Ostatnie skanowanie: July 2, 2026

D0/100

Poniżej średniej

Wyniki oceny

lunys.sk

Przeskanowano July 2, 2026

Magento

jQuery

Swiper

reCAPTCHA

Nginx

Ostatnie skanowanie: July 2, 2026

Plan działania

Napraw najpierw te 3 rzeczy

Posortowane według wpływu na wynik — każda poprawka podnosi ogólną ocenę.

+18potencjalny zysk

63/100

Performance

Waga: 25% · 7 zaliczonych · 4 ostrzeżenia · 4 nieudanych · 1 SPA (sprawdź ręcznie)

Co znaleźliśmy: 2056ms (good: <200ms)

Dlaczego to ma znaczenie: TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.

Jak to naprawić: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.

Dowód:PSI-lab· Pewność: high

Request quote for speed audit

Co znaleźliśmy: 4.1 MB, 123 requests — too heavy!

Dlaczego to ma znaczenie: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Jak to naprawić: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Dowód:PSI-lab· Pewność: high

Get Performance Optimization →

Co znaleźliśmy: 1271 KB wasted on unused code!

Dlaczego to ma znaczenie: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Uwaga: Ta kontrola wykorzystuje detekcję heurystyczną i może zwracać również fałszywe alarmy. Zalecamy ręczną weryfikację.

Jak to naprawić: You're loading 1271 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Dowód:PSI-lab· Pewność: low

Co znaleźliśmy: Only 25% of 4 scripts optimized — most are render-blocking

Dlaczego to ma znaczenie: 3 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

Jak to naprawić: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.

Dowód:HTML-heuristic· Pewność: high

Get Performance Optimization →

Dlaczego to ma znaczenie: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

Jak to naprawić: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.

Dowód:HTML-heuristic· Pewność: high

Request quote for speed audit

Co znaleźliśmy: no-store, no-cache, must-revalidate

Dlaczego to ma znaczenie: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

Jak to naprawić: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

Dowód:HTTP-header· Pewność: high

Request quote for speed audit

Co znaleźliśmy: 4 CSS files loaded

Dlaczego to ma znaczenie: Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load.

Jak to naprawić: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.

Dowód:HTML-heuristic· Pewność: high

Co znaleźliśmy: 4 CSS files without critical CSS extraction

Dlaczego to ma znaczenie: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

Jak to naprawić: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Dowód:PSI-lab· Pewność: high

Request quote for speed audit

8 problemów w kategorii Performance. Jest miejsce na poprawę.

Twój sklep na razie nie spełnia warunków dla odznaki Zulien Score. Uzyskaj ocenę 80+!

📧 Przypomnienia o ponownym skanowaniu

Raz w miesiącu napiszemy do Ciebie, kiedy zrobić nowe skanowanie i śledzić swoje postępy.

Zgadzam się z Polityka prywatności. Wyślemy Ci raport i opcjonalne powiadomienia o ponownym skanowaniu.

🚀 Popraw swoją ocenę

Nasze moduły PrestaShop potrafią automatycznie naprawić większość tych problemów.

Bezpłatna 15-min konsultacja · Bez zobowiązań

Udostępnij i eksportuj

Gotowy, by poprawić swoją ocenę?

Twój sklep internetowy traci klientów każdego dnia. Powyższe problemy kosztują Cię sprzedaż.

Napraw samodzielnie

Przejrzyj nasze moduły i napraw problemy w 2 kliknięciach.

Przeglądaj moduły Zulien

Zostaw to nam

Opisz swój cel, a w ciągu 48 h prześlemy Ci wycenę. Bez rozmów telefonicznych.

Uzyskaj wycenę

Odpowiedź w ciągu 48 h · Bez rozmowy telefonicznej

To zautomatyzowany szacunek heurystyczny, nie profesjonalny audyt. Wykryte zagadnienia odzwierciedlają publicznie obserwowalne sygnały w momencie skanowania i mogą zawierać również nieprawidłowe wskazania.Przeczytaj o naszej metodologiiZgłoś nieścisłośćUsuń ten raport

Zulien Score

Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách

68/100

Grade D

lunys.sk

Dátum auditu: July 2, 2026

Platforma: Magento

Online report: https://score.zulien.sk/r/lunys.sk

Executive summary

Chýb

Upozornení

155

Spolu kontrol

Skóre po kategóriách

Kategória	Skóre	Váha	Chyby	Upozornenia	OK
Performance	63/100	25%	4	4	7
SEO	75/100	20%	3	6	17
Security	78/100	15%	1	5	12
Mobile	61/100	10%	1	14	5
AI Readiness	56/100	10%	4	26	8
GDPR	72/100	10%	2	6	10
Vulnerability	65/100	10%	2	6	7

Kritické zistenia

Total Blocking Time (TBT)· Performance

TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.

