# ant.sk — Zulien Score 79/100 (Grade B)

> Free e-commerce audit: 79/100 overall score. Platform: PrestaShop. Company: ant s.r.o.. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://ant.sk
- **Platform:** PrestaShop
- **Company:** ant s.r.o.
- **Scan date:** 2026-10-07
- **Full report:** https://score.zulien.sk/ro/r/ant.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/ant.sk

## Audit summary

Your site performs solidly but has five critical gaps. Urgently set up DMARC email authentication and secure your payment pages. Congratulations on strong SEO and GDPR compliance.

## Score by category

| Category | Score |
|---|---|
| Performance | 77/100 |
| SEO | 91/100 |
| Security | 74/100 |
| Mobile | 80/100 |
| AI Readiness | 71/100 |
| GDPR | 87/100 |
| Vulnerability | 76/100 |
| Accessibility | 72/100 |

## Detailed findings

### Performance — 77/100

- **[FAIL]** Cumulative Layout Shift (CLS) — 0.298 (good: <0.1) — Core Web Vital FAILING
  - Fix: Urgent layout stability issues. 1) Add width/height to all <img> and <video>, 2) Reserve space for ads with min-height, 3) Use font-display: swap for web fonts, 4) Don't dynamically inject content above visible area.
  - Evidence: PSI-lab
- **[FAIL]** Total Page Weight — 5.5 MB, 43 requests — too heavy!
  - Fix: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Evidence: PSI-lab
- **[FAIL]** Unused Code (CSS + JS) — 256 KB wasted on unused code!
  - Fix: You're loading 256 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Evidence: PSI-lab
- **[FAIL]** Script Loading Strategy — Only 0% of 1 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.
  - Evidence: HTML-heuristic
- **[WARN]** Cache-Control Strategy — no-cache, private
  - Fix: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
  - Evidence: HTTP-header
- **[WARN]** CSS File Count — 4 CSS files loaded
  - Fix: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
  - Evidence: HTML-heuristic
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[INFO]** Third-party Services — Not measured — PageSpeed did not return the third-party audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[PASS]** Server Response Time (TTFB) — 24ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.77s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 1.04s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 32ms
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 0.77s
  - Evidence: PSI-lab
- **[PASS]** JavaScript Budget — 503 KB — within the 600 KB budget
  - Evidence: PSI-lab · 503 KB JavaScript · confidence: high
- **[PASS]** Request Budget — 43 requests — within the budget of 80
  - Evidence: PSI-lab · 43 requests · confidence: high
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 2 preload, 2 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** Lazy Loading — 63% of images use native lazy loading (36/57)
  - Evidence: HTML-heuristic
- **[PASS]** Font Loading Strategy — font-display: swap
  - Evidence: HTML-heuristic
- **[PASS]** Critical CSS Strategy — Critical CSS / async CSS loading detected
  - Evidence: PSI-lab

### SEO — 91/100

- **[WARN]** Meta Title — 5 chars (optimal: 30-60)
  - Fix: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.
  - Evidence: HTML-heuristic
- **[WARN]** Open Graph Tags — Missing: og:description, og:image
  - Fix: Add the missing OG tags: og:description, og:image. Use high-quality 1200×630px images for og:image.
  - Evidence: HTML-heuristic
- **[WARN]** Twitter/X Cards
  - Fix: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Evidence: HTML-heuristic
- **[WARN]** Empty/Dead Links — 9 dead links (8 empty, 1 hash-only, 0 javascript:void)
  - Fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Evidence: HTML-heuristic
- **[WARN]** Broken Image Sources — 2 image(s) with empty src attribute
  - Fix: Fix images with empty src=''. Either add proper URLs or use loading='lazy' with valid data-src for lazy-loaded images.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 7% ratio but 1266 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Meta Description — 137 chars
  - Evidence: HTML-heuristic
- **[PASS]** H1 Heading — "Vybavujemeprofesionálov,ktorí to myslia vážne."
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 13 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://ant.sk
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 1 block(s): Organization, ImageObject, WebSite, SearchAction
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 1 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with 587 URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk"
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Attributes — 100% of 57 images have alt text
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — index, follow, max-image-preview:large, max-snippet:-1
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Image Format Optimization — 82% next-gen formats (10 WebP, 35 AVIF)
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Content Depth — 1266 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 13, H3: 16 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 36 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 3/4 a11y signals: 1 ARIA roles, 19 ARIA labels, lang="sk"
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 0 day(s) ago
  - Evidence: HTML-heuristic

### Security — 74/100

- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** Cookie Security Flags — 3 cookie(s): 1 missing HttpOnly
  - Fix: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Evidence: HTTP-header
- **[WARN]** Technology Disclosure — Server: nginx/1.24.0 (Ubuntu)
  - Fix: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Evidence: HTTP-header
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** Server Version Disclosure — Nginx 1.24.0 exposed in headers
  - Fix: Hide server version. Apache: add 'ServerTokens Prod' and 'ServerSignature Off' to httpd.conf. Nginx: add 'server_tokens off;' to nginx.conf.
  - Evidence: HTTP-header
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[WARN]** Iframe Sandboxing — 1/1 unknown iframe(s) without sandbox attribute
  - Fix: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** Cookie Prefix Security — 1 session cookie(s) already have Secure + HttpOnly + SameSite; adding the __Host- prefix is a cosmetic hardening nicety
  - Evidence: HTTP-header · 1 session cookie(s), all with Secure+HttpOnly+SameSite · confidence: low
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
  - Evidence: DNS
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** HSTS (Strict-Transport-Security) — max-age=31536000, includeSubDomains
  - Evidence: HTTP-header
- **[PASS]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN
  - Evidence: HTTP-header
- **[PASS]** X-Content-Type-Options — nosniff
  - Evidence: HTTP-header
- **[PASS]** Referrer-Policy — strict-origin-when-cross-origin
  - Evidence: HTTP-header
- **[PASS]** Permissions-Policy — geolocation=(), microphone=(), camera=(), interest-cohort=()
  - Evidence: HTTP-header
- **[PASS]** Subresource Integrity (SRI) — No SRI-eligible third-party scripts loaded
  - Evidence: HTML-heuristic

### Mobile — 80/100

- **[FAIL]** Form Input Labels (WCAG 3.3.2) — Only 0/1 inputs have a label (0%)
  - Fix: 1 input elements have no label. Every input needs a matching <label for="id">Text</label> or an aria-label. A placeholder is NOT a label (WCAG 3.3.2). On a checkout or registration form this costs conversion and breaches EN 301 549 (EAA 2026).
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Performance Score — 80/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[WARN]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Theme Color — theme-color meta tag present
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Images (srcset) — 80 image(s) use srcset for responsive sizing
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy (WCAG 1.3.1) — No skipped heading levels
  - Evidence: HTML-heuristic
- **[PASS]** Link Text Quality (WCAG 2.4.4) — All links have descriptive text
  - Evidence: HTML-heuristic

### AI Readiness — 71/100

- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Entity Clarity & Brand Signals
  - Fix: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 42% quality alt text — 0 missing, 28 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Data Foundation — 3 distinct schema types (BusinessEntity, WebSite, BreadcrumbList) — add more for comprehensive AI coverage
  - Fix: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
  - Evidence: schema
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Structured Content (Lists & Tables) — 4 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 38 words — only 11% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Knowledge Graph Readiness — 2/4 signals — missing: consistent brand name (title/schema/OG), sameAs links (Wikipedia, LinkedIn)
  - Fix: Add: consistent brand name (title/schema/OG), sameAs links (Wikipedia, LinkedIn). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 18 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations — 1 quotation found — add more for authority
  - Fix: Add expert quotes, customer testimonials, or industry citations using <blockquote> elements.
  - Evidence: HTML-heuristic
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Evidence: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Evidence: file-probe
- **[INFO]** Social Proof (Testimonials / Case Studies) — Detected: case studies / portfolio. For a non-commercial/informational site, testimonials and case studies are optional
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 1266 words in raw HTML (7.5% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Organization Schema + Entity Linking — Organization found with 1 sameAs links — strong entity identity
  - Evidence: schema
- **[PASS]** Breadcrumb Schema — BreadcrumbList structured data found — clear navigation hierarchy
  - Evidence: schema
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Evidence: schema
- **[PASS]** Content Depth for AI — 1266 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 553 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Heading Hierarchy for AI — Proper structure: 1 H1 → 13 H2s → 16 H3s — clear content outline
  - Evidence: HTML-heuristic
- **[PASS]** Semantic HTML Structure — 5/6 semantic elements: <article>, <nav>, <main>, <header>, <footer>
  - Evidence: HTML-heuristic
- **[PASS]** Extractable Answer Blocks — 27 paragraphs, avg 79 words — optimal for AI extraction
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 28 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Canonical Tag for AI Deduplication — Self-referencing canonical — clean signal for AI
  - Evidence: HTML-heuristic
- **[PASS]** Content-to-Boilerplate Ratio — 88% of text in <main>/<article> — clean content signal
  - Evidence: HTML-heuristic

### GDPR — 87/100

- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[WARN]** Withdrawal of Consent Mechanism
  - Fix: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Evidence: HTML-heuristic
- **[PASS]** Cookie Consent Banner (CMP) — Cookiebot detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — 2 tracker(s) detected with CMP: Google Analytics/GTM, Meta Pixel
  - Evidence: HTML-heuristic
- **[PASS]** Google Consent Mode v2 — Consent mode signals detected (ad_storage, analytics_storage)
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — /gdpr
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — /o-nas
  - Evidence: HTML-heuristic
- **[PASS]** Terms & Conditions Page — /obchodne-podmienky
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic

### Vulnerability — 76/100

- **[FAIL]** DMARC Policy (Email Auth)
  - Fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
  - Evidence: DNS
- **[FAIL]** Payment Page Security — Payment page missing: No CSP
  - Fix: CRITICAL: Your payment page is missing security headers: No CSP. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Evidence: file-probe
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[PASS]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Evidence: HTML-heuristic
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 include:_spf.mailersend.net a mx include:_spf.m1.websupport.sk include:sp
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: selector1, selector2)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).

### Accessibility — 72/100

- **[FAIL]** Form Labels — 1 of 1 form inputs have no associated label
  - Fix: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.
  - Evidence: HTML-heuristic
- **[WARN]** Skip Link — No skip-to-content link detected
  - Fix: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Evidence: HTML-heuristic · confidence: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[PASS]** Page Language — <html lang="sk"> is set
  - Evidence: HTML-heuristic
- **[PASS]** Image Alt Text — All 57 images have alt attributes
  - Evidence: HTML-heuristic
- **[PASS]** Heading Structure — Single <h1> with a consistent heading outline
  - Evidence: HTML-heuristic
- **[PASS]** Link Text — Links use descriptive text
  - Evidence: HTML-heuristic · confidence: low
- **[PASS]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Evidence: HTML-heuristic
- **[PASS]** Zoom & Scaling — Pinch-zoom is not disabled
  - Evidence: HTML-heuristic

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/ro/r/ant.sk)