Ultima scanare: June 23, 2026

C0/100

Mediu

Raport de scor

metronet.sk

Scanat la June 23, 2026

WordPress

jQuery

Bootstrap

Font Awesome

GSAP

Video.js

Firmă:Metronet, s.r.o.· NACE 6290

NIS2: în afara scope-ului

Risc:15/100scăzut

Credit:A+

Adresă fictivă

Top 22% în sector

Profil complet al companiei →

Ultima scanare: June 23, 2026

Nu intră sub obligațiile de cybersecurity ale NIS2.Pe baza sectorului NACE + dimensiunea firmei, conformitatea cu Articolul 21 nu este obligatorie. Bunele practici de securitate sunt totuși recomandate.

Furnizați unei firme reglementate NIS2?Chiar și în afara domeniului direct puteți avea obligații din lanțul de aprovizionare — firmele reglementate le transferă contractual furnizorilor (securitate, raportarea incidentelor, criptare). Furnizorii ICT și de servicii gestionate intră în domeniu indiferent de mărime.

Verificați obligațiile furnizorului ·Bază legală: NIS2 Art. 21 · SK 366/2024 §21 · NIS2 Art. 21(2)(d)

Plan de acțiune

Remediază mai întâi aceste 3 lucruri

Sortate după impactul asupra scorului — fiecare remediere îți crește nota generală.

+15câștig potențial

70/100

Performance

Pondere: 25% · 8 trecute · 7 avertismente · 2 eșuate · 1 SPA (verifică manual)

Ce am găsit: 3.6 MB, 140 requests — too heavy!

De ce contează: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Cum să repari: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Dovadă:PSI-lab· Încredere: high

Get Performance Optimization →

Ce am găsit: 91 CSS files — too many!

De ce contează: Each CSS file blocks rendering. With 91 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Cum să repari: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Dovadă:HTML-heuristic· Încredere: high

Ce am găsit: 3.73s (good: <2.5s) — Core Web Vital

De ce contează: LCP is a Core Web Vital that directly impacts Google rankings. Sites failing LCP are demoted in search results. The #1 cause of slow LCP is unoptimized hero images.

Cum să repari: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.

Dovadă:PSI-lab· Încredere: high

Request quote for speed audit

Ce am găsit: 180 KB unused (CSS: 45 KB, JS: 135 KB)

De ce contează: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.

Notă: Această verificare folosește detecție euristică și poate produce false positives. Verificare manuală recomandată.

Cum să repari: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.

Dovadă:PSI-lab· Încredere: low

Ce am găsit: font-display: auto

De ce contează: font-display: block hides text until the font loads (FOIT) — users see a blank page. 'swap' shows text immediately with a fallback font.

Cum să repari: Use font-display: swap (shows fallback immediately, swaps when loaded) or font-display: optional (best for performance — may skip custom font on slow connections).

Dovadă:HTML-heuristic· Încredere: high

Request quote for speed audit

Ce am găsit: Only 40% of 52 scripts use async/defer

De ce contează: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.

Cum să repari: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.

Dovadă:HTML-heuristic· Încredere: high

Ce am găsit: Custom fonts detected without preload hints

De ce contează: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

Cum să repari: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Dovadă:HTML-heuristic· Încredere: high

Request quote for speed audit

Ce am găsit: 91 CSS files without critical CSS extraction

De ce contează: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

Cum să repari: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Dovadă:PSI-lab· Încredere: high

Request quote for speed audit

Ce am găsit: 4 external domains without preconnect

De ce contează: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

Cum să repari: Add <link rel='preconnect'> for key third-party domains: cdnjs.cloudflare.com, www.googletagmanager.com, t.contentsquare.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.

Dovadă:PSI-lab· Încredere: high

9 probleme găsite în Performance. Loc de îmbunătățire.

Magazinul tău nu se califică încă pentru badge-ul Zulien Score. Obține un scor de 80+ pentru a-l câștiga!

📧 Memento-uri de rescanare

Îți trimitem un email lunar când e momentul să rescanezi și să urmărești progresul.

Sunt de acord cu Politica de confidențialitate. Îți trimitem raportul tău și, opțional, notificări de rescanare.

🚀 Îmbunătățește-ți scorul

Modulele noastre PrestaShop pot rezolva majoritatea acestor probleme automat.

Consultanță gratuită de 15 min · Fără obligații

Distribuie și exportă

Gata să-ți îmbunătățești scorul?

