# hype.sk — Zulien Score 68/100 (Grade C)

> Free e-commerce audit: 68/100 overall score. Platform: WordPress 6.7.5. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://hype.sk/
- **Platform:** WordPress 6.7.5
- **Scan date:** 2026-07-10
- **Full report:** https://score.zulien.sk/pl/r/hype.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/hype.sk

## Score by category

| Category | Score |
|---|---|
| Performance | 67/100 |
| SEO | 87/100 |
| Security | 57/100 |
| Mobile | 67/100 |
| AI Readiness | 68/100 |
| GDPR | 71/100 |
| Vulnerability | 48/100 |

## Detailed findings

### Performance — 67/100

- **[FAIL]** Largest Contentful Paint (LCP) — 5.02s (good: <2.5s) — Core Web Vital FAILING
  - Fix: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.
  - Evidence: PSI-lab
- **[FAIL]** Total Page Weight — 14.4 MB, 147 requests — too heavy!
  - Fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Evidence: PSI-lab
- **[FAIL]** Unused Code (CSS + JS) — 867 KB wasted on unused code!
  - Fix: You're loading 867 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[FAIL]** Script Loading Strategy — Only 5% of 22 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.
  - Evidence: HTML-heuristic
- **[FAIL]** CSS File Count — 39 CSS files — too many!
  - Fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 39 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[WARN]** Connection Hint Coverage — 6 external domains without preconnect
  - Fix: Add <link rel='preconnect'> for key third-party domains: cdn-cookieyes.com, www.googletagmanager.com, www.google.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 76ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.53s
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 172ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.000 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 2.48s
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 1 preload, 0 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** Lazy Loading — 72% of images use native lazy loading (26/36)
  - Evidence: HTML-heuristic
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header

### SEO — 87/100

- **[FAIL]** Image Alt Attributes — Only 31% of 36 images have alt text
  - Fix: 25 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.
  - Evidence: HTML-heuristic
- **[WARN]** H1 Heading — 5 H1 tags (should be exactly 1)
  - Fix: Consolidate to exactly one H1 tag per page. Use H2-H6 for subheadings.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — 0% next-gen formats — 4 JPEG, 18 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Evidence: HTML-heuristic
- **[WARN]** Semantic HTML Structure — Only 2/6 semantic elements — missing: <article>, <header>, <footer>, <aside>
  - Fix: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
  - Evidence: HTML-heuristic
- **[WARN]** Excessive Resource Requests — 23 JS + 39 CSS = 62 external requests
  - Fix: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 3% ratio but 1017 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Title — 38 chars — "Hype - digitálna marketingová agentúra"
  - Evidence: HTML-heuristic
- **[PASS]** Meta Description — 138 chars
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 34 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Image Format — image/jpeg
  - Evidence: HTML-heuristic
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://hype.sk/
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 1 block(s): WebPage, ReadAction, ImageObject, BreadcrumbList
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 1 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with ~9+ URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Content Depth — 1017 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 34, H3: 9 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 51 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 15 ARIA roles, 19 ARIA labels, lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 92 day(s) ago
  - Evidence: HTML-heuristic

### Security — 57/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Evidence: HTTP-header
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** Subresource Integrity (SRI) — Only 0/3 SRI-eligible third-party scripts have integrity hashes (3 auto-updating provider script(s) excluded — SRI not applicable)
  - Fix: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Evidence: HTML-heuristic
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[WARN]** Iframe Sandboxing — 1/1 unknown iframe(s) without sandbox attribute
  - Fix: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
  - Evidence: DNS
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** Cookie Security Flags — No cookies set on initial response
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: openresty (no version)
  - Evidence: HTTP-header
- **[PASS]** Server Version Disclosure — openresty — version hidden
  - Evidence: HTTP-header

### Mobile — 67/100

- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Iba 0/18 inputs má label (0%)
  - Fix: 18 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Performance Score — 62/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: HTML-heuristic
- **[WARN]** Font Size Readability
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Apple Mobile Web App — Missing: apple-mobile-web-app-capable, status-bar-style
  - Fix: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
  - Evidence: HTML-heuristic
- **[WARN]** Form Input Types — phone fields use type='text' instead of type='tel'
  - Fix: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
  - Evidence: HTML-heuristic
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Evidence: HTML-heuristic
- **[WARN]** Fixed Width Elements — Large fixed-width elements detected — may cause horizontal scroll
  - Fix: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Images (srcset) — 9 image(s) use srcset for responsive sizing
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy (WCAG 1.3.1) — Žiadne preskočené úrovne
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Evidence: HTML-heuristic

### AI Readiness — 68/100

- **[FAIL]** llms.txt (AI Site Descriptor)
  - Fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
  - Evidence: file-probe
- **[FAIL]** Heading Hierarchy for AI — 5 H1, 34 H2, 9 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 22% quality alt text — 25 missing, 3 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** llms-full.txt (Complete AI Content)
  - Fix: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
  - Evidence: file-probe
- **[WARN]** Organization Schema + Entity Linking — Organization schema found but no sameAs links
  - Fix: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.
  - Evidence: schema
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Semantic HTML Structure — 2/6 elements — missing: <article>, <header>, <footer>, <aside>
  - Fix: Add: <article>, <header>, <footer>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — 12 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Freshness Signals — Schema dates found but no visible date on page
  - Fix: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.
  - Evidence: HTML-heuristic
- **[WARN]** Entity Clarity & Brand Signals — OG tags complete but no sameAs entity links
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — Only 2 data point(s) — add more
  - Fix: Add specific statistics, percentages, dollar amounts, and quantified claims. E.g., '93% of customers report...', 'saves an average of €200/year', '3x faster than...' Data makes content citable.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 40 words — only 6% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 18 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** ai.txt (AI Permissions)
  - Fix: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
  - Evidence: file-probe
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 1017 words in raw HTML (3.0% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data Foundation — 1 JSON-LD blocks with 10 schema types: WebPage, ReadAction, ImageObject, BreadcrumbList, ListItem, WebSite
  - Evidence: schema
- **[PASS]** Breadcrumb Schema — BreadcrumbList structured data found — clear navigation hierarchy
  - Evidence: schema
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Evidence: schema
- **[PASS]** Content Depth for AI — 1017 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 44 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Extractable Answer Blocks — 25 paragraphs, avg 63 words — optimal for AI extraction
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 50 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Canonical Tag for AI Deduplication — Self-referencing canonical — clean signal for AI
  - Evidence: HTML-heuristic
- **[PASS]** Knowledge Graph Readiness — 3/4 entity signals — strong Knowledge Graph presence
  - Evidence: HTML-heuristic
- **[PASS]** Content-to-Boilerplate Ratio — 91% of text in <main>/<article> — clean content signal
  - Evidence: HTML-heuristic
- **[PASS]** Social Proof (Testimonials / Case Studies) — Strong social proof: testimonials, case studies / portfolio
  - Evidence: HTML-heuristic

### GDPR — 71/100

- **[FAIL]** Privacy Policy Page
  - Fix: Create a comprehensive privacy policy covering: what data you collect, why (legal basis), how long you store it, who you share it with, and how users can exercise their GDPR rights (access, deletion, portability).
  - Evidence: HTML-heuristic
- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Third-party Data Sharing — 6 third-party domains loading scripts
  - Fix: Your page loads scripts from 6 external domains. Review each one: cdn-cookieyes.com, www.googletagmanager.com, www.google.com, cdn.jsdelivr.net, t.leady.com... Ensure each has a Data Processing Agreement (DPA) and is listed in your privacy policy.
  - Evidence: HTML-heuristic
- **[WARN]** Forms Without Privacy Notice — 4 form(s) on page with no privacy policy link
  - Fix: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Data Protection Officer Contact
  - Fix: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
  - Evidence: HTML-heuristic
- **[PASS]** Cookie Consent Banner (CMP) — CookieYes detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — 2 tracker(s) detected with CMP: Google Analytics/GTM, Meta Pixel
  - Evidence: HTML-heuristic
- **[PASS]** Google Consent Mode v2 — Consent mode signals detected (ad_storage, analytics_storage)
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — /o-nas
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic

### Vulnerability — 48/100

- **[FAIL]** CMS Version Disclosure — "WordPress 6.7.5" exposed in meta generator
  - Fix: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.
  - Evidence: HTML-heuristic
- **[FAIL]** Admin Panel at Default URL — Accessible at: /admin, /wp-admin
  - Fix: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).
  - Evidence: file-probe
- **[FAIL]** Suspicious Inline Script Patterns — Detected: Dynamic script injection
  - Fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
  - Evidence: file-probe
- **[FAIL]** DMARC Policy (Email Auth)
  - Fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
  - Evidence: DNS
- **[FAIL]** Clickjacking on Sensitive Page — Login/payment page without X-Frame-Options or CSP frame-ancestors
  - Fix: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
  - Evidence: file-probe
- **[FAIL]** Server Error Leak — PHP/server error messages visible in page output
  - Fix: Set display_errors=Off in php.ini and log_errors=On. Configure a custom error page. Never show stack traces, SQL errors, or file paths to users.
  - Evidence: file-probe
- **[WARN]** CMS Information Files — readme.html accessible — reveals version details
  - Fix: Delete or block access to readme.html. These files reveal your exact CMS version and update history.
  - Evidence: file-probe
- **[WARN]** Form CSRF Protection — 1/4 forms have CSRF tokens
  - Fix: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** Open Redirect Detection — URL redirect parameter found in page links
  - Fix: Validate all redirect URLs server-side against a whitelist. Never allow user-controlled redirect targets without validation.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** Source Maps Exposed — JavaScript source maps (.js.map) are publicly accessible
  - Fix: Remove source maps from production or block access via server config. In Vite/Webpack: set sourcemap: false for production builds.
  - Evidence: file-probe
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[WARN]** CDN Script Integrity (SRI) — 1 CDN script(s) without Subresource Integrity
  - Fix: Add integrity='sha384-...' crossorigin='anonymous' to CDN scripts from: cdn.jsdelivr.net. Generate hashes at srihash.org.
  - Evidence: file-probe
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 a mx include:_spf.m1.websupport.sk ?all
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: mail)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/pl/r/hype.sk)