Total Page Weight· Performance

Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Unused Code (CSS + JS)· Performance

Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Script Loading Strategy· Performance

3 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

H1 Heading· SEO

The H1 is the primary content signal for search engines. Pages without H1 rank significantly lower for target keywords.

Open Graph Image Format· SEO

Social scrapers expect an image at og:image URL. If they get HTML/JSON instead, no preview renders.

Image Alt Attributes· SEO

Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA.

Content-Security-Policy (CSP)· Security

CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.

Form Input Labels (WCAG 3.3.2)· Mobile

EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.

llms.txt (AI Site Descriptor)· AI Readiness

llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.

Heading Hierarchy for AI· AI Readiness

AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Content Freshness Signals· AI Readiness

No freshness signals = AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

Performance

63/100

Váha: 25% · 7 OK · 4 upozornení · 4 chýb · spolu 16

Total Blocking Time (TBT)Zlyhalo

2056ms (good: <200ms)

Prečo je to dôležité: TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.

Ako opraviť: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.

Total Page WeightZlyhalo

4.1 MB, 123 requests — too heavy!

Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Unused Code (CSS + JS)Zlyhalo

1271 KB wasted on unused code!

Prečo je to dôležité: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Ako opraviť: You're loading 1271 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Script Loading StrategyZlyhalo

Only 25% of 4 scripts optimized — most are render-blocking

Prečo je to dôležité: 3 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain.

Ako opraviť: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.

Resource Hints (Preload/Preconnect)Upozornenie

Prečo je to dôležité: Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS.

Ako opraviť: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.

Cache-Control StrategyUpozornenie

no-store, no-cache, must-revalidate

Prečo je to dôležité: no-cache/no-store forces browsers to re-download resources on every visit. Repeat visitors load your entire site from scratch every time.

Ako opraviť: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.

CSS File CountUpozornenie

4 CSS files loaded

Prečo je to dôležité: Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load.

Ako opraviť: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.

Critical CSS StrategyUpozornenie

4 CSS files without critical CSS extraction

Prečo je to dôležité: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

Ako opraviť: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Server Response Time (TTFB)Prešlo

21ms

First Contentful Paint (FCP)Prešlo

0.67s

Largest Contentful Paint (LCP)Prešlo

1.35s — Core Web Vital ✓

Cumulative Layout Shift (CLS)Prešlo

0.002 — Core Web Vital ✓

Speed IndexPrešlo

2.52s

Text Compression (gzip/brotli)Prešlo

All text resources properly compressed

Lazy LoadingPrešlo

3% of images use native lazy loading (10/306)

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

SEO

75/100

Váha: 20% · 17 OK · 6 upozornení · 3 chýb · spolu 27

H1 HeadingZlyhalo

Prečo je to dôležité: The H1 is the primary content signal for search engines. Pages without H1 rank significantly lower for target keywords.

Ako opraviť: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.

Open Graph Image FormatZlyhalo

og:image returned text/html

Prečo je to dôležité: Social scrapers expect an image at og:image URL. If they get HTML/JSON instead, no preview renders.

Ako opraviť: Make sure the og:image URL returns an image (Content-Type: image/png or image/jpeg). Common cause: returning HTML or JSON from a broken redirect.

Image Alt AttributesZlyhalo

Only 29% of 306 images have alt text

Prečo je to dôležité: Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA.

Ako opraviť: 217 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.

Image Format OptimizationUpozornenie

0% next-gen formats — 0 JPEG, 22 PNG images

Prečo je to dôležité: Your images are using legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations.

Ako opraviť: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.

