# kolibahoreca.sk — Zulien Score 75/100 (Grade B)

> Free e-commerce audit: 75/100 overall score. Platform: WordPress. Company: KOLIBA HORECA s.r.o.. 100+ checkpoints in 7 categories (Performance, SEO, Security, Mobile, AI Readiness, GDPR, Vulnerability).

- **Audited:** https://kolibahoreca.sk
- **Platform:** WordPress
- **Company:** KOLIBA HORECA s.r.o.
- **Scan date:** 2026-07-02
- **Full report:** https://score.zulien.sk/ro/r/kolibahoreca.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/kolibahoreca.sk

## Audit summary

Your site has a solid foundation but needs stronger security measures. Priority: enable HTTPS protection (HSTS) and security headers immediately. Your SEO and GDPR compliance are strong points.

## Score by category

| Category | Score |
|---|---|
| Performance | 91/100 |
| SEO | 77/100 |
| Security | 59/100 |
| Mobile | 76/100 |
| AI Readiness | 60/100 |
| GDPR | 87/100 |
| Vulnerability | 52/100 |

## Detailed findings

### Performance — 91/100

- **[FAIL]** Script Loading Strategy — Only 11% of 18 scripts optimized — most are render-blocking
  - Fix: Add defer or async to all <script src='...'> tags. Render-blocking scripts are the #1 cause of slow FCP. Defer maintains execution order, async does not.
  - Evidence: HTML-heuristic
- **[FAIL]** CSS File Count — 30 CSS files — too many!
  - Fix: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Evidence: HTML-heuristic
- **[WARN]** Total Page Weight — 1.9 MB, 72 requests (optimal: <1.5 MB, <50 req)
  - Fix: Reduce page weight: compress images to WebP (saves 30-50%), enable text compression (gzip/brotli), lazy load below-fold images, remove unused CSS/JS.
  - Evidence: PSI-lab
- **[WARN]** Font Preloading — Custom fonts detected without preload hints
  - Fix: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Evidence: HTML-heuristic
- **[WARN]** Critical CSS Strategy — 30 CSS files without critical CSS extraction
  - Fix: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Evidence: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Evidence: PSI-lab
- **[INFO]** Cache-Control Strategy — Not measured — no Cache-Control on the HTML document; static-asset caching was not sampled
  - Evidence: HTTP-header
- **[PASS]** Server Response Time (TTFB) — 48ms
  - Evidence: PSI-lab
- **[PASS]** First Contentful Paint (FCP) — 0.48s
  - Evidence: PSI-lab
- **[PASS]** Largest Contentful Paint (LCP) — 0.86s — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Total Blocking Time (TBT) — 0ms
  - Evidence: PSI-lab
- **[PASS]** Cumulative Layout Shift (CLS) — 0.000 — Core Web Vital ✓
  - Evidence: PSI-lab
- **[PASS]** Speed Index — 1.01s
  - Evidence: PSI-lab
- **[PASS]** Unused Code (CSS + JS) — Only 21 KB of unused code — well optimized
  - Evidence: PSI-lab
- **[PASS]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Evidence: HTTP-header
- **[PASS]** Resource Hints (Preload/Preconnect) — 1 preload, 0 preconnect hint(s)
  - Evidence: HTML-heuristic
- **[PASS]** Lazy Loading — 41% of images use native lazy loading (11/27)
  - Evidence: HTML-heuristic
- **[PASS]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Evidence: HTTP-header

### SEO — 77/100

- **[FAIL]** H1 Heading
  - Fix: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Attributes — Only 0% of 27 images have alt text
  - Fix: 27 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.
  - Evidence: HTML-heuristic
- **[WARN]** Meta Title — 13 chars (optimal: 30-60)
  - Fix: Your title is very short. Add descriptive keywords and your brand name for better ranking signals.
  - Evidence: HTML-heuristic
- **[WARN]** Meta Description — 257 chars (optimal: 120-160)
  - Fix: Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.
  - Evidence: HTML-heuristic
- **[WARN]** Image Format Optimization — 0% next-gen formats — 1 JPEG, 12 PNG images
  - Fix: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Evidence: HTML-heuristic
- **[WARN]** Semantic HTML Structure — Only 2/6 semantic elements — missing: <article>, <header>, <footer>, <aside>
  - Fix: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
  - Evidence: HTML-heuristic
- **[WARN]** Empty/Dead Links — 9 dead links (0 empty, 9 hash-only, 0 javascript:void)
  - Fix: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Evidence: HTML-heuristic
- **[WARN]** Excessive Resource Requests — 18 JS + 30 CSS = 48 external requests
  - Fix: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.
  - Evidence: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 2% ratio but 724 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Evidence: HTML-heuristic
- **[PASS]** Content Structure (H2 Headings) — 5 H2 subheadings found
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Evidence: HTML-heuristic
- **[PASS]** Open Graph Image Format — image/jpeg
  - Evidence: HTML-heuristic
- **[PASS]** Twitter/X Cards — Card type: summary_large_image
  - Evidence: HTML-heuristic
- **[PASS]** Canonical URL — https://kolibahoreca.sk/
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data (JSON-LD) — 1 block(s): WebSite, SearchAction, EntryPoint, WebPage
  - Evidence: schema
- **[PASS]** JSON-LD Validity — 1 block(s) parse cleanly
  - Evidence: HTML-heuristic
- **[PASS]** robots.txt — Present, references sitemap
  - Evidence: file-probe
- **[PASS]** XML Sitemap — Found with ~30+ URLs
  - Evidence: file-probe
- **[PASS]** HTML Language Attribute — lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Meta Robots Tag — max-snippet:-1,max-image-preview:large,max-video-preview:-1
  - Evidence: HTML-heuristic
- **[PASS]** Favicon — Favicon detected
  - Evidence: file-probe
- **[PASS]** Content Depth — 724 words — sufficient content
  - Evidence: HTML-heuristic
- **[PASS]** Deep Heading Hierarchy — H2: 5, H3: 5 — well-structured content
  - Evidence: HTML-heuristic
- **[PASS]** Internal Linking — 9 internal links — strong site navigation
  - Evidence: HTML-heuristic
- **[PASS]** Accessibility Fundamentals — 4/4 a11y signals: 21 ARIA roles, 15 ARIA labels, skip link, lang="sk-SK"
  - Evidence: HTML-heuristic
- **[PASS]** Sitemap Freshness — Newest <lastmod> 1 day(s) ago
  - Evidence: HTML-heuristic

### Security — 59/100

- **[FAIL]** HSTS (Strict-Transport-Security)
  - Fix: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Evidence: HTTP-header
- **[FAIL]** Content-Security-Policy (CSP)
  - Fix: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Evidence: HTTP-header
- **[FAIL]** Clickjacking Protection
  - Fix: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Evidence: HTTP-header
- **[WARN]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Fix: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Evidence: DNS
- **[WARN]** X-Content-Type-Options
  - Fix: Add header: X-Content-Type-Options: nosniff
  - Evidence: HTTP-header
- **[WARN]** Referrer-Policy
  - Fix: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Evidence: HTTP-header
- **[WARN]** Permissions-Policy
  - Fix: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Evidence: HTTP-header
- **[WARN]** security.txt (RFC 9116)
  - Fix: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Evidence: file-probe
- **[WARN]** CDN / WAF Protection
  - Fix: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Evidence: HTTP-header
- **[PASS]** SSL/TLS Certificate — Valid HTTPS connection established
  - Evidence: SSL
- **[PASS]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
  - Evidence: DNS
- **[PASS]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Evidence: HTTP-header
- **[PASS]** Cookie Security Flags — No cookies set on initial response
  - Evidence: HTTP-header
- **[PASS]** Technology Disclosure — Server: nginx (no version)
  - Evidence: HTTP-header
- **[PASS]** Subresource Integrity (SRI) — No SRI-eligible third-party scripts loaded
  - Evidence: HTML-heuristic
- **[PASS]** Server Version Disclosure — Nginx — version hidden
  - Evidence: HTTP-header

### Mobile — 76/100

- **[FAIL]** Link Text Quality (WCAG 2.4.4) — 4/70 odkazov (6%) má vágny text
  - Fix: Vysoké % generických odkazov ('click here', 'read more', 'tu', 'viac'). Každý odkaz musí byť pochopiteľný mimo kontextu — 'Detail produktu Zimná bunda' namiesto len 'Detail'.
  - Evidence: HTML-heuristic
- **[WARN]** Mobile Performance Score — 78/100 (target: 90+)
  - Fix: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.
  - Evidence: PSI-lab
- **[WARN]** Touch Target Size
  - Fix: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Evidence: HTML-heuristic
- **[WARN]** Font Size Readability
  - Fix: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
  - Evidence: HTML-heuristic
- **[WARN]** Theme Color
  - Fix: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Evidence: HTML-heuristic
- **[WARN]** Apple Mobile Web App — Missing: apple-mobile-web-app-capable, status-bar-style
  - Fix: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
  - Evidence: HTML-heuristic
- **[WARN]** Print Stylesheet — Order/invoice page without print styles
  - Fix: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Evidence: HTML-heuristic
- **[WARN]** Fixed Width Elements — Large fixed-width elements detected — may cause horizontal scroll
  - Fix: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
  - Evidence: HTML-heuristic
- **[PASS]** Viewport Configuration — width=device-width, initial-scale=1
  - Evidence: HTML-heuristic
- **[PASS]** Content Fits Viewport — No horizontal scrolling needed
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Evidence: HTML-heuristic
- **[PASS]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Evidence: HTML-heuristic
- **[PASS]** Responsive Images (srcset) — 12 image(s) use srcset for responsive sizing
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Types — Optimized: 1 email, 1 tel
  - Evidence: HTML-heuristic
- **[PASS]** Form Input Labels (WCAG 3.3.2) — 13/13 inputs majú label
  - Evidence: HTML-heuristic

### AI Readiness — 60/100

- **[FAIL]** llms.txt (AI Site Descriptor)
  - Fix: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
  - Evidence: file-probe
- **[FAIL]** Heading Hierarchy for AI — 0 H1, 5 H2, 5 H3 — poor structure
  - Fix: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Evidence: HTML-heuristic
- **[FAIL]** Content Freshness Signals
  - Fix: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Evidence: HTML-heuristic
- **[FAIL]** Image Alt Text Quality for AI — Only 0% quality alt text — 27 missing, 0 poor
  - Fix: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Evidence: HTML-heuristic
- **[WARN]** llms-full.txt (Complete AI Content)
  - Fix: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
  - Evidence: file-probe
- **[WARN]** Organization Schema + Entity Linking — Organization schema found but no sameAs links
  - Fix: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.
  - Evidence: schema
- **[WARN]** FAQ Schema (Direct AI Answers)
  - Fix: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Evidence: schema
- **[WARN]** Semantic HTML Structure — 2/6 elements — missing: <article>, <header>, <footer>, <aside>
  - Fix: Add: <article>, <header>, <footer>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
  - Evidence: HTML-heuristic
- **[WARN]** Structured Content (Lists & Tables) — 12 lists found — consider adding comparison tables
  - Fix: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.
  - Evidence: HTML-heuristic
- **[WARN]** Entity Clarity & Brand Signals — OG tags complete but no sameAs entity links
  - Fix: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Author Expertise Signals (E-E-A-T)
  - Fix: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Evidence: HTML-heuristic
- **[WARN]** Extractable Answer Blocks — 15 paragraphs, avg 25 words — too short for citation
  - Fix: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Evidence: HTML-heuristic
- **[WARN]** Statistics & Data Presence — No statistical data found in content
  - Fix: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.
  - Evidence: HTML-heuristic
- **[WARN]** Section Length Optimization — Avg section: 75 words — only 11% in 80-200 word optimal range
  - Fix: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Evidence: HTML-heuristic
- **[WARN]** Q&A Format Headings
  - Fix: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Evidence: HTML-heuristic
- **[WARN]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://kolibahoreca.sk/
  - Fix: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Evidence: HTML-heuristic
- **[WARN]** Content Readability for AI — Grade 20 — too complex for broad AI citation (technical threshold: 14)
  - Fix: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Evidence: HTML-heuristic
- **[WARN]** Expert Quotations & Citations
  - Fix: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Evidence: HTML-heuristic
- **[WARN]** ai.txt (AI Permissions)
  - Fix: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
  - Evidence: file-probe
- **[WARN]** WebMCP Agentic Readiness
  - Fix: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Evidence: HTML-heuristic
- **[WARN]** Content-to-Boilerplate Ratio — 54% in main content area — too much boilerplate
  - Fix: Move more content into <main> or <article> elements. Reduce navigation text, footer content, and sidebar noise. AI crawlers extract content from semantic containers and discard the rest.
  - Evidence: HTML-heuristic
- **[WARN]** Social Proof (Testimonials / Case Studies) — Only testimonials detected
  - Fix: Add visible client testimonials (<blockquote> with name/role/company), case study links, and a 'Trusted by' client logo strip. B2B buyers evaluate credibility before contact — multiple social proof signals reinforce expertise.
  - Evidence: HTML-heuristic
- **[PASS]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Evidence: file-probe
- **[PASS]** Content Accessibility for AI — 724 words in raw HTML (2.5% text ratio) — readable by AI crawlers without executing JS
  - Evidence: HTML-heuristic
- **[PASS]** Structured Data Foundation — 1 JSON-LD blocks with 9 schema types: WebSite, SearchAction, EntryPoint, WebPage, BreadcrumbList, ListItem
  - Evidence: schema
- **[PASS]** Breadcrumb Schema — BreadcrumbList structured data found — clear navigation hierarchy
  - Evidence: schema
- **[PASS]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Evidence: schema
- **[PASS]** Content Depth for AI — 724 words — rich content for AI analysis and citation
  - Evidence: HTML-heuristic
- **[PASS]** Answer-First Content Format — First paragraph: 47 words — good content density above the fold
  - Evidence: HTML-heuristic
- **[PASS]** Internal Link Density — 12 contextual internal links per 1,000 words — strong knowledge graph signal
  - Evidence: HTML-heuristic
- **[PASS]** Knowledge Graph Readiness — 3/4 entity signals — strong Knowledge Graph presence
  - Evidence: HTML-heuristic

### GDPR — 87/100

- **[WARN]** Cookie Policy
  - Fix: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Evidence: HTML-heuristic
- **[WARN]** Terms & Conditions Page
  - Fix: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.
  - Evidence: HTML-heuristic
- **[WARN]** Right to Erasure (Data Deletion)
  - Fix: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Evidence: HTML-heuristic
- **[PASS]** Cookie Consent Banner (CMP) — Complianz detected
  - Evidence: HTML-heuristic
- **[PASS]** Tracking Scripts & Consent — No tracking scripts detected
  - Evidence: HTML-heuristic
- **[PASS]** Privacy Policy Page — https://kolibahoreca.sk/wp-content/plugins/complianz-gdpr/assets/css/c
  - Evidence: HTML-heuristic
- **[PASS]** Legal Contact / Imprint Page — https://kolibahoreca.sk/o-nas/
  - Evidence: HTML-heuristic
- **[PASS]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Evidence: HTML-heuristic
- **[PASS]** Data Protection Officer Contact — DPO / data protection contact found
  - Evidence: HTML-heuristic
- **[PASS]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Evidence: HTML-heuristic

### Vulnerability — 52/100

- **[FAIL]** CMS Version Disclosure — "Elementor 3.31.3; features: e_font_icon_svg, additional_custom_breakpoints, e_element_cache; settings: css_print_method-external, google_font-enabled, font_display-swap" exposed in meta generator
  - Fix: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.
  - Evidence: HTML-heuristic
- **[FAIL]** Form CSRF Protection — 1 form(s) without CSRF tokens
  - Fix: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Evidence: HTML-heuristic · confidence: low
- **[FAIL]** Suspicious Inline Script Patterns — Detected: Dynamic script injection
  - Fix: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
  - Evidence: file-probe
- **[FAIL]** DMARC Policy (Email Auth)
  - Fix: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
  - Evidence: DNS
- **[FAIL]** Payment Page Security — Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection
  - Fix: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Evidence: file-probe
- **[FAIL]** Clickjacking on Sensitive Page — Login/payment page without X-Frame-Options or CSP frame-ancestors
  - Fix: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
  - Evidence: file-probe
- **[WARN]** CMS Information Files — readme.html accessible — reveals version details
  - Fix: Delete or block access to readme.html. These files reveal your exact CMS version and update history.
  - Evidence: file-probe
- **[WARN]** Open Redirect Detection — URL redirect parameter found in page links
  - Fix: Validate all redirect URLs server-side against a whitelist. Never allow user-controlled redirect targets without validation.
  - Evidence: HTML-heuristic · confidence: low
- **[WARN]** WordPress User Enumeration — /wp-json/wp/v2/users exposes user accounts
  - Fix: Restrict the REST API users endpoint. Add to functions.php: add_filter('rest_endpoints', function($endpoints) { unset($endpoints['/wp/v2/users']); return $endpoints; }); Or use a security plugin.
  - Evidence: file-probe
- **[WARN]** Cross-Origin Isolation
  - Fix: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Evidence: HTTP-header
- **[PASS]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Evidence: file-probe
- **[PASS]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Evidence: file-probe
- **[PASS]** Directory Listing — Disabled — file structure hidden
  - Evidence: file-probe
- **[PASS]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Evidence: file-probe
- **[PASS]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Evidence: HTML-heuristic
- **[PASS]** SPF Record (Email Security) — SPF configured: v=spf1 include:_spf.mlsend.com include:spf.protection.outlook.com -all
  - Evidence: DNS
- **[PASS]** DKIM Signing (Email Auth) — DKIM configured (selectors: default)
  - Evidence: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).

---

Zulien Score is a free, automated heuristic audit covering performance (Core Web Vitals, TTFB, page weight), SEO (meta, structured data, sitemap), security (SSL/TLS, HSTS, CSP), mobile usability, AI readiness, GDPR / ePrivacy compliance and vulnerability surface. Results are cached for 6 hours and re-scanned on demand.

[View the full interactive report on Zulien Score →](https://score.zulien.sk/ro/r/kolibahoreca.sk)
