# andreashop.sk — Zulien Score 59/100 (známka C)

> Bezplatný audit e-shopu: 59/100 celkové skóre. 100+ kontrol v 7 kategóriách (výkon, SEO, bezpečnosť, mobil, AI pripravenosť, GDPR, zraniteľnosti).

- **Auditovaný:** https://andreashop.sk
- **Dátum auditu:** 2026-07-28
- **Plná správa:** https://score.zulien.sk/sk/r/andreashop.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/andreashop.sk

## Zhrnutie auditu

Váš web má základné problémy s bezpečnosťou a dostupnosťou. Prioritne pridajte HTTPS ochranu (HSTS) na všetky stránky. Naopak, SEO a GDPR compliance sú na dobrej úrovni.

## Skóre podľa kategórií

| Kategória | Skóre |
|---|---|
| Výkon | 58/100 |
| SEO | 73/100 |
| Bezpečnosť | 53/100 |
| Mobil | 58/100 |
| AI pripravenosť | 58/100 |
| GDPR | 74/100 |
| Zraniteľnosti | 59/100 |
| Prístupnosť | 33/100 |

## Detailné nálezy

### Výkon — 58/100

- **[CHYBA]** Total Page Weight — 4.1 MB, 334 requests — too heavy!
  - Riešenie: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Dôkaz: PSI-lab
- **[CHYBA]** Unused Code (CSS + JS) — 1109 KB wasted on unused code!
  - Riešenie: You're loading 1109 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Largest Contentful Paint (LCP) — 2.61s (good: <2.5s) — Core Web Vital
  - Riešenie: Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Total Blocking Time (TBT) — 560ms (good: <200ms)
  - Riešenie: Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Speed Index — 3.56s (good: <3.4s)
  - Riešenie: Speed Index measures visual completeness over time. Improve it by: prioritizing above-fold content, preloading critical resources, and minimizing render-blocking assets.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Resource Hints (Preload/Preconnect)
  - Riešenie: Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Lazy Loading — 606 images without lazy loading
  - Riešenie: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Cache-Control Strategy — no-store, no-cache, must-revalidate
  - Riešenie: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Script Loading Strategy — Only 43% of 7 scripts use async/defer
  - Riešenie: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** CSS File Count — 7 CSS files loaded
  - Riešenie: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Critical CSS Strategy — 7 CSS files without critical CSS extraction
  - Riešenie: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Connection Hint Coverage — 4 external domains without preconnect
  - Riešenie: Add <link rel='preconnect'> for key third-party domains: sub3.tpd.sk, www.google.com, cdn.luigisbox.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
  - Dôkaz: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Dôkaz: PSI-lab
- **[OK]** Server Response Time (TTFB) — 127ms
  - Dôkaz: PSI-lab
- **[OK]** First Contentful Paint (FCP) — 1.03s
  - Dôkaz: PSI-lab
- **[OK]** Cumulative Layout Shift (CLS) — 0.000 — Core Web Vital ✓
  - Dôkaz: PSI-lab
- **[OK]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Dôkaz: HTTP-header

### SEO — 73/100

- **[CHYBA]** H1 Heading
  - Riešenie: Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Open Graph Tags
  - Riešenie: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Semantic HTML Structure — 1/6 semantic elements — poor structure
  - Riešenie: Your page lacks semantic HTML5 elements. Replace generic <div> wrappers with <header>, <nav>, <main>, <article>, <aside>, and <footer> to give search engines and screen readers proper content signals.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Format Optimization — 0% next-gen formats — 215 JPEG, 105 PNG images
  - Riešenie: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical URL Consistency — Canonical points to different URL: https://www.andreashop.sk/
  - Riešenie: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Deep Heading Hierarchy — No H3 subheadings for long content
  - Riešenie: Add H3 subheadings under your H2 sections to create a deeper content hierarchy. This helps search engines understand sub-topics and improves featured snippet eligibility.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Empty/Dead Links — 22 dead links (14 empty, 6 hash-only, 2 javascript:void)
  - Riešenie: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Accessibility Fundamentals — 2/4 a11y signals — missing: ARIA labels, skip navigation link
  - Riešenie: Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Dimension Attributes — Only 0% of images have width/height attributes
  - Riešenie: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
  - Dôkaz: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 3% ratio but 2685 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Dôkaz: HTML-heuristic
- **[OK]** Meta Title — 50 chars — "Andreashop - Internetový obchod pre Vašu domácnosť"
  - Dôkaz: HTML-heuristic
- **[OK]** Meta Description — 158 chars
  - Dôkaz: HTML-heuristic
- **[OK]** Content Structure (H2 Headings) — 2 H2 subheadings found
  - Dôkaz: HTML-heuristic
- **[OK]** Twitter/X Cards — Card type: summary_large_image
  - Dôkaz: HTML-heuristic
- **[OK]** Canonical URL — https://www.andreashop.sk/
  - Dôkaz: HTML-heuristic
- **[OK]** Structured Data (JSON-LD) — 3 block(s): WebSite, SearchAction, BreadcrumbList
  - Dôkaz: schema
- **[OK]** JSON-LD Validity — 3 block(s) parse cleanly
  - Dôkaz: HTML-heuristic
- **[OK]** robots.txt — Present, references sitemap
  - Dôkaz: file-probe
- **[OK]** XML Sitemap — Found with ~10+ URLs
  - Dôkaz: file-probe
- **[OK]** HTML Language Attribute — lang="sk"
  - Dôkaz: HTML-heuristic
- **[OK]** Image Alt Attributes — 99% of 606 images have alt text
  - Dôkaz: HTML-heuristic
- **[OK]** Favicon — Favicon detected
  - Dôkaz: file-probe
- **[OK]** Content Depth — 2685 words — sufficient content
  - Dôkaz: HTML-heuristic
- **[OK]** Internal Linking — 133 internal links — strong site navigation
  - Dôkaz: HTML-heuristic

### Bezpečnosť — 53/100

- **[CHYBA]** HSTS (Strict-Transport-Security)
  - Riešenie: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Dôkaz: HTTP-header
- **[CHYBA]** Content-Security-Policy (CSP)
  - Riešenie: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
  - Dôkaz: HTTP-header
- **[CHYBA]** Clickjacking Protection
  - Riešenie: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** DNSSEC — No DNSKEY records — zone is unsigned
  - Riešenie: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Dôkaz: DNS
- **[UPOZORNENIE]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Riešenie: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Dôkaz: DNS
- **[UPOZORNENIE]** X-Content-Type-Options
  - Riešenie: Add header: X-Content-Type-Options: nosniff
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Permissions-Policy
  - Riešenie: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Cookie Security Flags — 1 cookie(s): 1 missing Secure, 1 missing SameSite
  - Riešenie: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Subresource Integrity (SRI) — Only 0/6 SRI-eligible third-party scripts have integrity hashes (1 auto-updating provider script(s) excluded — SRI not applicable)
  - Riešenie: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** security.txt (RFC 9116)
  - Riešenie: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** CDN / WAF Protection
  - Riešenie: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Iframe Sandboxing — 15/15 unknown iframe(s) without sandbox attribute
  - Riešenie: Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.
  - Dôkaz: HTML-heuristic · istota: low
- **[OK]** SSL/TLS Certificate — Valid HTTPS connection established
  - Dôkaz: SSL
- **[OK]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Dôkaz: HTTP-header
- **[OK]** Referrer-Policy — no-referrer-when-downgrade
  - Dôkaz: HTTP-header
- **[OK]** Technology Disclosure — Server: nginx (no version)
  - Dôkaz: HTTP-header
- **[OK]** Server Version Disclosure — Nginx — version hidden
  - Dôkaz: HTTP-header
- **[OK]** Password Field Security — 1 password field(s) — allow password manager autofill
  - Dôkaz: HTTP-header

### Mobil — 58/100

- **[CHYBA]** Form Input Labels (WCAG 3.3.2) — Iba 1/7 inputs má label (14%)
  - Riešenie: 6 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Link Text Quality (WCAG 2.4.4) — 220/992 odkazov (22%) má vágny text
  - Riešenie: Vysoké % generických odkazov ('click here', 'read more', 'tu', 'viac'). Každý odkaz musí byť pochopiteľný mimo kontextu — 'Detail produktu Zimná bunda' namiesto len 'Detail'.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Mobile Performance Score — 53/100 (target: 90+)
  - Riešenie: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Riešenie: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Dôkaz: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[UPOZORNENIE]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Riešenie: Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.
  - Dôkaz: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[UPOZORNENIE]** Theme Color
  - Riešenie: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Mobile Navigation (Semantic)
  - Riešenie: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Responsive Images (srcset) — 606 images without responsive sizing
  - Riešenie: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Form Input Types — phone fields use type='text' instead of type='tel'
  - Riešenie: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Mobile Sticky CTA — Add-to-cart button found but no sticky/fixed positioning detected
  - Riešenie: Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Text Overflow Handling — No word-break/overflow-wrap CSS detected
  - Riešenie: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Express Checkout (Apple Pay + Google Pay) — Iba Apple Pay detekovaný — chýba Google Pay
  - Riešenie: Pridaj Google Pay cez Stripe, Adyen alebo Mollie. Mobile conversion rate rastie keď je express checkout dostupný.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h2→h4
  - Riešenie: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
  - Dôkaz: HTML-heuristic
- **[OK]** Viewport Configuration — width=device-width, initial-scale=1
  - Dôkaz: HTML-heuristic
- **[OK]** Content Fits Viewport — No horizontal scrolling needed
  - Dôkaz: HTML-heuristic
- **[OK]** Responsive Design Techniques — Media queries detected
  - Dôkaz: HTML-heuristic
- **[OK]** Payment Methods Detected — 1 method(s): Apple Pay
  - Dôkaz: HTML-heuristic

### AI pripravenosť — 58/100

- **[CHYBA]** Organization Schema + Entity Linking
  - Riešenie: Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).
  - Dôkaz: schema
- **[CHYBA]** Heading Hierarchy for AI — 0 H1, 2 H2, 0 H3 — poor structure
  - Riešenie: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Semantic HTML Structure
  - Riešenie: Replace <div> wrappers with: <header> (site header), <nav> (navigation), <main> (primary content), <article> (self-contained content), <aside> (sidebar), <footer>. This is the foundation of AI-readable HTML.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Content Freshness Signals
  - Riešenie: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Entity Clarity & Brand Signals
  - Riešenie: Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Image Alt Text Quality for AI — Only 45% quality alt text — 3 missing, 330 poor
  - Riešenie: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Structured Data Foundation — 2 distinct schema types (WebSite, BreadcrumbList) — add more for comprehensive AI coverage
  - Riešenie: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
  - Dôkaz: schema
- **[UPOZORNENIE]** FAQ Schema (Direct AI Answers)
  - Riešenie: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Dôkaz: schema
- **[UPOZORNENIE]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Riešenie: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Structured Content (Lists & Tables) — 25 lists found — consider adding comparison tables
  - Riešenie: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Author Expertise Signals (E-E-A-T)
  - Riešenie: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Extractable Answer Blocks — 4 paragraphs, avg 8 words — too short for citation
  - Riešenie: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Section Length Optimization — Avg section: 437 words — only 0% in 80-200 word optimal range
  - Riešenie: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Q&A Format Headings
  - Riešenie: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.andreashop.sk/
  - Riešenie: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Knowledge Graph Readiness — 1/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema
  - Riešenie: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Content Readability for AI — Grade 15 — too complex for broad AI citation (technical threshold: 14)
  - Riešenie: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Expert Quotations & Citations
  - Riešenie: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** WebMCP Agentic Readiness
  - Riešenie: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Content-to-Boilerplate Ratio — No <main> or <article> elements — AI can't isolate content from boilerplate
  - Riešenie: Add <main> around your primary content and <article> around self-contained content blocks. This creates clear boundaries for AI content extraction.
  - Dôkaz: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Dôkaz: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Dôkaz: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Dôkaz: file-probe
- **[INFO]** Social Proof (Testimonials / Case Studies) — None detected. For a non-commercial/informational site, testimonials and case studies are optional
  - Dôkaz: HTML-heuristic · istota: low
- **[INFO]** Agent-Commerce Readiness — 69/100 — čiastočne pripravené (Prístup 100 · Porozumenie 25 · Objaviteľnosť 100 · Transakcia 50)
- **[INFO]** Agent: Prístup — dostane sa agent dnu — 100/100 (2 signály/-ov)
- **[INFO]** Agent: Porozumenie — rozumie produktom — 25/100 (2 signály/-ov)
- **[INFO]** Agent: Objaviteľnosť — nájde celý katalóg — 100/100 (3 signály/-ov)
- **[INFO]** Agent: Transakcia — vie konať (kôš/podmienky) — 50/100 (1 signál)
- **[OK]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
  - Dôkaz: file-probe
- **[OK]** Content Accessibility for AI — 2685 words in raw HTML (2.9% text ratio) — readable by AI crawlers without executing JS
  - Dôkaz: HTML-heuristic
- **[OK]** Breadcrumb Schema — BreadcrumbList structured data found — clear navigation hierarchy
  - Dôkaz: schema
- **[OK]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Dôkaz: schema
- **[OK]** Content Depth for AI — 2685 words — rich content for AI analysis and citation
  - Dôkaz: HTML-heuristic
- **[OK]** Heureka XML Feed — 775+ items at /heureka.xml — all required fields present
  - Dôkaz: file-probe
- **[OK]** Heureka Feed Quality (sampled) — EAN 100% · IMG 100% · DESC 100% · 31 cat · 0.1–699 € (n=50)
  - Dôkaz: HTML-heuristic
- **[OK]** Statistics & Data Presence — 17 data points found — strong citation magnet
  - Dôkaz: HTML-heuristic
- **[OK]** Common Question Coverage — Answers 5/5 key shopper questions: price, shipping, returns/refunds, availability, payment
  - Dôkaz: HTML-heuristic
- **[OK]** Internal Link Density — 50 contextual internal links per 1,000 words — strong knowledge graph signal
  - Dôkaz: HTML-heuristic

### GDPR — 74/100

- **[UPOZORNENIE]** Cookie Policy
  - Riešenie: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Legal Contact / Imprint Page
  - Riešenie: Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** International Data Transfers — 1 US-based tracker(s) without consent: Google Analytics/GTM
  - Riešenie: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Right to Erasure (Data Deletion)
  - Riešenie: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Withdrawal of Consent Mechanism
  - Riešenie: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Dôkaz: HTML-heuristic
- **[INFO]** Cookie Consent Banner (CMP) — No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)
  - Dôkaz: HTML-heuristic · 1 GTM container(s) detected · istota: low
- **[INFO]** Tracking Scripts & Consent — 1 tracker(s) detected (Google Analytics/GTM); no CMP visible in server HTML but GTM is present
  - Dôkaz: HTML-heuristic · 1 GTM container(s) detected · istota: low
- **[INFO]** Google Consent Mode v2 — No Consent Mode signals in server HTML, but GTM is present — Consent Mode is commonly configured inside GTM
  - Dôkaz: HTML-heuristic · 1 GTM container(s) detected · istota: low
- **[OK]** Privacy Policy Page — https://policies.google.com/privacy?hl=sk
  - Dôkaz: HTML-heuristic
- **[OK]** Terms & Conditions Page — /obchodne-podmienky-a274
  - Dôkaz: HTML-heuristic
- **[OK]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Dôkaz: HTML-heuristic
- **[OK]** Third-party Data Sharing — 4 third-party domain(s)
  - Dôkaz: HTML-heuristic
- **[OK]** Data Protection Officer Contact — DPO / data protection contact found
  - Dôkaz: HTML-heuristic

### Zraniteľnosti — 59/100

- **[CHYBA]** Admin Panel at Default URL — Accessible at: /admin
  - Riešenie: Rename your admin directory to a random, non-guessable path (e.g., /admin-x7k9m2). Add IP whitelisting via .htaccess, implement 2FA, and set up brute-force protection (fail2ban or similar).
  - Dôkaz: file-probe
- **[CHYBA]** Payment Page Security — Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection
  - Riešenie: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Dôkaz: file-probe
- **[CHYBA]** Clickjacking on Sensitive Page — Login/payment page without X-Frame-Options or CSP frame-ancestors
  - Riešenie: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** Form CSRF Protection — 37/39 forms have CSRF tokens
  - Riešenie: Ensure ALL forms include a CSRF token. In PrestaShop, use {$csrf_token} in templates. In WordPress, use wp_nonce_field().
  - Dôkaz: HTML-heuristic · istota: low
- **[UPOZORNENIE]** Cross-Origin Isolation
  - Riešenie: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Mixed Content Resources — 1 HTTP resource(s) on HTTPS page
  - Riešenie: Replace HTTP URLs with HTTPS: http://www.riesenia.com/
  - Dôkaz: file-probe
- **[UPOZORNENIE]** Inline Event Handlers — 37 inline event handlers (onclick, onmouseover, etc.)
  - Riešenie: Move inline event handlers to external JavaScript files using addEventListener(). Inline handlers prevent proper CSP implementation (require 'unsafe-inline') and increase XSS attack surface.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Login Form Security — Login form blocks password manager autofill
  - Riešenie: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
  - Dôkaz: file-probe
- **[INFO]** BIMI Brand Indicators
  - Dôkaz: file-probe
- **[OK]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Dôkaz: HTML-heuristic
- **[OK]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Dôkaz: file-probe
- **[OK]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Dôkaz: file-probe
- **[OK]** Directory Listing — Disabled — file structure hidden
  - Dôkaz: file-probe
- **[OK]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Dôkaz: HTML-heuristic
- **[OK]** SPF Record (Email Security) — SPF configured: v=spf1 mx include:mailgun.org include:_spf.vshosting.cloud ip4:93.185.102.135 ip
  - Dôkaz: DNS
- **[OK]** DMARC Policy (Email Auth) — DMARC enforced: p=quarantine
  - Dôkaz: DNS
- **[OK]** DKIM Signing (Email Auth) — DKIM configured (selectors: default)
  - Dôkaz: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Prístupnosť — 33/100

- **[CHYBA]** Form Labels — 6 of 7 form inputs have no associated label
  - Riešenie: Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Heading Structure — The page has no <h1> heading
  - Riešenie: Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Landmark Regions — No <main> landmark region found
  - Riešenie: Wrap the primary content in <main> and use <nav>, <header>, <footer> for the page regions.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Alt Text — 7 of 606 images missing alt text
  - Riešenie: Add alt text to the remaining images (alt="" for decorative ones).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Link Text — 220 of 992 links use vague text ("click here", "read more", "here")
  - Riešenie: Rewrite links to describe their destination ("View delivery options" not "click here").
  - Dôkaz: HTML-heuristic · istota: low
- **[UPOZORNENIE]** Skip Link — No skip-to-content link detected
  - Riešenie: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Dôkaz: HTML-heuristic · istota: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[OK]** Page Language — <html lang="sk"> is set
  - Dôkaz: HTML-heuristic
- **[OK]** Zoom & Scaling — Pinch-zoom is not disabled
  - Dôkaz: HTML-heuristic

---

Zulien Score je bezplatný automatizovaný heuristický audit pokrývajúci výkon (Core Web Vitals, TTFB, page weight), SEO (meta tagy, štruktúrované dáta, sitemap), bezpečnosť (SSL/TLS, HSTS, CSP), mobilnú použiteľnosť, AI pripravenosť, súlad s GDPR / ePrivacy a zraniteľnosti. Výsledky sú cache-ované na 6 hodín a re-skenovateľné na požiadanie.

[Zobraziť plnú interaktívnu správu na Zulien Score →](https://score.zulien.sk/sk/r/andreashop.sk)