Repară singur

Vezi modulele noastre pentru a remedia aceste probleme în 2 click-uri.

Vezi modulele Zulien

Lasă-ne să rezolvăm pentru tine

Descrie obiectivul tău și îți trimitem o ofertă în 48h — fără apel telefonic.

Cere o ofertă scrisă

Răspuns în 48h · Fără apel de vânzări

Aceasta este o estimare euristică automată, nu un audit profesional. Constatările reflectă semnale observabile public la momentul scanării și pot include false positives.Află despre metodologia noastrăRaportează inexactitateElimină acest raport

Zulien Score

Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách

70/100

Grade C

metronet.sk

Metronet, s.r.o.

Dátum auditu: June 23, 2026

Platforma: WordPress

NACE: 6290

Online report: https://score.zulien.sk/r/metronet.sk

Executive summary

Chýb

Upozornení

139

Spolu kontrol

Skóre po kategóriách

Kategória	Skóre	Váha	Chyby	Upozornenia	OK
Performance	70/100	25%	2	7	8
SEO	78/100	20%	2	8	14
Security	65/100	15%	2	9	6
Mobile	61/100	10%	1	8	7
AI Readiness	63/100	10%	4	16	11
GDPR	89/100	10%	0	3	9
Vulnerability	55/100	10%	5	7	8

Kritické zistenia

Total Page Weight· Performance

Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

CSS File Count· Performance

Each CSS file blocks rendering. With 91 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Content Structure (H2 Headings)· SEO

Pages without heading structure have 30% lower time-on-page and miss long-tail ranking opportunities.

XML Sitemap· SEO

Sitemaps help Google discover and index pages 3-5x faster, especially for large stores with deep category structures.

Content-Security-Policy (CSP)· Security

CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.

Clickjacking Protection· Security

Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Heading Hierarchy (WCAG 1.3.1)· Mobile

Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené.

llms.txt (AI Site Descriptor)· AI Readiness

llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.

Heading Hierarchy for AI· AI Readiness

AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Image Alt Text Quality for AI· AI Readiness

Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

Content-to-Boilerplate Ratio· AI Readiness

Token density measures useful content vs noise. Pages with <30% content ratio are scored 'not machine-readable' by tools like LLMClicks. AI literally can't find your content in the boilerplate.

CMS Version Disclosure· Vulnerability

Knowing your exact CMS version lets attackers search CVE databases instantly. E.g., PrestaShop 1.7.8.x is associated with known SQL injection CVEs. Hiding the version forces attackers to guess.

Performance

70/100

Váha: 25% · 8 OK · 7 upozornení · 2 chýb · spolu 18

Total Page WeightZlyhalo

3.6 MB, 140 requests — too heavy!

Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

CSS File CountZlyhalo

91 CSS files — too many!

Prečo je to dôležité: Each CSS file blocks rendering. With 91 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Ako opraviť: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Largest Contentful Paint (LCP)Upozornenie

3.73s (good: <2.5s) — Core Web Vital

Prečo je to dôležité: LCP is a Core Web Vital that directly impacts Google rankings. Sites failing LCP are demoted in search results. The #1 cause of slow LCP is unoptimized hero images.

Ako opraviť: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.

Unused Code (CSS + JS)Upozornenie

180 KB unused (CSS: 45 KB, JS: 135 KB)

Prečo je to dôležité: Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth.

Ako opraviť: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.

Font Loading StrategyUpozornenie

font-display: auto

Prečo je to dôležité: font-display: block hides text until the font loads (FOIT) — users see a blank page. 'swap' shows text immediately with a fallback font.

Ako opraviť: Use font-display: swap (shows fallback immediately, swaps when loaded) or font-display: optional (best for performance — may skip custom font on slow connections).

Script Loading StrategyUpozornenie

Only 40% of 52 scripts use async/defer

Prečo je to dôležité: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.

Ako opraviť: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.

Font PreloadingUpozornenie

Custom fonts detected without preload hints

Prečo je to dôležité: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

Ako opraviť: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Critical CSS StrategyUpozornenie

91 CSS files without critical CSS extraction

Prečo je to dôležité: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

Ako opraviť: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Connection Hint CoverageUpozornenie

4 external domains without preconnect

Prečo je to dôležité: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

Ako opraviť: Add <link rel='preconnect'> for key third-party domains: cdnjs.cloudflare.com, www.googletagmanager.com, t.contentsquare.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.

Server Response Time (TTFB)Prešlo

89ms

First Contentful Paint (FCP)Prešlo

0.76s

Total Blocking Time (TBT)Prešlo

186ms

Cumulative Layout Shift (CLS)Prešlo

0.077 — Core Web Vital ✓

Speed IndexPrešlo

2.86s

Text Compression (gzip/brotli)Prešlo

All text resources properly compressed

Resource Hints (Preload/Preconnect)Prešlo

1 preload, 0 preconnect hint(s)

Lazy LoadingPrešlo

49% of images use native lazy loading (102/208)

Render-blocking ResourcesInfo

Not measured — PageSpeed did not return the render-blocking audit for this URL

Ako opraviť: Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run.

SEO

78/100

Váha: 20% · 14 OK · 8 upozornení · 2 chýb · spolu 25

Content Structure (H2 Headings)Zlyhalo

Prečo je to dôležité: Pages without heading structure have 30% lower time-on-page and miss long-tail ranking opportunities.

Ako opraviť: Add H2 subheadings to structure your content. Each major section should have a descriptive H2.

XML SitemapZlyhalo

Prečo je to dôležité: Sitemaps help Google discover and index pages 3-5x faster, especially for large stores with deep category structures.

Ako opraviť: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.

Meta DescriptionUpozornenie

116 chars (optimal: 120-160)

Prečo je to dôležité: Short descriptions waste SERP real estate and miss the chance to persuade searchers to click.

Ako opraviť: Expand your description to at least 120 characters. Include benefits, a CTA, and your target keyword.

H1 HeadingUpozornenie

5 H1 tags (should be exactly 1)

Prečo je to dôležité: Multiple H1 tags dilute the main topic signal. Google's John Mueller confirmed: one H1 per page is best practice.

Ako opraviť: Consolidate to exactly one H1 tag per page. Use H2-H6 for subheadings.

Twitter/X CardsUpozornenie

Prečo je to dôležité: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.

Ako opraviť: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.

Image Format OptimizationUpozornenie

Only 1% next-gen formats — 5 legacy images remain

Prečo je to dôležité: WebP/AVIF images are 30-70% smaller than JPEG/PNG with the same quality. This directly improves page speed, LCP, and mobile experience.

Ako opraviť: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use <picture> element for browser fallback.

Canonical URL ConsistencyUpozornenie

Canonical points to different URL: https://www.metronet.sk/

Prečo je to dôležité: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.

Ako opraviť: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.

Internal LinkingUpozornenie

Only 3 internal links

Prečo je to dôležité: Internal links help Google discover and rank your pages. Pages with more internal links receive higher PageRank and are crawled more frequently.

Ako opraviť: Add more internal links to related content. Target 5+ internal links per page for strong site crawlability.

Empty/Dead LinksUpozornenie

9 dead links (0 empty, 9 hash-only, 0 javascript:void)

Prečo je to dôležité: Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens.

Ako opraviť: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.

Excessive Resource RequestsUpozornenie

52 JS + 91 CSS = 143 external requests

Prečo je to dôležité: Google's crawl budget is limited. Sites with excessive resources get crawled less frequently and experience slower indexation of new content.

Ako opraviť: Reduce to under 30 external resources by bundling JS/CSS files, removing unused plugins, and consolidating third-party scripts.

Meta TitlePrešlo

58 chars — "Optický internet a TV nielen v Banskej Bystrici | Metro…"

Open Graph TagsPrešlo

og:title, og:description, og:image, og:type

Open Graph Image FormatPrešlo

image/webp

Canonical URLPrešlo

https://www.metronet.sk/

Structured Data (JSON-LD)Prešlo

1 block(s): WebPage, ReadAction, ImageObject, BreadcrumbList

JSON-LD ValidityPrešlo

1 block(s) parse cleanly

robots.txtPrešlo

Present, references sitemap

HTML Language AttributePrešlo

lang="sk-SK"

Image Alt AttributesPrešlo

97% of 208 images have alt text

Meta Robots TagPrešlo

index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1

FaviconPrešlo

Favicon detected

Semantic HTML StructurePrešlo

4/6 semantic elements: <nav>, <main>, <header>, <footer>

Content DepthPrešlo

3422 words — sufficient content

Accessibility FundamentalsPrešlo

3/4 a11y signals: 28 ARIA roles, 36 ARIA labels, lang="sk-SK"

Text-to-HTML RatioInfo

6% ratio but 3422 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content

Prečo je to dôležité: Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on.

Ako opraviť: Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.

Security

65/100

Váha: 15% · 6 OK · 9 upozornení · 2 chýb · spolu 17

Content-Security-Policy (CSP)Zlyhalo

Prečo je to dôležité: CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.

Ako opraviť: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

Clickjacking ProtectionZlyhalo

Prečo je to dôležité: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Ako opraviť: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.

CAA DNS RecordUpozornenie

No CAA records — any CA can issue certificates for this domain

Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

X-Content-Type-OptionsUpozornenie

Prečo je to dôležité: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.

Ako opraviť: Add header: X-Content-Type-Options: nosniff

Referrer-PolicyUpozornenie

Prečo je to dôležité: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.

Ako opraviť: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.

Permissions-PolicyUpozornenie

Prečo je to dôležité: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.

Ako opraviť: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.

Technology DisclosureUpozornenie

X-Powered-By: PHP/8.3.31

Prečo je to dôležité: Exposing exact server/PHP versions lets attackers search CVE databases for specific exploits. This is the first step in most automated attacks.

Ako opraviť: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.

Subresource Integrity (SRI)Upozornenie

Only 0/2 SRI-eligible third-party scripts have integrity hashes (2 auto-updating provider script(s) excluded — SRI not applicable)

Prečo je to dôležité: Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site. The British Airways breach (£20M fine) was exactly this attack vector.

Ako opraviť: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.

security.txt (RFC 9116)Upozornenie

Prečo je to dôležité: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all. Required by ISO 27001 and SOC 2.

Ako opraviť: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.

CDN / WAF ProtectionUpozornenie

Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts. Cloudflare blocks 150+ billion daily threats.

Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

Iframe SandboxingUpozornenie

2/2 unknown iframe(s) without sandbox attribute

Prečo je to dôležité: Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS.

Ako opraviť: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.

SSL/TLS CertificatePrešlo

Valid HTTPS connection established

DNSSECPrešlo

Zone is DNSSEC-signed (DNSKEY published)

Prečo je to dôležité: DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities.

HTTP → HTTPS RedirectPrešlo

HTTP properly redirects to HTTPS

HSTS (Strict-Transport-Security)Prešlo

max-age=63072000, preload, includeSubDomains

Cookie Security FlagsPrešlo

No cookies set on initial response

Server Version DisclosurePrešlo

openresty — version hidden

Mobile

61/100

Váha: 10% · 7 OK · 8 upozornení · 1 chýb · spolu 16

Heading Hierarchy (WCAG 1.3.1)Zlyhalo

Preskočené úrovne: h1→h3, h3→h6, h3→h5

Prečo je to dôležité: Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené.

Ako opraviť: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.

Mobile Performance ScoreUpozornenie

50/100 (target: 90+)

Prečo je to dôležité: Over 65% of e-commerce traffic is mobile (Statista 2024). Google ranks based on mobile performance, not desktop. Mobile score <50 means you're penalized in mobile search.

Ako opraviť: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are 3-5x slower than desktop — what's fast on desktop is slow on mobile.

Touch Target SizeUpozornenie

Prečo je to dôležité: Small tap targets cause 37% more mis-taps on mobile (Google UX research). In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Font Size ReadabilityUpozornenie

Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience. Users over 40 are especially affected — and they have the highest purchasing power.

Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

Theme ColorUpozornenie

Prečo je to dôležité: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional — small detail, big perception impact.

Ako opraviť: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.

Inline CSS SizeUpozornenie

59 KB of inline CSS

Prečo je to dôležité: Large inline CSS blocks increase initial HTML download and parsing time — especially painful on mobile with limited CPU and slower connections.

Ako opraviť: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.

Apple Mobile Web AppUpozornenie

Missing: apple-mobile-web-app-capable, status-bar-style

Prečo je to dôležité: These tags enable 'Add to Home Screen' on iOS with a full-screen experience. 45% of mobile shoppers use iOS — a polished home screen presence increases return visits.

Ako opraviť: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.

Fixed Width ElementsUpozornenie

Large fixed-width elements detected — may cause horizontal scroll

Prečo je to dôležité: Fixed-width elements wider than the viewport cause horizontal scrolling on mobile. Google's mobile-friendly test specifically checks for this.

