# bonprix.sk — Zulien Score 83/100 (známka A)

> Bezplatný audit e-shopu: 83/100 celkové skóre. Platforma: Magento. 100+ kontrol v 7 kategóriách (výkon, SEO, bezpečnosť, mobil, AI pripravenosť, GDPR, zraniteľnosti).

- **Auditovaný:** https://bonprix.sk
- **Platforma:** Magento
- **Dátum auditu:** 2026-07-28
- **Plná správa:** https://score.zulien.sk/sk/r/bonprix.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/bonprix.sk

## Zhrnutie auditu

Vaš obchod funguje dobre, ale máte bezpečnostné a právne medzery. Hneď pridajte cookie banner na súlad s GDPR. Vaša dostupnosť pre používateľov je výborná.

## Skóre podľa kategórií

| Kategória | Skóre |
|---|---|
| Výkon | 94/100 |
| SEO | 89/100 |
| Bezpečnosť | 83/100 |
| Mobil | 74/100 |
| AI pripravenosť | 72/100 |
| GDPR | 63/100 |
| Zraniteľnosti | 75/100 |
| Prístupnosť | 96/100 |

## Detailné nálezy

### Výkon — 94/100

- **[CHYBA]** CSS File Count — 28 CSS files — too many!
  - Riešenie: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Unused Code (CSS + JS) — 160 KB unused (CSS: 0 KB, JS: 160 KB)
  - Riešenie: Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Cache-Control Strategy — max-age=0, no-cache
  - Riešenie: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Font Preloading — Custom fonts detected without preload hints
  - Riešenie: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Inline JavaScript Size — 105 KB of inline JavaScript
  - Riešenie: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
  - Dôkaz: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Dôkaz: PSI-lab
- **[OK]** Server Response Time (TTFB) — 19ms
  - Dôkaz: PSI-lab
- **[OK]** First Contentful Paint (FCP) — 0.81s
  - Dôkaz: PSI-lab
- **[OK]** Largest Contentful Paint (LCP) — 0.89s — Core Web Vital ✓
  - Dôkaz: PSI-lab
- **[OK]** Total Blocking Time (TBT) — 0ms
  - Dôkaz: PSI-lab
- **[OK]** Cumulative Layout Shift (CLS) — 0.008 — Core Web Vital ✓
  - Dôkaz: PSI-lab
- **[OK]** Speed Index — 1.45s
  - Dôkaz: PSI-lab
- **[OK]** Total Page Weight — 1.4 MB (65 requests)
  - Dôkaz: PSI-lab
- **[OK]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Dôkaz: HTTP-header
- **[OK]** Resource Hints (Preload/Preconnect) — 2 preload, 1 preconnect hint(s)
  - Dôkaz: HTML-heuristic
- **[OK]** Lazy Loading — 95% of images use native lazy loading (35/37)
  - Dôkaz: HTML-heuristic
- **[OK]** Font Loading Strategy — font-display: swap
  - Dôkaz: HTML-heuristic
- **[OK]** HTTP/3 (QUIC) Support — HTTP/3 enabled via Alt-Svc header
  - Dôkaz: HTTP-header
- **[OK]** Critical CSS Strategy — Critical CSS / async CSS loading detected
  - Dôkaz: PSI-lab

### SEO — 89/100

- **[CHYBA]** Open Graph Image Format — og:image returned text/html
  - Riešenie: Make sure the og:image URL returns an image (Content-Type: image/png or image/jpeg). Common cause: returning HTML or JSON from a broken redirect.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Meta Description — 168 chars (optimal: 120-160)
  - Riešenie: Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Twitter/X Cards
  - Riešenie: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical URL Consistency — Canonical points to different URL: https://www.bonprix.sk
  - Riešenie: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Sitemap in robots.txt — robots.txt exists but doesn't reference your sitemap
  - Riešenie: Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.
  - Dôkaz: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 1% ratio but 690 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Dôkaz: HTML-heuristic
- **[OK]** Meta Title — 60 chars — "bonprix • Internetový obchod • Odevy dámske, pánske a d…"
  - Dôkaz: HTML-heuristic
- **[OK]** H1 Heading — "Odevy dámske, pánske a detské"
  - Dôkaz: HTML-heuristic
- **[OK]** Content Structure (H2 Headings) — 2 H2 subheadings found
  - Dôkaz: HTML-heuristic
- **[OK]** Open Graph Tags — og:title, og:description, og:image, og:type
  - Dôkaz: HTML-heuristic
- **[OK]** Canonical URL — https://www.bonprix.sk
  - Dôkaz: HTML-heuristic
- **[OK]** Structured Data (JSON-LD) — 2 block(s): WebSite, SearchAction, Organization
  - Dôkaz: schema
- **[OK]** JSON-LD Validity — 2 block(s) parse cleanly
  - Dôkaz: HTML-heuristic
- **[OK]** robots.txt — Present
  - Dôkaz: file-probe
- **[OK]** XML Sitemap — Found with ~17+ URLs
  - Dôkaz: file-probe
- **[OK]** HTML Language Attribute — lang="sk-SK"
  - Dôkaz: HTML-heuristic
- **[OK]** Hreflang Tags (Multilingual) — 10 language(s): fr-BE, nl-BE, nl-NL, fr-FR, pl-PL
  - Dôkaz: HTML-heuristic
- **[OK]** Image Alt Attributes — 100% of 37 images have alt text
  - Dôkaz: HTML-heuristic
- **[OK]** Meta Robots Tag — index, follow
  - Dôkaz: HTML-heuristic
- **[OK]** Favicon — Favicon detected
  - Dôkaz: file-probe
- **[OK]** Image Format Optimization — 62% next-gen formats (23 WebP, 0 AVIF)
  - Dôkaz: HTML-heuristic
- **[OK]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Dôkaz: HTML-heuristic
- **[OK]** Content Depth — 690 words — sufficient content
  - Dôkaz: HTML-heuristic
- **[OK]** Deep Heading Hierarchy — H2: 2, H3: 3 — well-structured content
  - Dôkaz: HTML-heuristic
- **[OK]** Internal Linking — 43 internal links — strong site navigation
  - Dôkaz: HTML-heuristic
- **[OK]** Empty/Dead Links — 1 minor dead link(s) — acceptable
  - Dôkaz: HTML-heuristic
- **[OK]** Accessibility Fundamentals — 3/4 a11y signals: 5 ARIA roles, 86 ARIA labels, lang="sk-SK"
  - Dôkaz: HTML-heuristic

### Bezpečnosť — 83/100

- **[UPOZORNENIE]** DNSSEC — No DNSKEY records — zone is unsigned
  - Riešenie: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Dôkaz: DNS
- **[UPOZORNENIE]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Riešenie: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Dôkaz: DNS
- **[UPOZORNENIE]** Cookie Security Flags — 4 cookie(s): 1 missing HttpOnly
  - Riešenie: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** security.txt (RFC 9116)
  - Riešenie: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** CDN / WAF Protection
  - Riešenie: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
  - Dôkaz: HTTP-header
- **[OK]** SSL/TLS Certificate — Valid HTTPS connection established
  - Dôkaz: SSL
- **[OK]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Dôkaz: HTTP-header
- **[OK]** HSTS (Strict-Transport-Security) — max-age=31536000, preload, includeSubDomains
  - Dôkaz: HTTP-header
- **[OK]** Content-Security-Policy (CSP) — Present and reasonably configured
  - Dôkaz: HTTP-header
- **[OK]** Clickjacking Protection — X-Frame-Options: SAMEORIGIN
  - Dôkaz: HTTP-header
- **[OK]** X-Content-Type-Options — nosniff
  - Dôkaz: HTTP-header
- **[OK]** Referrer-Policy — no-referrer-when-downgrade
  - Dôkaz: HTTP-header
- **[OK]** Permissions-Policy — geolocation=(self), camera=(self), microphone=(self)
  - Dôkaz: HTTP-header
- **[OK]** Technology Disclosure — Server identity hidden
  - Dôkaz: HTTP-header

### Mobil — 74/100

- **[UPOZORNENIE]** Mobile Performance Score — 76/100 (target: 90+)
  - Riešenie: Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Riešenie: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Dôkaz: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[UPOZORNENIE]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Riešenie: Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.
  - Dôkaz: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[UPOZORNENIE]** Theme Color
  - Riešenie: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Inline CSS Size — 157 KB of inline CSS
  - Riešenie: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Responsive Images (srcset) — 37 images without responsive sizing
  - Riešenie: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Apple Mobile Web App — Missing: apple-mobile-web-app-capable, status-bar-style
  - Riešenie: Add: <meta name='apple-mobile-web-app-capable' content='yes'>, <meta name='apple-mobile-web-app-status-bar-style' content='default'>, <link rel='apple-touch-icon' href='/icon-180.png'>.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Notch/Safe Area Handling — viewport-fit=cover set but no safe-area-inset padding detected
  - Riešenie: Add CSS padding using env(safe-area-inset-*) for content near screen edges. Without it, content may be hidden behind the notch or Dynamic Island.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Fixed Width Elements — 14 large fixed-width value(s) may cause horizontal scroll: width:1200px, width:1320px, width:1500px…
  - Riešenie: Replace fixed pixel widths with max-width: 100% or use relative units (%, vw). Add 'overflow-x: hidden' to body as a safety net.
  - Dôkaz: HTML-heuristic · width:1200px, width:1320px, width:1500px
- **[UPOZORNENIE]** Link Text Quality (WCAG 2.4.4) — 1 odkazov má generický text ("click here", "more", "tu"...)
  - Riešenie: Nahraď 'Click here' / 'Read more' / 'Viac' popisným textom: 'Prečítaj si viac o GDPR', 'Pozri cenník modulov'. Screen readers čítajú odkazy mimo kontextu — samostatné 'viac' nemá význam.
  - Dôkaz: HTML-heuristic
- **[OK]** Viewport Configuration — width=device-width, initial-scale=1
  - Dôkaz: HTML-heuristic
- **[OK]** Content Fits Viewport — No horizontal scrolling needed
  - Dôkaz: HTML-heuristic
- **[OK]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
  - Dôkaz: HTML-heuristic
- **[OK]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
  - Dôkaz: HTML-heuristic
- **[OK]** Form Input Types — Optimized: 1 email, 2 search
  - Dôkaz: HTML-heuristic
- **[OK]** Form Input Labels (WCAG 3.3.2) — 3/3 inputs majú label
  - Dôkaz: HTML-heuristic
- **[OK]** Heading Hierarchy (WCAG 1.3.1) — Žiadne preskočené úrovne
  - Dôkaz: HTML-heuristic

### AI pripravenosť — 72/100

- **[CHYBA]** Content Freshness Signals
  - Riešenie: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Structured Data Foundation — 2 distinct schema types (WebSite, BusinessEntity) — add more for comprehensive AI coverage
  - Riešenie: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
  - Dôkaz: schema
- **[UPOZORNENIE]** FAQ Schema (Direct AI Answers)
  - Riešenie: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Dôkaz: schema
- **[UPOZORNENIE]** Structured Content (Lists & Tables) — 15 lists found — consider adding comparison tables
  - Riešenie: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Author Expertise Signals (E-E-A-T)
  - Riešenie: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Extractable Answer Blocks — 18 paragraphs, avg 19 words — too short for citation
  - Riešenie: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Section Length Optimization — Avg section: 91 words — only 20% in 80-200 word optimal range
  - Riešenie: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Q&A Format Headings
  - Riešenie: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Common Question Coverage — Answers 3/5 — missing: price, availability
  - Riešenie: Add clear content answering the questions shoppers (and AI assistants) ask: pricing, shipping options & cost, returns/refund policy, stock availability, and accepted payment methods. A visible FAQ or info section covering these is ideal.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.bonprix.sk
  - Riešenie: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Knowledge Graph Readiness — 2/4 signals — missing: @id in JSON-LD, consistent brand name (title/schema/OG)
  - Riešenie: Add: @id in JSON-LD, consistent brand name (title/schema/OG). Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Content Readability for AI — Grade 18 — too complex for broad AI citation (technical threshold: 14)
  - Riešenie: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Alt Text Quality for AI — 62% good, 14 poor, 0 missing
  - Riešenie: Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Expert Quotations & Citations
  - Riešenie: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** WebMCP Agentic Readiness
  - Riešenie: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Content-to-Boilerplate Ratio — 38% in main content area — too much boilerplate
  - Riešenie: Move more content into <main> or <article> elements. Reduce navigation text, footer content, and sidebar noise. AI crawlers extract content from semantic containers and discard the rest.
  - Dôkaz: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Dôkaz: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Dôkaz: file-probe
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Dôkaz: file-probe
- **[INFO]** Social Proof (Testimonials / Case Studies) — None detected. For a non-commercial/informational site, testimonials and case studies are optional
  - Dôkaz: HTML-heuristic · istota: low
- **[INFO]** Agent-Commerce Readiness — 81/100 — pripravené pre AI agentov (Prístup 100 · Porozumenie 75 · Objaviteľnosť 100 · Transakcia 50)
- **[INFO]** Agent: Prístup — dostane sa agent dnu — 100/100 (2 signály/-ov)
- **[INFO]** Agent: Porozumenie — rozumie produktom — 75/100 (2 signály/-ov)
- **[INFO]** Agent: Objaviteľnosť — nájde celý katalóg — 100/100 (1 signál)
- **[INFO]** Agent: Transakcia — vie konať (kôš/podmienky) — 50/100 (1 signál)
- **[OK]** AI Bot Access Policy — Explicitly allowed: Googlebot
  - Dôkaz: file-probe
- **[OK]** Content Accessibility for AI — 690 words in raw HTML (1.3% text ratio) — readable by AI crawlers without executing JS
  - Dôkaz: HTML-heuristic
- **[OK]** Organization Schema + Entity Linking — Organization found with 4 sameAs links — strong entity identity
  - Dôkaz: schema
- **[OK]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Dôkaz: schema
- **[OK]** Content Depth for AI — 690 words — rich content for AI analysis and citation
  - Dôkaz: HTML-heuristic
- **[OK]** Answer-First Content Format — First paragraph: 20 words — good content density above the fold
  - Dôkaz: HTML-heuristic
- **[OK]** Heading Hierarchy for AI — Proper structure: 1 H1 → 2 H2s → 3 H3s — clear content outline
  - Dôkaz: HTML-heuristic
- **[OK]** Semantic HTML Structure — 4/6 semantic elements: <nav>, <main>, <header>, <footer>
  - Dôkaz: HTML-heuristic
- **[OK]** Entity Clarity & Brand Signals — OG tags complete + 4 sameAs links: Facebook, Instagram, YouTube
  - Dôkaz: HTML-heuristic
- **[OK]** Statistics & Data Presence — 6 data points found — strong citation magnet
  - Dôkaz: HTML-heuristic
- **[OK]** Internal Link Density — 62 contextual internal links per 1,000 words — strong knowledge graph signal
  - Dôkaz: HTML-heuristic

### GDPR — 63/100

- **[CHYBA]** Cookie Consent Banner (CMP)
  - Riešenie: Install a certified consent management platform: Cookiebot, OneTrust, Usercentrics, or CookieYes. The CMP must block ALL non-essential cookies and scripts until explicit consent is given (opt-in, not opt-out).
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Tracking Scripts Without Consent — 1 tracker(s) loading without consent: Pinterest Tag
  - Riešenie: These tracking scripts fire before user consent: Pinterest Tag. Configure your CMP to block them until explicit opt-in. Use Tag Manager's consent mode or CMP script blocking.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Cookie Policy
  - Riešenie: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** International Data Transfers — 1 US-based tracker(s) without consent: Pinterest Tag
  - Riešenie: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Right to Erasure (Data Deletion)
  - Riešenie: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Dôkaz: HTML-heuristic
- **[INFO]** Terms & Conditions Page — No Terms & Conditions link found — for a non-commercial/informational site this is optional (no purchase or paid service to govern)
  - Dôkaz: HTML-heuristic · istota: low
- **[OK]** Privacy Policy Page — /pomoc/zasady-ochrany-osobnych-udajov/
  - Dôkaz: HTML-heuristic
- **[OK]** Legal Contact / Imprint Page — /corporate/about-us/
  - Dôkaz: HTML-heuristic
- **[OK]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Dôkaz: HTML-heuristic
- **[OK]** Newsletter Consent — Newsletter form with consent mechanism detected
  - Dôkaz: HTML-heuristic
- **[OK]** Data Protection Officer Contact — DPO / data protection contact found
  - Dôkaz: HTML-heuristic
- **[OK]** Withdrawal of Consent Mechanism — Consent withdrawal / opt-out mechanism found
  - Dôkaz: HTML-heuristic

### Zraniteľnosti — 75/100

- **[CHYBA]** Suspicious Inline Script Patterns — Detected: Payment data exfiltration pattern, Dynamic script injection
  - Riešenie: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
  - Dôkaz: file-probe
- **[CHYBA]** DMARC Policy (Email Auth)
  - Riešenie: Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.
  - Dôkaz: DNS
- **[CHYBA]** API Key Exposure in Source — 3 potential API key(s) in HTML: secretKey:"aiXA1G6zeoJUu40oYS3..., AIzaSyByJAknczAEXQ-w_RzW5e85ec...
  - Riešenie: URGENT: Rotate all exposed API keys immediately! Move secrets to server-side environment variables. Never include API keys in client-side HTML or JavaScript. Use server-side proxy endpoints for API calls.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** Inline JavaScript Exposure — 105 KB of inline JavaScript
  - Riešenie: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
  - Dôkaz: HTML-heuristic · istota: low
- **[UPOZORNENIE]** DKIM Signing (Email Auth)
  - Riešenie: Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** Cross-Origin Isolation
  - Riešenie: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Dôkaz: HTTP-header
- **[OK]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Dôkaz: HTML-heuristic
- **[OK]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Dôkaz: file-probe
- **[OK]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Dôkaz: file-probe
- **[OK]** Directory Listing — Disabled — file structure hidden
  - Dôkaz: file-probe
- **[OK]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Dôkaz: file-probe
- **[OK]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Dôkaz: HTML-heuristic
- **[OK]** Form CSRF Protection — 1 form(s) — all have CSRF tokens
  - Dôkaz: HTML-heuristic
- **[OK]** SPF Record (Email Security) — SPF configured: v=spf1 a mx ip4:82.177.16.10/32 ip4:194.79.25.177/32 ip4:194.79.25.55/32 ip4:194
  - Dôkaz: DNS
- **[OK]** Payment Page Security — All essential security headers present on payment page
  - Dôkaz: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

### Prístupnosť — 96/100

- **[UPOZORNENIE]** Skip Link — No skip-to-content link detected
  - Riešenie: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Dôkaz: HTML-heuristic · istota: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[OK]** Page Language — <html lang="sk-SK"> is set
  - Dôkaz: HTML-heuristic
- **[OK]** Image Alt Text — All 37 images have alt attributes
  - Dôkaz: HTML-heuristic
- **[OK]** Form Labels — All 3 form inputs are labelled
  - Dôkaz: HTML-heuristic
- **[OK]** Heading Structure — Single <h1> with a consistent heading outline
  - Dôkaz: HTML-heuristic
- **[OK]** Link Text — Links use descriptive text
  - Dôkaz: HTML-heuristic · istota: low
- **[OK]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Dôkaz: HTML-heuristic
- **[OK]** Zoom & Scaling — Pinch-zoom is not disabled
  - Dôkaz: HTML-heuristic

---

Zulien Score je bezplatný automatizovaný heuristický audit pokrývajúci výkon (Core Web Vitals, TTFB, page weight), SEO (meta tagy, štruktúrované dáta, sitemap), bezpečnosť (SSL/TLS, HSTS, CSP), mobilnú použiteľnosť, AI pripravenosť, súlad s GDPR / ePrivacy a zraniteľnosti. Výsledky sú cache-ované na 6 hodín a re-skenovateľné na požiadanie.

[Zobraziť plnú interaktívnu správu na Zulien Score →](https://score.zulien.sk/sk/r/bonprix.sk)