Semantic HTML StructureUpozornenie

Only 3/6 semantic elements — missing: <article>, <nav>, <aside>

Prečo je to dôležité: Semantic HTML gives search engines clear signals about content structure. Pages with proper semantic markup earn more featured snippets and knowledge panel appearances.

Ako opraviť: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.

Canonical URL ConsistencyUpozornenie

Canonical points to different URL: https://www.lunys.sk/

Prečo je to dôležité: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.

Ako opraviť: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.

Sitemap in robots.txtUpozornenie

robots.txt exists but doesn't reference your sitemap

Prečo je to dôležité: While Google can find sitemaps via Search Console, referencing it in robots.txt ensures all search engines (Bing, Yandex, Baidu) can discover it automatically.

Ako opraviť: Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.

Accessibility FundamentalsUpozornenie

2/4 a11y signals — missing: ARIA labels, skip navigation link

Prečo je to dôležité: The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO — Google confirms a11y as a ranking signal.

Ako opraviť: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.

Image Dimension AttributesUpozornenie

Only 14% of images have width/height attributes

Prečo je to dôležité: Missing image dimensions are the #1 cause of Cumulative Layout Shift. Google explicitly uses CLS as a Core Web Vital ranking factor.

Ako opraviť: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.

Meta TitlePrešlo

38 chars — "Skratka k lepším potravinám | LUNYS.sk"

Meta DescriptionPrešlo

149 chars

Content Structure (H2 Headings)Prešlo

4 H2 subheadings found

Open Graph TagsPrešlo

og:title, og:description, og:image, og:type

Twitter/X CardsPrešlo

Card type: summary_large_image

Canonical URLPrešlo

https://www.lunys.sk/

Structured Data (JSON-LD)Prešlo

3 block(s): WebSite, Organization, SearchAction

JSON-LD ValidityPrešlo

3 block(s) parse cleanly

robots.txtPrešlo

Present

XML SitemapPrešlo

Found with ~1+ URLs

HTML Language AttributePrešlo

lang="sk"

Meta Robots TagPrešlo

index, follow

FaviconPrešlo

Favicon detected

Content DepthPrešlo

2719 words — sufficient content

Deep Heading HierarchyPrešlo

H2: 4, H3: 7 — well-structured content

Internal LinkingPrešlo

77 internal links — strong site navigation

Empty/Dead LinksPrešlo

2 minor dead link(s) — acceptable

Text-to-HTML RatioInfo

4% ratio but 2719 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content

Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.

Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.

Security

78/100

Váha: 15% · 12 OK · 5 upozornení · 1 chýb · spolu 18

Content-Security-Policy (CSP)Zlyhalo

Prečo je to dôležité: CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.

Ako opraviť: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

CAA DNS RecordUpozornenie

No CAA records — any CA can issue certificates for this domain

Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

Cookie Security FlagsUpozornenie

4 cookie(s): 3 missing Secure, 3 missing HttpOnly, 4 missing SameSite

Prečo je to dôležité: Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks.

Ako opraviť: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.

security.txt (RFC 9116)Upozornenie

Prečo je to dôležité: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all. Required by ISO 27001 and SOC 2.

Ako opraviť: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.

CDN / WAF ProtectionUpozornenie

Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts. Cloudflare blocks 150+ billion daily threats.

Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

Iframe SandboxingUpozornenie

1/1 unknown iframe(s) without sandbox attribute

Prečo je to dôležité: Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS.

Ako opraviť: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.

SSL/TLS CertificatePrešlo

Valid HTTPS connection established

DNSSECPrešlo

Zone is DNSSEC-signed (DNSKEY published)

Prečo je to dôležité: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.

HTTP → HTTPS RedirectPrešlo

HTTP properly redirects to HTTPS

HSTS (Strict-Transport-Security)Prešlo

max-age=31536000, preload, includeSubDomains

Clickjacking ProtectionPrešlo

X-Frame-Options: SAMEORIGIN

X-Content-Type-OptionsPrešlo

nosniff

Referrer-PolicyPrešlo

strict-origin-when-cross-origin

Permissions-PolicyPrešlo

microphone=(self), camera=(self)

Technology DisclosurePrešlo

Server: nginx (no version)

Subresource Integrity (SRI)Prešlo

All cross-origin scripts are auto-updating provider scripts where SRI does not apply

Server Version DisclosurePrešlo

Nginx — version hidden

Password Field SecurityPrešlo

1 password field(s) — allow password manager autofill

Mobile

61/100

Váha: 10% · 5 OK · 14 upozornení · 1 chýb · spolu 21

Form Input Labels (WCAG 3.3.2)Zlyhalo

Iba 10/45 inputs má label (22%)

Prečo je to dôležité: EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.