Ako opraviť: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.

Form Input Labels (WCAG 3.3.2)Upozornenie

15/16 inputs má label (94%)

Prečo je to dôležité: Formulárové inputy bez labelov sú nedostupné pre screen reader používateľov a zhoršujú konverziu aj pre bežných používateľov (neviditeľné placeholder texty, stratená informácia pri fokusovaní).

Ako opraviť: 1 input elementov nemá <label for="id">, aria-label, aria-labelledby alebo title. Placeholder nie je dostatočný (WCAG 3.3.2). Pridaj <label for="email">Email</label><input id="email"> alebo <input aria-label="Email">.

Viewport ConfigurationPrešlo

width=device-width, initial-scale=1

Content Fits ViewportPrešlo

No horizontal scrolling needed

Responsive Design TechniquesPrešlo

Flexbox, CSS Grid, Media queries detected

Mobile Navigation (Semantic)Prešlo

<nav> element present — proper navigation landmark

Responsive Images (srcset)Prešlo

1 image(s) use srcset for responsive sizing

Form Input TypesPrešlo

Optimized: 1 email, 1 tel

Link Text Quality (WCAG 2.4.4)Prešlo

Všetky odkazy majú popisný text

AI Readiness

63/100

Váha: 10% · 11 OK · 16 upozornení · 4 chýb · spolu 31

llms.txt (AI Site Descriptor)Zlyhalo

Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.

Ako opraviť: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

Heading Hierarchy for AIZlyhalo

5 H1, 0 H2, 18 H3 — poor structure

Prečo je to dôležité: AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content.

Ako opraviť: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).

Image Alt Text Quality for AIZlyhalo

Only 47% quality alt text — 6 missing, 104 poor

Prečo je to dôležité: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

Ako opraviť: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.

Content-to-Boilerplate RatioZlyhalo

Only 2% in main content — mostly boilerplate

Prečo je to dôležité: Token density measures useful content vs noise. Pages with <30% content ratio are scored 'not machine-readable' by tools like LLMClicks. AI literally can't find your content in the boilerplate.

Ako opraviť: Wrap your primary content in <main> or <article> tags. AI extracts content from these semantic containers — without them, your product descriptions are mixed with navigation and footer text.

llms-full.txt (Complete AI Content)Upozornenie

Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

Ako opraviť: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.

Organization Schema + Entity LinkingUpozornenie

Organization schema found but no sameAs links

Prečo je to dôležité: sameAs links tell AI: 'This is the same entity across the web.' Sites with sameAs to Wikipedia are 3x more likely to appear in AI-generated answers. It's how Google builds Knowledge Panels.

Ako opraviť: Add sameAs array to your Organization schema linking to Wikipedia, LinkedIn, Facebook, Instagram, and other official profiles. This creates a Knowledge Graph entity for your brand.

FAQ Schema (Direct AI Answers)Upozornenie

Prečo je to dôležité: FAQ schema provides 30% higher AI citation rates (LLMClicks research). ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. It's the fastest way to get your content cited by AI.

Ako opraviť: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).

Structured Content (Lists & Tables)Upozornenie

11 lists found — consider adding comparison tables

Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with much higher accuracy than paragraph text. Structured content = more AI citations.

Ako opraviť: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content exponentially faster than paragraphs.

Content Freshness SignalsUpozornenie

Schema dates found but no visible date on page

Prečo je to dôležité: 76.4% of ChatGPT's top 1000 cited pages were updated within 30 days. AI-cited content is 25.7% fresher than traditional organic results. Freshness signals tell AI your content is current and reliable.

Ako opraviť: Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.

Entity Clarity & Brand SignalsUpozornenie

OG tags complete but no sameAs entity links

Prečo je to dôležité: AI needs to confidently identify your brand entity. Open Graph + sameAs create a cross-platform identity that AI models recognize. The HubSpot AEO Grader found entity clarity is a top-3 factor for AI brand recognition.

Ako opraviť: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.

Author Expertise Signals (E-E-A-T)Upozornenie

Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited 3x more than anonymous content. This is especially important for product guides, reviews, and advice content.

Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Section Length OptimizationUpozornenie

Avg section: 224 words — only 0% in 80-200 word optimal range

Prečo je to dôležité: Pages with 120-180 word sections earn 70% more AI citations (Otterly Citation Economy 2026). For Google AI Overviews specifically, 100-150 words per section is the sweet spot.

Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Q&A Format HeadingsUpozornenie

Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

Ako opraviť: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.

Internal Link DensityUpozornenie

only 1/1000w (target: 3-5)

Prečo je to dôležité: Internal links create an implicit knowledge graph for AI crawlers. Each contextual link teaches AI about content relationships. AI models navigate internal links to build comprehensive understanding of your store.

Ako opraviť: Add 3-5 contextual internal links per 1,000 words using descriptive anchor text. Link to related products, categories, and guides. Replace generic anchors ('click here', 'read more') with descriptive text.

Canonical Tag for AI DeduplicationUpozornenie

Canonical points to different URL: https://www.metronet.sk/

Prečo je to dôležité: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.

Ako opraviť: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.

Content Readability for AIUpozornenie

Grade 18 — too complex for broad AI citation (technical threshold: 14)

Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are 28% more likely to be cited by AI.

Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Expert Quotations & CitationsUpozornenie

Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

ai.txt (AI Permissions)Upozornenie

Prečo je to dôležité: ai.txt is an emerging standard (proposed May 2025) for fine-grained AI permissions beyond robots.txt. Early adoption signals AI-forward thinking and gives you control over how AI uses your content.

Ako opraviť: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.

WebMCP Agentic ReadinessUpozornenie

Prečo je to dôležité: WebMCP is called 'the new Schema.org moment' — it's how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

Social Proof (Testimonials / Case Studies)Upozornenie

Prečo je to dôležité: Without visible social proof, B2B prospects can't verify your track record before reaching out. Missing testimonials/case studies is the #1 reason consultancy sites lose qualified leads at the contact stage.

Ako opraviť: Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is the #1 credibility lever.

AI Bot Access PolicyPrešlo

No AI bot restrictions (allowed by default)

Content Accessibility for AIPrešlo

3422 words in raw HTML (5.8% text ratio) — readable by AI crawlers without executing JS

Structured Data FoundationPrešlo

1 JSON-LD blocks with 10 schema types: WebPage, ReadAction, ImageObject, BreadcrumbList, ListItem, WebSite

Breadcrumb SchemaPrešlo

BreadcrumbList structured data found — clear navigation hierarchy

Site Search Schema (SearchAction)Prešlo

WebSite SearchAction configured — AI can search your store

Content Depth for AIPrešlo

3422 words — rich content for AI analysis and citation

Answer-First Content FormatPrešlo

First paragraph: 53 words — good content density above the fold

Semantic HTML StructurePrešlo

4/6 semantic elements: <nav>, <main>, <header>, <footer>

Extractable Answer BlocksPrešlo

20 paragraphs, avg 36 words — optimal for AI extraction

Statistics & Data PresencePrešlo

4 data points found — strong citation magnet

Knowledge Graph ReadinessPrešlo

3/4 entity signals — strong Knowledge Graph presence

GDPR

89/100

Váha: 10% · 9 OK · 3 upozornení · 0 chýb · spolu 12

Cookie PolicyUpozornenie

Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

Ako opraviť: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.

Terms & Conditions PageUpozornenie

Prečo je to dôležité: EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights.

Ako opraviť: Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.

Right to Erasure (Data Deletion)Upozornenie

Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process. Italian DPA fined companies €20M+ for obstructing erasure requests.

Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Cookie Consent Banner (CMP)Prešlo

Cookiebot detected

Tracking Scripts & ConsentPrešlo

2 tracker(s) detected with CMP: Google Analytics/GTM, Google Ads

Google Consent Mode v2Prešlo

Consent mode signals detected (ad_storage, analytics_storage)

Privacy Policy PagePrešlo

https://www.metronet.sk/wp-content/plugins/complianz-gdpr/assets/css/c

Legal Contact / Imprint PagePrešlo

https://www.metronet.sk/o-nas/

Data Encryption (No Mixed Content)Prešlo

All resources loaded over HTTPS

Third-party Data SharingPrešlo

4 third-party domain(s)

Data Protection Officer ContactPrešlo

DPO / data protection contact found

Withdrawal of Consent MechanismPrešlo

Consent withdrawal / opt-out mechanism found

Vulnerability

55/100

Váha: 10% · 8 OK · 7 upozornení · 5 chýb · spolu 20

CMS Version DisclosureZlyhalo

"Site Kit by Google 1.181.0" exposed in meta generator

Prečo je to dôležité: Knowing your exact CMS version lets attackers search CVE databases instantly. E.g., PrestaShop 1.7.8.x is associated with known SQL injection CVEs. Hiding the version forces attackers to guess.

Ako opraviť: Remove the meta generator tag entirely. In PrestaShop: remove from header.tpl. In WordPress: add remove_action('wp_head', 'wp_generator') to functions.php.

Suspicious Inline Script PatternsZlyhalo

Detected: Dynamic script injection

Prečo je to dôležité: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. The 2024 Akamai report found skimmers disguised as Google Tag Manager on thousands of e-commerce sites.

Ako opraviť: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.

Payment Page SecurityZlyhalo

Payment page missing: No CSP, No X-Content-Type-Options, No clickjacking protection

Prečo je to dôležité: Payment pages without proper security headers violate PCI DSS. This can result in fines of $5,000-$100,000/month from payment processors, and makes card data theft significantly easier.

Ako opraviť: CRITICAL: Your payment page is missing security headers: No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.

Clickjacking on Sensitive PageZlyhalo

Prečo je to dôležité: Clickjacking on payment/login pages is a high-severity vulnerability. Users unknowingly submit credentials or payments through invisible iframes. PCI DSS requires frame-busting on payment pages.

Ako opraviť: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.

Server Error LeakZlyhalo

PHP/server error messages visible in page output

Prečo je to dôležité: Error messages reveal file paths, database structure, table names, and query logic. This is a goldmine for attackers — it turns a blind SQL injection into a targeted one, reducing attack time from days to minutes.

Ako opraviť: Set display_errors=Off in php.ini and log_errors=On. Configure a custom error page. Never show stack traces, SQL errors, or file paths to users.

CMS Information FilesUpozornenie

readme.html accessible — reveals version details

Prečo je to dôležité: Even if you hide the generator tag, readme.html and CHANGELOG.txt reveal exact version numbers. Attackers check these as a fallback.

Ako opraviť: Delete or block access to readme.html. These files reveal your exact CMS version and update history.

Form CSRF ProtectionUpozornenie

1/2 forms have CSRF tokens

Prečo je to dôležité: Forms without CSRF tokens allow cross-site request forgery — an attacker's site can submit orders, change settings, or modify data on behalf of your logged-in users.

Ako opraviť: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().

X-Powered-By HeaderUpozornenie

PHP/8.3.31

Prečo je to dôležité: "PHP/8.3.31" reveals your server technology and version. Attackers use this to find matching CVEs.

Ako opraviť: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').

Source Maps ExposedUpozornenie

JavaScript source maps (.js.map) are publicly accessible

Prečo je to dôležité: Source maps reveal your original source code, variable names, comments, and application logic. Attackers use this to find vulnerabilities, API keys in code, and understand your authentication flow.

Ako opraviť: Remove source maps from production or block access via server config. In Vite/Webpack: set sourcemap: false for production builds.

DMARC Policy (Email Auth)Upozornenie

DMARC set to p=none (monitoring only, no enforcement)

Prečo je to dôležité: DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes.

Ako opraviť: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.

Cross-Origin IsolationUpozornenie

Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

CDN Script Integrity (SRI)Upozornenie

1 CDN script(s) without Subresource Integrity

Prečo je to dôležité: CDN scripts without SRI can be tampered with if the CDN is compromised. The polyfill.io attack (2024, 380K+ sites) and British Airways breach (£20M fine) were both CDN supply chain attacks.

Ako opraviť: Add integrity='sha384-...' crossorigin='anonymous' to CDN scripts from: cdnjs.cloudflare.com. Generate hashes at srihash.org.

Sensitive Files ExposedPrešlo

.env, .git, composer.json — all properly blocked

Install Script ExposedPrešlo

No /install/ or /setup/ paths accessible

Directory ListingPrešlo

Disabled — file structure hidden

Admin Panel at Default URLPrešlo

Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)

Debug Mode / Error ExposurePrešlo

No debug indicators found in page output

PHP VersionPrešlo

PHP 8.3.31 — current

SPF Record (Email Security)Prešlo

SPF configured: v=spf1 ip4:95.47.178.165/32 ip4:92.245.31.66 include:amazonses.com include:_spf.

DKIM Signing (Email Auth)Prešlo

DKIM configured (selectors: google, s1, mail)

Ďalšie kroky

Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/metronet.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk