS/JS that always loads together, serve icons as a sprite or font rather than individual files, and lazy-load below-fold images so they aren't requested on load.
  - Evidence: PSI-lab · 81 requests · confidence: high
- **[WARN]** Cache-Control Strategy — no-store, no-cache, must-revalidate, no-cache, private
  - Fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
  - Evidence: HTTP-header
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[WARN]** Connection Hint Coverage — 5 external domains without preconnect
  - Fix: Add <link rel='preconnect'> for key third-party domains: www.googletagmanager.com, connect.facebook.net, www.google.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
  - Evidence: PSI-lab
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 25ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 1.05s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 1.43s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.042 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 1.68s
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 1 preload, 1 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** Lazy Loading — 7% of images use native lazy loading (5/74)
  - Evidence: HTML-heuristic
- **[PASS]** Font Loading Strategy — font-display: swap
  - Evidence: HTML-heuristic
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header
- **[PASS]** CSS File Count — 3 CSS file(s) — well consolidated
  - Evidence: HTML-heuristic

### SEO — 82/100

- **[FAIL]** Structured Data (JSON-LD)
  - Fix: Add JSON-LD structured data: Product (with price, availability, reviews), Organization, BreadcrumbList, and WebSite schemas.
  - Evidence: schema
- **[WARN]** Meta Title — 73 chars (optimal: 30-60)
  - Fix: Shorten your title to under 60 characters. Google truncates longer titles with '…', which cuts off your message.
  - Evidence: HTML-heuristic
- **[WARN]** Meta Description — 319 chars (optimal: 120-160)
  - Fix: Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.
  - Evidence: HTML-heuristic
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — 0% next-gen formats — 4 JPEG, 7 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical URL Consistency — Canonical points to different URL: https://www.biocentrumplus.sk/
  - Fix: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 3% ratio but 1328 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "Lečivé maste, prírodná kozmetika a vitamíny pre zdravie"
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 5 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Image Format — image/webp
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://www.biocentrumplus.sk/
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Sitemap index with 1 child sitemaps
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk"
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 100% of 74 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — index,follow
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth — 1328 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 5, H3: 2 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 79 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Empty/Dead Links — 4 minor dead link(s) — acceptable
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 4/4 a11y signals: 113 ARIA roles, 52 ARIA labels, skip link, lang="sk"
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 0 day(s) ago
  - Evidence: HTML-heuristic

### Security — 60/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** HTTP → HTTPS Redirect
  - Fix: Configure a 301 redirect from http:// to https:// for all pages. In Apache: RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Cookie Security Flags — 3 cookie(s): 2 missing HttpOnly, 2 missing SameSite
  - Fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Evidence: HTTP-header
- **[WARN]** Subresource Integrity (SRI) — Only 0/9 SRI-eligible third-party scripts have integrity hashes (2 auto-updating provider script(s) excluded — SRI not applicable)
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Evidence: HTML-heuristic
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[INFO]** Iframe Sandboxing — 1 trusted provider embed(s) without sandbox — expected (sandbox would break YouTube/Maps/Stripe/reCAPTCHA)
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** Cookie Prefix Security — 1 session cookie(s) already have Secure + HttpOnly + SameSite; adding the __Host- prefix is a cosmetic hardening nicety
  - Evidence: HTTP-header · 1 session cookie(s), all with Secure+HttpOnly+SameSite · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
  - Evidence: DNS
- **[PASS]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN, SAMEORIGIN
  - Evidence: HTTP-header
- **[PASS]** X-Content-Type-Options — nosniff
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: openresty (no version)
  - Evidence: HTTP-header
- **[PASS]** security.txt (RFC 9116) — Present at /.well-known/security.txt
  - Evidence: file-probe
- **[PASS]** Server Version Disclosure — openresty — version hidden
  - Evidence: HTTP-header
- **[PASS]** Password Field Security — 1 password field(s) — allow password manager autofill
  - Evidence: HTTP-header

### Mobile — 51/100

- **[FAIL]** Mobile Performance Score — 37/100 — critically slow
  - Fix: Your mobile experience is severely degraded. Priority fixes: 1) Reduce JavaScript, 2) Convert all images to WebP with responsive sizing, 3) Enable aggressive caching, 4) Use a CDN.
  - Evidence: PSI-lab
- **[WARN]** Desktop/Mobile Performance Gap — Desktop: 85 vs Mobile: 37 (48 point gap)
  - Fix: Your desktop experience is significantly better than mobile. Focus on: reducing JavaScript (mobile CPUs are slower), serving responsive images (smaller files for smaller screens), and minimizing main-thread work.
  - Evidence: HTML-heuristic
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[WARN]** PWA Features
  - Fix: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Responsive Images (srcset) — 74 images without responsive sizing
  - Fix: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Evidence: HTML-heuristic
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Evidence: HTML-heuristic
- **[WARN]** Heading Hierarchy (WCAG 1.3.1) — Skipped levels: h2→h4
  - Fix: Keep headings in order h1 → h2 → h3 → h4 with no skipped levels. Screen readers use the heading hierarchy to navigate. If you want smaller text at the same level, use a CSS class rather than a lower heading tag.
  - Evidence: HTML-heuristic
- **[WARN]** Link Text Quality (WCAG 2.4.4) — 2 links have generic text ("click here", "more", "here"...)
  - Fix: Replace 'Click here' and 'Read more' with descriptive text: 'Read more about GDPR', 'See module pricing'. Screen readers read links out of context, so a bare 'more' carries no meaning.
  - Evidence: HTML-heuristic
- **[INFO]** Payment Methods Detected — No known payment gateway detected on the homepage
  - Evidence: HTML-heuristic
- **[INFO]** Express Checkout (Apple Pay + Google Pay) — Apple Pay / Google Pay not detected on the homepage — express checkout usually appears only in the cart or checkout
  - Evidence: HTML-heuristic
- **[INFO]** SK/CZ Local Payment Methods — No SK/CZ local payment method detected on the homepage — bank buttons and QR payment usually appear only in checkout
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Types — Optimized: 2 email, 1 search
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Labels (WCAG 3.3.2) — 6/6 inputs have a label
  - Evidence: HTML-heuristic

### AI Readiness — 57/100

- **[FAIL]** Structured Data Foundation
  - Fix: Add JSON-LD structured data immediately. Priority order: 1) Organization, 2) Product (with offers), 3) BreadcrumbList, 4) WebSite+SearchAction, 5) FAQPage. Use JSON-LD format exclusively — not Microdata or RDFa.
  - Evidence: schema
- **[FAIL]** Organization Schema + Entity Linking
  - Fix: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Evidence: schema
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Content-to-Boilerplate Ratio — Only 1% in main content — mostly boilerplate
  - Fix: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.
  - Evidence: HTML-heuristic
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Breadcrumb Schema
  - Fix: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
  - Evidence: schema
- **[WARN]** Site Search Schema (SearchAction)
  - Fix: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
  - Evidence: schema
- **[WARN]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Fix: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — 15 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Entity Clarity & Brand Signals — OG tags complete but no sameAs entity links
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Product Feed (AI Commerce)
  - Fix: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
  - Evidence: file-probe · probed /feed/products.xml, /google-shopping.xml, /export/google-shopping.xml — none returned a product feed
- **[WARN]** Heureka XML Feed
  - Fix: Generate a Heureka XML feed at /feed/heureka.xml (or /export/heureka.xml). PrestaShop has a Heureka.cz module, WooCommerce has plugins. Structure: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> with ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (required) + EAN/PARAM/DELIVERY_DATE (highly recommended for ranking).
  - Evidence: file-probe
- **[WARN]** Extractable Answer Blocks — 33 paragraphs, avg 9 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — Only 1 data point(s) — add more
  - Fix: Add specific statistics, percentages, dollar amounts, and quantified claims. E.g., '93% of customers report...', 'saves an average of €200/year', '3x faster than...' Data makes content citable.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 315 words — only 0% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Common Question Coverage — Answers 3/5 — missing: price, returns/refunds
  - Fix: Add clear content answering the questions shoppers (and AI assistants) ask: pricing, shipping options & cost, returns/refund policy, stock availability, and accepted payment methods. A visible FAQ or info section covering these is ideal.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.biocentrumplus.sk/
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Evidence: HTML-heuristic
- **[WARN]** Return Policy Schema
  - Fix: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
  - Evidence: schema
- **[WARN]** Shipping Details Schema
  - Fix: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
  - Evidence: schema
- **[WARN]** Knowledge Graph Readiness — 1/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema
  - Fix: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 17 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Image Alt Text Quality for AI — 79% good, 13 poor, 0 missing
  - Fix: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Trust Widget — No trust widget (Heureka / Trustpilot / AggregateRating) detected
  - Fix: For SK/CZ shops: install the Heureka Ověřeno zákazníky widget (free for verified sellers — https://sluzby.heureka.sk). Alternatives: Trustpilot, Google Reviews with AggregateRating schema. Place the trust widget on product + category + footer.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** Product Schema Completeness — No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit
  - Evidence: schema
- **[INFO]** Search Typo Handling (measurement) — A correctly spelled query and the same query with a typo return similarly sized pages (199238 B vs 199238 B) — consistent with typo tolerance
  - Evidence: HTML-heuristic · 199238 B response · https://biocentrumplus.sk/action/ProductSearch/prepareString/?string=xyzqwerty-nezmysel · confidence: low
- **[INFO]** Reviews & Ratings Schema — No review schema on this homepage — review/rating schema typically lives on product pages
  - Evidence: schema
- **[INFO]** AI Plugin Manifest — Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
  - Evidence: file-probe
- **[INFO]** GTIN/EAN Coverage — No product feed was sampled — GTIN/EAN coverage could not be verified
  - Evidence: HTML-heuristic
- **[INFO]** Speakable Content (Voice AI) — Not present — optional; SpeakableSpecification has limited assistant adoption
  - Evidence: HTML-heuristic
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[INFO]** Agent-Commerce Readiness — 50/100 — partly ready (Access 100 · Understand 0 · Discover 50 · Transact 50)
- **[INFO]** Agent: Access — can an agent get in — 100/100 (2 signals)
- **[INFO]** Agent: Understand — can it read the products — 0/100 (2 signals)
- **[INFO]** Agent: Discover — can it find the whole catalogue — 50/100 (3 signals)
- **[INFO]** Agent: Transact — can it act (cart, terms) — 50/100 (3 signals)
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** AI agent access (live) — ChatGPT-User and PerplexityBot get the same page as a browser
  - Evidence: file-probe · ChatGPT-User, PerplexityBot: same page as a browser · https://biocentrumplus.sk
- **[PASS]** Content Accessibility for AI — 1328 words in raw HTML (3.0% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Zero-results Recovery — A search with no matches still offers products, suggestions or a way to get help
  - Evidence: HTML-heuristic · 199238 B response · https://biocentrumplus.sk/action/ProductSearch/prepareString/?string=xyzqwerty-nezmysel · confidence: low
- **[PASS]** Content Depth for AI — 1328 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy for AI — Proper structure: 1 H1 → 5 H2s → 2 H3s — clear content outline
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 59 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic

### GDPR — 75/100

- **[FAIL]** Consumer Dispute Resolution Links — No EU ODR platform or supervisory-authority link found
  - Fix: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Legal Contact / Imprint Page
  - Fix: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Evidence: HTML-heuristic
- **[WARN]** Third-party Data Sharing — 6 third-party domains loading scripts
  - Fix: Your page loads scripts from 6 external domains. Review each one: cdn.myshoptet.com, www.googletagmanager.com, connect.facebook.net, www.google.com, www.smartsuppchat.com... Ensure each has a Data Processing Agreement (DPA) and is listed in your privacy policy.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Omnibus Price Disclosure (30-day low) — Discounts shown without a visible 'lowest price in last 30 days' reference
  - Fix: Whenever you advertise a price reduction, display the lowest price applied in the 30 days before the discount, next to the new price. In PrestaShop add a 30-day price-history anchor (e.g. our zu_pricehistory module) so every sale label is compliant automatically.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** Withdrawal & Complaints Policy — Missing: right of withdrawal (odstúpenie od zmluvy), complaints procedure (reklamačný poriadok)
  - Fix: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Online Withdrawal Function — No online withdrawal function or withdrawal information detected
  - Fix: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** Legal guarantee notice — No harmonised notice on the legal guarantee was found on the pages we scanned — it may be on a page this scan does not open. Verify it is shown.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** AI chatbot disclosure — Chat widget detected: Smartsupp. If it answers with AI (e.g. an AI agent or auto-replies), visitors must be told they are talking to an AI.
  - Evidence: HTML-heuristic · Smartsupp · confidence: low
- **[PASS]** Cookie Consent Banner (CMP) — Cookiebot detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — 1 tracker(s) detected with CMP: Google Analytics/GTM
  - Evidence: HTML-heuristic
- **[PASS]** Google Consent Mode v2 — Consent mode signals detected (ad_storage, analytics_storage)
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — /podmienky-ochrany-osobnych-udajov
  - Evidence: HTML-heuristic
- **[PASS]** Terms & Conditions Page — /obchodne-podmienky
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic

### Vulnerability — 62/100

- **[FAIL]** Known Vulnerabilities (CVE) — 5 CVEs associated with 1 detected component version
  - Fix: Update jQuery 1.11.3 → 3.7.1 (CVE-2011-4969, CVE-2012-6708, CVE-2015-9251, CVE-2020-11022, CVE-2020-11023). Verify each before acting — a host or distro can backport a security patch while the version string still reads as vulnerable, so a detected CVE is not proof your install is affected. CVE details: CVE-2011-4969: https://nvd.nist.gov/vuln/detail/CVE-2011-4969 · CVE-2012-6708: https://nvd.nist.gov/vuln/detail/CVE-2012-6708 · CVE-2015-9251: https://nvd.nist.gov/vuln/detail/CVE-2015-9251 · CVE-2020-11022: https://nvd.nist.gov/vuln/detail/CVE-2020-11022 · CVE-2020-11023: https://nvd.nist.gov/vuln/detail/CVE-2020-11023
  - Evidence: file-probe · confidence: low
- **[FAIL]** Admin Panel at Default URL — Accessible at: /admin
  - Fix: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).
  - Evidence: file-probe
- **[FAIL]** jQuery Version — jQuery 1.11.3 — critically outdated!
  - Fix: jQuery 1.11.3 is associated with multiple known security vulnerabilities. Upgrade to 3.7.x. If your plugins require jQuery 1.x/2.x, use jquery-migrate as a temporary bridge.
  - Evidence: file-probe · confidence: low
- **[FAIL]** Payment Page Security — Payment page missing: No HSTS, No CSP
  - Fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Evidence: file-probe
- **[WARN]** Form CSRF Protection — 39/41 forms have CSRF tokens
  - Fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Fix: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
  - Evidence: DNS
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[WARN]** Login Form Security — Login form blocks password manager autofill
  - Fix: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
  - Evidence: file-probe
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 a mx include:_spf.m1.websupport.sk include:_spf.myshoptet.com ?all
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: mail)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Accessibility — 93/100

- **[WARN]** Heading Structure — Heading outline issue (h1 count: 1h2→h4, h2→h4)
  - Fix: Use a single <h1> and don't jump heading levels (e.g. <h2> straight to <h4>).
  - Evidence: HTML-heuristic
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="sk"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Text — All 74 images have alt attributes
  - Evidence: HTML-heuristic
- **[PASS]** Form Labels — All 6 form inputs are labelled
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Evidence: HTML-heuristic
- **[PASS]** Zoom & Scaling — Pinch-zoom is not disabled
  - Evidence: HTML-heuristic
- **[PASS]** Skip Link — A skip-to-content link is present
  - Evidence: HTML-heuristic · confidence: low

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/pl/r/biocentrumplus.sk)