Ako opraviť: 35 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).

Viewport ConfigurationUpozornenie

Present, but maximum-scale=1 disables pinch-to-zoom

Prečo je to dôležité: Preventing pinch-to-zoom is an accessibility violation (WCAG 1.4.4). Users with vision impairments need zoom. Google penalizes sites that disable zoom.

Ako opraviť: Remove 'maximum-scale=1' and 'user-scalable=no' from your viewport meta tag. Use: <meta name='viewport' content='width=device-width, initial-scale=1'>

Mobile Performance ScoreUpozornenie

60/100 (target: 90+)

Prečo je to dôležité: Over 65% of e-commerce traffic is mobile (Statista 2024). Google ranks based on mobile performance, not desktop. Mobile score <50 means you're penalized in mobile search.

Ako opraviť: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.

Touch Target SizeUpozornenie

Prečo je to dôležité: Small tap targets cause 37% more mis-taps on mobile (Google UX research). In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityUpozornenie

Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience. Users over 40 are especially affected — and they have the highest purchasing power.

Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

PWA FeaturesUpozornenie

Has manifest, missing service worker

Prečo je to dôležité: PWA-enabled stores see 52% higher engagement and 36% higher conversion rates (Google case studies). Users can install the store as an app on their home screen.

Ako opraviť: Add a service worker to enable PWA features. Register a service worker for offline caching and faster repeat visits.

Theme ColorUpozornenie

Prečo je to dôležité: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional — small detail, big perception impact.

Ako opraviť: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.

Mobile Navigation (Semantic)Upozornenie

Prečo je to dôležité: Semantic <nav> elements are essential for mobile accessibility. Screen readers use them to let users jump directly to navigation — critical on small screens where content is long.

Ako opraviť: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').

Apple Mobile Web AppUpozornenie

Web manifest found but no Apple-specific meta tags

Prečo je to dôležité: Web manifests work for Android but iOS requires separate meta tags. Without them, iOS users get a degraded 'Add to Home Screen' experience.

Ako opraviť: iOS Safari doesn't fully support web manifests. Add Apple-specific meta tags for the best iOS experience: apple-mobile-web-app-capable, apple-touch-icon, and status-bar-style.

Form Input TypesUpozornenie

phone fields use type='text' instead of type='tel'

Prečo je to dôležité: Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors by 30% and speeds up form completion (Baymard Institute).

Ako opraviť: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.

Mobile Sticky CTAUpozornenie

Add-to-cart button found but no sticky/fixed positioning detected

Prečo je to dôležité: Mobile users scroll extensively. A sticky add-to-cart bar increases mobile conversion by 8-12% (Baymard Institute). Without it, users must scroll back up to purchase — many won't.

Ako opraviť: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.

Text Overflow HandlingUpozornenie

No word-break/overflow-wrap CSS detected

Prečo je to dôležité: Long strings without word-break cause horizontal overflow on mobile — the #1 cause of 'content wider than viewport' failures. German/Finnish compound words and URLs are common culprits.

Ako opraviť: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.

Print StylesheetUpozornenie

Order/invoice page without print styles

Prečo je to dôležité: Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce.

Ako opraviť: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.

Express Checkout (Apple Pay + Google Pay)Upozornenie

Iba Apple Pay detekovaný — chýba Google Pay

Prečo je to dôležité: iOS/Android majú 50/50 share. Jeden bez druhého znamená stratený revenue na polovici mobilných používateľov.

Ako opraviť: Pridaj Google Pay cez Stripe, Adyen alebo Mollie. Mobile conversion rate rastie o 10-20 % keď je express checkout dostupný.

Heading Hierarchy (WCAG 1.3.1)Upozornenie

Preskočené úrovne: h2→h4

Prečo je to dôležité: Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené.

Ako opraviť: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.

Content Fits ViewportPrešlo

No horizontal scrolling needed

Responsive Design TechniquesPrešlo

Media queries detected

Responsive Images (srcset)Prešlo

42 image(s) use srcset for responsive sizing

Payment Methods DetectedPrešlo

1 method(s): Apple Pay

Link Text Quality (WCAG 2.4.4)Prešlo

Všetky odkazy majú popisný text

SK/CZ Local Payment MethodsInfo

Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute

Prečo je to dôležité: SK/CZ shop bez bankových tlačidiel a QR platby = masívny cart abandonment. Priemerný SK e-shop má 6-8 payment metód. (Sken vidí iba homepage — over manuálne v checkoute.)

Ako opraviť: Ak SK/CZ local platby nemáš, integruj GoPay alebo ComGate — obe podporujú Tatra Pay, VÚB Pay, ČSOB Pay, Raiffeisen, QR platba v jednom API. Alternatívne Barion pre CZ trh.

AI Readiness

56/100

Váha: 10% · 8 OK · 26 upozornení · 4 chýb · spolu 40

llms.txt (AI Site Descriptor)Zlyhalo

Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.

Ako opraviť: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

Heading Hierarchy for AIZlyhalo

0 H1, 4 H2, 7 H3 — poor structure

Prečo je to dôležité: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Ako opraviť: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).

Content Freshness SignalsZlyhalo

Prečo je to dôležité: No freshness signals = AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

Ako opraviť: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.

Image Alt Text Quality for AIZlyhalo

Only 11% quality alt text — 217 missing, 54 poor

Prečo je to dôležité: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

Ako opraviť: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.

llms-full.txt (Complete AI Content)Upozornenie

Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

Ako opraviť: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.

Structured Data FoundationUpozornenie

3 schema types found (WebSite, Organization, SearchAction) — add more for comprehensive AI coverage

Prečo je to dôležité: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Research shows sites with comprehensive schema markup are 36% more likely to be cited by AI.

Ako opraviť: Expand your structured data: add Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage schemas. Sites with 4+ schema types are 36% more likely to appear in AI search summaries.

Organization Schema + Entity LinkingUpozornenie

Organization schema found but no sameAs links

Prečo je to dôležité: sameAs links tell AI: 'This is the same entity across the web.' Sites with sameAs to Wikipedia are 3x more likely to appear in AI-generated answers. It's how Google builds Knowledge Panels.

Ako opraviť: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.

FAQ Schema (Direct AI Answers)Upozornenie

Prečo je to dôležité: FAQ schema provides 30% higher AI citation rates (LLMClicks research). ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. It's the fastest way to get your content cited by AI.

Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Breadcrumb SchemaUpozornenie

Prečo je to dôležité: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.

Ako opraviť: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.

Semantic HTML StructureUpozornenie

3/6 elements — missing: <article>, <nav>, <aside>

Prečo je to dôležité: AI crawlers don't see your CSS. They rely on semantic HTML to distinguish main content from navigation, ads, and boilerplate. The WordLift AI Audit weights semantic HTML as a primary machine-readability signal.

Ako opraviť: Add: <article>, <nav>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.

Structured Content (Lists & Tables)Upozornenie

No structured content elements found

Prečo je to dôležité: Unstructured paragraph-only content is harder for AI to parse and cite. Pages with lists and tables get cited 30-40% more in AI-generated answers because AI can extract specific facts more reliably.

Ako opraviť: Add bulleted lists for features/benefits, numbered lists for steps/rankings, and tables for comparisons/specifications. These are the content formats AI extracts most reliably.

Entity Clarity & Brand SignalsUpozornenie

OG tags complete but no sameAs entity links

Prečo je to dôležité: AI needs to confidently identify your brand entity. Open Graph + sameAs create a cross-platform identity that AI models recognize. The HubSpot AEO Grader found entity clarity is a top-3 factor for AI brand recognition.

Ako opraviť: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.

Author Expertise Signals (E-E-A-T)Upozornenie

Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited 3x more than anonymous content. This is especially important for product guides, reviews, and advice content.

Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

AI Plugin ManifestUpozornenie

Prečo je to dôležité: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.

Ako opraviť: Create /.well-known/ai-plugin.json if you have an API. This enables direct AI agent integration (ChatGPT Actions, custom GPTs). Include: name_for_model, description_for_model, auth config, and link to OpenAPI spec.

Product Feed (AI Commerce)Upozornenie

Prečo je to dôležité: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.

Ako opraviť: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.

Heureka XML FeedUpozornenie

Prečo je to dôležité: Heureka.sk a Heureka.cz sú dominantné cenové porovnávače na SK/CZ trhu (40%+ all e-com discovery traffic). Bez XML feedu nie ste viditeľní na hlavnom trhovisku — strata 20-30 % potenciálneho traffic. Žiaden generický audit tool toto nekontroluje.

Ako opraviť: Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).

Speakable Content (Voice AI)Upozornenie

Prečo je to dôležité: Voice AI commerce is growing rapidly. SpeakableSpecification tells voice assistants which content to read aloud. Early adoption positions your store for the voice shopping wave.

Ako opraviť: Add SpeakableSpecification schema to identify content sections suitable for voice assistants (Google Assistant, Alexa, Siri). Mark your product summaries and FAQs as speakable.

Extractable Answer BlocksUpozornenie

5 paragraphs, avg 151 words — too long for AI snippets

Prečo je to dôležité: Pages with 40-80 word paragraphs earn 70% more AI citations (Otterly 2026 data). AI extracts individual paragraphs as answer snippets — dense walls of text get skipped.

Ako opraviť: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.

Section Length OptimizationUpozornenie

Avg section: 203 words — only 0% in 80-200 word optimal range

Prečo je to dôležité: Pages with 120-180 word sections earn 70% more AI citations (Otterly Citation Economy 2026). For Google AI Overviews specifically, 100-150 words per section is the sweet spot.

Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Q&A Format HeadingsUpozornenie

Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

Ako opraviť: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.

Canonical Tag for AI DeduplicationUpozornenie

Canonical points to different URL: https://www.lunys.sk/

Prečo je to dôležité: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.

Ako opraviť: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.

Return Policy SchemaUpozornenie

Prečo je to dôležité: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.

Ako opraviť: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.

Shipping Details SchemaUpozornenie

Prečo je to dôležité: Fulfillment speed now factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a massive conversion driver.

Ako opraviť: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.

Knowledge Graph ReadinessUpozornenie

2/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn)

Prečo je to dôležité: Brands with verified Knowledge Graph presence receive 3.1x more AI citations. @id creates a persistent entity identifier that connects your schema across pages and platforms.

Ako opraviť: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.

Content Readability for AIUpozornenie

Grade 20 — too complex for broad AI citation (technical threshold: 14)

Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are 28% more likely to be cited by AI.

Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Expert Quotations & CitationsUpozornenie

Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

ai.txt (AI Permissions)Upozornenie

Prečo je to dôležité: ai.txt is an emerging standard (proposed May 2025) for fine-grained AI permissions beyond robots.txt. Early adoption signals AI-forward thinking and gives you control over how AI uses your content.

Ako opraviť: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.

WebMCP Agentic ReadinessUpozornenie

Prečo je to dôležité: WebMCP is called 'the new Schema.org moment' — it's how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

Content-to-Boilerplate RatioUpozornenie

38% in main content area — too much boilerplate

Prečo je to dôležité: AI crawlers specifically target <main> and <article> content blocks. If most of your text is in navigation, footers, and sidebars, AI gets noise instead of signal — reducing citation quality.

Ako opraviť: Move more content into <main> or <article> elements. Reduce navigation text, footer content, and sidebar noise. AI crawlers extract content from semantic containers and discard the rest.

Customer Reviews — AggregateUpozornenie

1 source: Heureka Ověřeno

Prečo je to dôležité: Without a second review source and a machine-readable reviewCount, AI assistants can't verify scale of social proof — single-source ratings are routinely deweighted as potentially curated.

Ako opraviť: Single review source detected without published reviewCount. Add AggregateRating JSON-LD (ratingValue + reviewCount + bestRating) so the count is machine-readable, and add a second source (Heureka Ověřeno + Trustpilot is the SK/CZ standard).

AI Bot Access PolicyPrešlo

No AI bot restrictions (allowed by default)

Content Accessibility for AIPrešlo

2719 words in raw HTML (3.8% text ratio) — readable by AI crawlers without executing JS

Site Search Schema (SearchAction)Prešlo

WebSite SearchAction configured — AI can search your store

Content Depth for AIPrešlo

2719 words — rich content for AI analysis and citation

Answer-First Content FormatPrešlo

First paragraph: 722 words — good content density above the fold

Statistics & Data PresencePrešlo

30 data points found — strong citation magnet

Internal Link DensityPrešlo

28 contextual internal links per 1,000 words — strong knowledge graph signal

Heureka Ověřeno WidgetPrešlo

Heureka trust widget detected

Prečo je to dôležité: Heureka Ověřeno is the dominant SK/CZ social-proof program — buyers trust it 2× more than generic ratings. Verified shops with a public obchody.heureka.* profile show stronger long-term provenance than just a widget script.

Product Schema CompletenessInfo

No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit

Prečo je to dôležité: Product schema only belongs on product pages, so its absence on this page is expected — not a defect. Scan a product URL to evaluate it.

Ako opraviť: To audit Product schema, run the scan on a product detail URL. On product pages add: name, description, image, offers (price, priceCurrency, availability), brand, sku, aggregateRating.

Reviews & Ratings SchemaInfo

No review schema on this homepage — review/rating schema typically lives on product pages

Prečo je to dôležité: Review schema is product-page-specific, so its absence here is expected, not a defect.

Ako opraviť: Scan a product URL to audit review schema. On product pages add AggregateRating (ratingValue, reviewCount, bestRating) and individual Review schemas.

GDPR

72/100

Váha: 10% · 10 OK · 6 upozornení · 2 chýb · spolu 18

Google Consent Mode v2Zlyhalo

Prečo je to dôležité: Google requires Consent Mode v2 for all EU traffic since March 2024. Without it, Google Ads remarketing and conversion data will not function, and you lose measurement data.

Ako opraviť: Implement Google Consent Mode v2 with gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied' }). Required since March 2024 for EU audiences.

GDPR Art. 6(1)(a) · GDPR Art. 7 · SK 18/2018 § 14

Consumer Dispute Resolution LinksZlyhalo

No EU ODR platform or supervisory-authority link found

Prečo je to dôležité: EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a frequently-fined consumer-law breach.

Ako opraviť: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.

Nariadenie (EÚ) 524/2013 (ODR) · Smernica 2013/11/EÚ (ADR) · SK zák. 391/2015 Z.z. · CZ zák. 634/1992 Sb. § 14

Cookie PolicyUpozornenie

Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.

Personal Data Exposure in SourceUpozornenie

2 personal email(s) in page source: zakaznik@lunys.sk, objednavkypp@lunys.sk

Prečo je to dôležité: A named individual's email is personal data under GDPR Art. 4(1); publishing it in source breaches data minimisation (Art. 5(1)(c)). Role mailboxes like info@ are intentionally public and are not flagged here.

Ako opraviť: Remove person-named email addresses (e.g. firstname.lastname@) from the public HTML. Use role mailboxes (info@, sales@) or a contact form instead.

Right to Erasure (Data Deletion)Upozornenie

Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process. Italian DPA fined companies €20M+ for obstructing erasure requests.

Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Age VerificationUpozornenie

Age-restricted content detected without age gate

Prečo je to dôležité: EU member states require age verification for age-restricted products. German JuSchG (Youth Protection Act) and similar laws mandate age gates. Missing them risks regulatory action and marketplace delisting.

Ako opraviť: Implement age verification for alcohol, tobacco, gambling, or adult content. Use a date-of-birth check or age confirmation modal before accessing the site.

Omnibus Price Disclosure (30-day low)Upozornenie

Discounts shown without a visible 'lowest price in last 30 days' reference

Prečo je to dôležité: The EU Omnibus Directive (2019/2161), enacted in SK as zák. 108/2024 and CZ via zák. 634/1992, makes the 30-day reference price MANDATORY on every advertised discount. ŠOI/ČOI actively fine missing disclosures — and a '−40%' off an inflated base is exactly what they target.

Ako opraviť: Whenever you advertise a price reduction, display the lowest price applied in the 30 days before the discount, next to the new price. In PrestaShop add a 30-day price-history anchor (e.g. our zu_pricehistory module) so every sale label is compliant automatically.

Withdrawal & Complaints PolicyUpozornenie

Missing: right of withdrawal (odstúpenie od zmluvy)

Prečo je to dôležité: The Consumer Rights Directive (2011/83/EU) and SK zák. 108/2024 / CZ zák. 89/2012 require pre-contractual disclosure of the 14-day withdrawal right and an accessible complaints procedure. Missing them extends customers' cancellation rights and is a standard ŠOI/ČOI finding.

Ako opraviť: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.

Cookie Consent Banner (CMP)Prešlo

Cookiebot detected

Tracking Scripts & ConsentPrešlo

2 tracker(s) detected with CMP: Google Analytics/GTM, Hotjar

Privacy Policy PagePrešlo

/ochrana-sukromia

Legal Contact / Imprint PagePrešlo

https://www.lunys.sk/o-nas

Terms & Conditions PagePrešlo

https://www.lunys.sk/vseobecne-obchodne-podmienky-a27

Data Encryption (No Mixed Content)Prešlo

All resources loaded over HTTPS

Third-party Data SharingPrešlo

1 third-party domain(s)

Newsletter ConsentPrešlo

Newsletter form with consent mechanism detected

Data Protection Officer ContactPrešlo

DPO / data protection contact found

Withdrawal of Consent MechanismPrešlo

Consent withdrawal / opt-out mechanism found

Vulnerability

65/100

Váha: 10% · 7 OK · 6 upozornení · 2 chýb · spolu 15

Admin Panel at Default URLZlyhalo

Accessible at: /admin

Prečo je to dôležité: Default admin URLs receive thousands of automated brute-force attempts daily. Botnets target /admin, /wp-admin, /administrator relentlessly. A renamed path blocks 99% of automated attacks.

Ako opraviť: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).

Payment Page SecurityZlyhalo

Payment page missing: No CSP

Prečo je to dôležité: Payment pages without proper security headers violate PCI DSS. This can result in fines of $5,000-$100,000/month from payment processors, and makes card data theft significantly easier.

Ako opraviť: CRITICAL: Your payment page is missing security headers: No CSP. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.

Form CSRF ProtectionUpozornenie

31/32 forms have CSRF tokens

Prečo je to dôležité: Forms without CSRF tokens allow cross-site request forgery — an attacker's site can submit orders, change settings, or modify data on behalf of your logged-in users.

Ako opraviť: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().

Inline JavaScript ExposureUpozornenie

52 KB of inline JavaScript

Prečo je to dôležité: Large amounts of inline JavaScript prevent proper CSP implementation and increase the risk of XSS. External scripts can be protected with SRI hashes.

Ako opraviť: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).

DMARC Policy (Email Auth)Upozornenie

DMARC set to p=none (monitoring only, no enforcement)

Prečo je to dôležité: DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes.

Ako opraviť: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.

Cross-Origin IsolationUpozornenie

Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

Inline Event HandlersUpozornenie

28 inline event handlers (onclick, onmouseover, etc.)

Prečo je to dôležité: Inline event handlers are a legacy pattern that prevents Content Security Policy enforcement. They also make XSS attacks easier — injected HTML attributes can execute JavaScript immediately.

Ako opraviť: Move inline event handlers to external JavaScript files using addEventListener(). Inline handlers prevent proper CSP implementation (require 'unsafe-inline') and increase XSS attack surface.

Login Form SecurityUpozornenie

Prečo je to dôležité: NIST guidelines recommend allowing password autofill. Blocking it forces users to choose weak, memorable passwords — a leading cause of credential compromise.

Ako opraviť: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.

CMS Version DisclosurePrešlo

No generator tag — CMS identity hidden

Sensitive Files ExposedPrešlo

.env, .git, composer.json — all properly blocked

Install Script ExposedPrešlo

No /install/ or /setup/ paths accessible

Directory ListingPrešlo

Disabled — file structure hidden

Debug Mode / Error ExposurePrešlo

No debug indicators found in page output

SPF Record (Email Security)Prešlo

SPF configured: v=spf1 ip4:185.59.208.196 ip4:5.178.48.82 ip4:213.151.240.75 ip4:185.25.248.40 i

DKIM Signing (Email Auth)Prešlo

DKIM configured (selectors: k2, selector1, mail)

Ďalšie kroky

Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/lunys.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk