Posledný sken: 13. júna 2026

D0/100

Podpriemerné

Výsledky skóre

farlesk.sk

Skenované 13. júna 2026

Magento

jQuery 3.7.1

Bootstrap 5.3.8

Font Awesome

Swiper

Toastr

Posledný sken: 13. júna 2026

Akčný plán

Opravte týchto 3 vecí ako prvé

Zoradené podľa dopadu na skóre — každá oprava posunie celkové hodnotenie nahor.

+18potenciálny zisk

36/100

Výkon

Váha: 25% · 5 prešlo · 7 upozornenia · 7 zlyhalo

Čo sme zistili: 8.46s (good: <1.8s)

Prečo na tom záleží: FCP over 3s means users stare at a blank screen for 3+ seconds. 53% of mobile users abandon sites that take over 3 seconds to show content.

Ako to opraviť: Critical: enable full-page caching, eliminate render-blocking resources, preload critical CSS, defer all non-essential JS, and compress images.

Get Store Optimization →

Čo sme zistili: 16.14s (good: <2.5s) — Core Web Vital FAILING

Prečo na tom záleží: LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).

Ako to opraviť: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.

Fix with Performance module →

Čo sme zistili: 2316ms (good: <200ms)

Prečo na tom záleží: TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.

Ako to opraviť: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.

Požiadať o audit rýchlosti

Čo sme zistili: 20.14s (good: <3.4s)

Prečo na tom záleží: Speed Index over 5.8s means users watch a near-blank page for almost 6 seconds. At this speed, you're losing 40%+ of potential customers to competitors.

Ako to opraviť: Your page loads very slowly visually. Prioritize critical rendering path: inline critical CSS, defer non-essential JS, preload hero image, and use a CDN.

Požiadať o audit rýchlosti

Čo sme zistili: 12.5 MB, 290 requests — too heavy!

Prečo na tom záleží: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Ako to opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Get Performance Optimization →

Čo sme zistili: 1967 KB wasted on unused code!

Prečo na tom záleží: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Poznámka: Táto kontrola používa heuristickú detekciu a môže vrátiť aj falošné pozitíva. Odporúčame manuálne overenie.

Ako to opraviť: You're loading 1967 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Čo sme zistili: 11 CSS files — too many!

Prečo na tom záleží: Each CSS file blocks rendering. With 11 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Ako to opraviť: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Čo sme zistili: 376 images without lazy loading

Prečo na tom záleží: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save 80%+ of initial download.

Ako to opraviť: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.

Požiadať o audit rýchlosti

Prečo na tom záleží: Without cache headers, browsers use heuristic caching which is unpredictable. Explicit caching can eliminate 60%+ of requests for repeat visitors.

Ako to opraviť: Add Cache-Control headers: 'max-age=31536000, immutable' for versioned static assets, 'max-age=0, must-revalidate' for HTML.

Požiadať o audit rýchlosti

Čo sme zistili: Only 60% of 5 scripts use async/defer

Prečo na tom záleží: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.

Ako to opraviť: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.

Čo sme zistili: Custom fonts detected without preload hints

Prečo na tom záleží: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

Ako to opraviť: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Požiadať o audit rýchlosti

Čo sme zistili: 11 CSS files without critical CSS extraction

Prečo na tom záleží: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

Ako to opraviť: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Požiadať o audit rýchlosti

Čo sme zistili: 4 external domains without preconnect

Prečo na tom záleží: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

Ako to opraviť: Add <link rel='preconnect'> for key third-party domains: www.googletagmanager.com, www.google.com, code.jquery.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.

Čo sme zistili: 2599 KB of inline JavaScript

Prečo na tom záleží: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.

Ako to opraviť: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.

Požiadať o bezpečnostný audit

14 problémov v kategórii Výkon. Toto škodí vášmu e-shopu.

Váš e-shop zatiaľ nespĺňa podmienky pre odznak Zulien Score. Získajte skóre 80+!

📧 Pripomienky opätovného skenu

Raz mesačne vám napíšeme, kedy urobiť nový sken a sledovať vaše zlepšenia.

Súhlasím s Ochrana súkromia. Pošleme vám report a voliteľné upozornenia na opätovný sken.

🚀 Zlepšite svoje skóre

Naše PrestaShop moduly dokážu automaticky opraviť väčšinu týchto problémov.

Bezplatná 15-min konzultácia · Bez záväzku

Zdieľať a exportovať

Pripravení zlepšiť svoje skóre?

Váš e-shop prichádza o zákazníkov každý deň. Problémy vyššie vás stoja predaje.

Kritické skóre — vyžiadajte si expertný audit

Podrobná analýza od nášho tímu: identifikujeme príčiny problémov, určíme priority opráv a pripravíme akčný plán. Ponuku vám pošleme do 48 hodín.

Opravte si sami

Prejdite si naše moduly a opravte problémy na 2 kliknutia.

Prejsť moduly Zulien

Nechajte to na nás

Opíšte váš cieľ a do 48 h vám pošleme cenovú ponuku. Bez telefonátu.

Získať cenovú ponuku

Odpoveď do 48 h · Bez telefonátu

Spadá vaša firma pod smernicu NIS2?

Smernica EÚ NIS2 vyžaduje od mnohých online firiem dodržiavanie pravidiel kybernetickej bezpečnosti. Overte, či sa vás týka.

Toto je automatizovaný heuristický odhad, nie profesionálny audit. Zistenia odrážajú verejne pozorovateľné signály v čase skenu a môžu obsahovať aj nesprávne nálezy.Prečítajte si o našej metodikeNahlásiť nepresnosťOdstrániť tento report

Zulien Score

Komplexný audit e-shopu — 50+ kontrol v 7 kategóriách

53/100

Grade D

farlesk.sk

Dátum auditu: 13. júna 2026

Platforma: Magento

Online report: https://score.zulien.sk/r/farlesk.sk

Executive summary

Chýb

Upozornení

149

Spolu kontrol

Skóre po kategóriách

Kategória	Skóre	Váha	Chyby	Upozornenia	OK
Výkon	36/100	25%	7	7	5
SEO	83/100	20%	1	4	12
Bezpečnosť	37/100	15%	4	8	3
Mobil	41/100	10%	3	10	5
AI pripravenosť	48/100	10%	4	18	4
GDPR	61/100	10%	2	5	6
Zraniteľnosť	64/100	10%	4	5	10

Kritické zistenia

First Contentful Paint (FCP)· Performance

FCP over 3s means users stare at a blank screen for 3+ seconds. 53% of mobile users abandon sites that take over 3 seconds to show content.

Largest Contentful Paint (LCP)· Performance

LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).

Total Blocking Time (TBT)· Performance

TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.

Speed Index· Performance

Speed Index over 5.8s means users watch a near-blank page for almost 6 seconds. At this speed, you're losing 40%+ of potential customers to competitors.

Celková váha stránky· Performance

Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Nevyužitý kód (CSS + JS)· Performance

Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Počet CSS súborov· Performance

Each CSS file blocks rendering. With 11 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

XML sitemap· SEO

Sitemaps help Google discover and index pages 3-5x faster, especially for large stores with deep category structures.

SSL/TLS certifikát· Security

Chrome, Firefox, and Safari all show 'Not Secure' warnings on HTTP sites. 85% of users will abandon a purchase on an insecure site.

HSTS (Strict-Transport-Security)· Security

Without HSTS, attackers can intercept the first HTTP request and downgrade the connection. This is the #1 way to steal session cookies on public WiFi.

Content-Security-Policy (CSP)· Security

CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.

Ochrana pred clickjackingom· Security

Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Výkon

36/100

Váha: 25% · 5 OK · 7 upozornení · 7 chýb · spolu 19

First Contentful Paint (FCP)Zlyhalo

8.46s (good: <1.8s)

Prečo je to dôležité: FCP over 3s means users stare at a blank screen for 3+ seconds. 53% of mobile users abandon sites that take over 3 seconds to show content.

Ako opraviť: Critical: enable full-page caching, eliminate render-blocking resources, preload critical CSS, defer all non-essential JS, and compress images.

Largest Contentful Paint (LCP)Zlyhalo

16.14s (good: <2.5s) — Core Web Vital FAILING

Prečo je to dôležité: LCP >4s fails Core Web Vitals — Google actively demotes these pages. Each 100ms improvement in LCP correlates with 1.7% higher conversion rate (Vodafone study).

Ako opraviť: Urgent: your largest content element loads too slowly. 1) Preload hero image, 2) Convert to WebP/AVIF, 3) Serve from CDN, 4) Remove render-blocking JS before it, 5) Consider lazy loading all other images.

Total Blocking Time (TBT)Zlyhalo

2316ms (good: <200ms)

Prečo je to dôležité: TBT over 600ms means your page is unresponsive for over half a second. Users who can't interact within 100ms perceive the site as broken. This kills conversions.

Ako opraviť: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.

Speed IndexZlyhalo

20.14s (good: <3.4s)

Prečo je to dôležité: Speed Index over 5.8s means users watch a near-blank page for almost 6 seconds. At this speed, you're losing 40%+ of potential customers to competitors.

Ako opraviť: Your page loads very slowly visually. Prioritize critical rendering path: inline critical CSS, defer non-essential JS, preload hero image, and use a CDN.

Celková váha stránkyZlyhalo

12.5 MB, 290 requests — too heavy!

Prečo je to dôležité: Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is 2.2 MB — you're well above that. Amazon found every 100ms of latency costs 1% of sales.

Ako opraviť: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.

Nevyužitý kód (CSS + JS)Zlyhalo

1967 KB wasted on unused code!

Prečo je to dôležité: Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs.

Ako opraviť: You're loading 1967 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.

Počet CSS súborovZlyhalo

11 CSS files — too many!

Prečo je to dôležité: Each CSS file blocks rendering. With 11 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks.

Ako opraviť: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.

Lazy loadingUpozornenie

376 images without lazy loading

Prečo je to dôležité: Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save 80%+ of initial download.

Ako opraviť: Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.

Cache-Control stratégiaUpozornenie

Prečo je to dôležité: Without cache headers, browsers use heuristic caching which is unpredictable. Explicit caching can eliminate 60%+ of requests for repeat visitors.

Ako opraviť: Add Cache-Control headers: 'max-age=31536000, immutable' for versioned static assets, 'max-age=0, must-revalidate' for HTML.

Stratégia načítania skriptovUpozornenie

Only 60% of 5 scripts use async/defer

Prečo je to dôležité: Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking.

Ako opraviť: Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.

Preload fontovUpozornenie

Custom fonts detected without preload hints

Prečo je to dôležité: Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms.

Ako opraviť: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.

Critical CSS stratégiaUpozornenie

11 CSS files without critical CSS extraction

Prečo je to dôležité: Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites.

Ako opraviť: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.

Connection hint pokrytieUpozornenie

4 external domains without preconnect

Prečo je to dôležité: Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin.

Ako opraviť: Add <link rel='preconnect'> for key third-party domains: www.googletagmanager.com, www.google.com, code.jquery.com. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.

Veľkosť inline JavaScriptUpozornenie

2599 KB of inline JavaScript

Prečo je to dôležité: Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads.

Ako opraviť: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.

Server response time (TTFB)Prešlo

90ms

Cumulative Layout Shift (CLS)Prešlo

0.000 — Core Web Vital ✓

Render-blokujúce zdrojePrešlo

No render-blocking resources found

Kompresia textu (gzip/brotli)Prešlo

All text resources properly compressed

Resource hints (preload/preconnect)Prešlo

20 preload, 0 preconnect hint(s)

SEO

83/100

Váha: 20% · 12 OK · 4 upozornení · 1 chýb · spolu 24

XML sitemapZlyhalo

Prečo je to dôležité: Sitemaps help Google discover and index pages 3-5x faster, especially for large stores with deep category structures.

Ako opraviť: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.

robots.txtUpozornenie

Prečo je to dôležité: robots.txt guides search engine crawling. Without it, crawlers may waste budget on irrelevant pages (admin, cart, checkout).

Ako opraviť: Create a robots.txt file at your domain root. Include a Sitemap directive pointing to your XML sitemap.

Optimalizácia formátov obrázkovUpozornenie

Only 41% next-gen formats — 1 legacy images remain

Prečo je to dôležité: WebP/AVIF images are 30-70% smaller than JPEG/PNG with the same quality. This directly improves page speed, LCP, and mobile experience.

Ako opraviť: Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use <picture> element for browser fallback.

Rozdiel Title vs H1Upozornenie

Title and H1 are identical

Prečo je to dôležité: Identical title and H1 wastes an opportunity to target additional keywords. Different but related title/H1 combinations increase ranking for more keyword variations.

Ako opraviť: Make your title tag and H1 heading different but complementary. The title should include your brand and be click-optimized for SERP. The H1 should be content-focused for on-page experience.

Konzistencia kanonickej URLUpozornenie

Canonical points to different URL: https://www.farlesk.sk

Prečo je to dôležité: A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target.

Ako opraviť: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.

Meta TitlePrešlo

38 chars — "Farby laky, tmely a lepidlá Farlesk.sk"

H1 nadpisPrešlo

"Farby laky, tmely a lepidlá Farlesk.sk"

Štruktúra obsahu (H2 nadpisy)Prešlo

13 H2 subheadings found

Kanonická URLPrešlo

https://www.farlesk.sk

Štruktúrované dáta (JSON-LD)Prešlo

1 block(s): ImageObject, PostalAddress

HTML atribút jazykaPrešlo

lang="sk"

Hreflang tagy (viac jazykov)Prešlo

2 language(s): sk-SK, x-default

Meta robots tagPrešlo

index, follow

FaviconPrešlo

Favicon detected

Hĺbka obsahuPrešlo

2153 words — sufficient content

Hlboká hierarchia nadpisovPrešlo

H2: 13, H3: 8 — well-structured content

Interné prelinkovaniePrešlo

385 internal links — strong site navigation

Meta popisInfo

SPA detected — see note below

Prečo je to dôležité: Without a meta description, Google auto-generates one — often poorly. Custom descriptions can boost CTR by 5.8% (Backlinko study).

Ako opraviť: JS-renderovaná stránka (Nuxt) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne. JS-rendered site detected (Nuxt) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.

Open Graph tagyInfo

SPA detected — see note below

Prečo je to dôležité: Without OG tags, social platforms show ugly auto-generated previews. Proper OG tags increase social engagement by 2-3x.

Twitter/X CardsInfo

SPA detected — see note below

Prečo je to dôležité: Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs.

Alt atribúty obrázkovInfo

Only 52% of 376 images have alt text · SPA detected — see note below

Prečo je to dôležité: Missing alt text means zero visibility in Google Image Search (which drives 20%+ of total search traffic for e-commerce).

Pomer textu k HTMLInfo

0% — very thin content (2153 words) · SPA detected — see note below

Prečo je to dôležité: Google's Helpful Content Update specifically targets thin content pages. This significantly hurts your rankings.

Sémantická HTML štruktúraInfo

Only 3/6 semantic elements — missing: <article>, <main>, <aside> · SPA detected — see note below

Prečo je to dôležité: Semantic HTML gives search engines clear signals about content structure. Pages with proper semantic markup earn more featured snippets and knowledge panel appearances.

Základy prístupnostiInfo

2/4 a11y signals — missing: ARIA labels, skip navigation link · SPA detected — see note below

Prečo je to dôležité: The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO — Google confirms a11y as a ranking signal.

Bezpečnosť

37/100

Váha: 15% · 3 OK · 8 upozornení · 4 chýb · spolu 15

SSL/TLS certifikátZlyhalo

Prečo je to dôležité: Chrome, Firefox, and Safari all show 'Not Secure' warnings on HTTP sites. 85% of users will abandon a purchase on an insecure site.

Ako opraviť: Install a valid SSL certificate (Let's Encrypt is free). Configure your server to serve all pages over HTTPS.

HSTS (Strict-Transport-Security)Zlyhalo

Prečo je to dôležité: Without HSTS, attackers can intercept the first HTTP request and downgrade the connection. This is the #1 way to steal session cookies on public WiFi.

Ako opraviť: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.

Content-Security-Policy (CSP)Zlyhalo

Prečo je to dôležité: CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector.

Ako opraviť: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.

Ochrana pred clickjackingomZlyhalo

Prečo je to dôležité: Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it.

Ako opraviť: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.

DNSSEC podpísanie zónyUpozornenie

No DNSKEY records — zone is unsigned

Prečo je to dôležité: Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities.

Ako opraviť: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.

CAA DNS záznam (autorizácia CA)Upozornenie

No CAA records — any CA can issue certificates for this domain

Prečo je to dôležité: CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017).

Ako opraviť: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.

X-Content-Type-OptionsUpozornenie

Prečo je to dôležité: Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it.

Ako opraviť: Add header: X-Content-Type-Options: nosniff

Referrer-PolicyUpozornenie

Prečo je to dôležité: Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths.

Ako opraviť: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.

Permissions-PolicyUpozornenie

Prečo je to dôležité: Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge.

Ako opraviť: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.

Subresource Integrity (SRI)Upozornenie

Only 0/5 external scripts have integrity hashes

Prečo je to dôležité: Without SRI, if a third-party CDN is compromised, attackers can inject malicious code into your site. The British Airways breach (£20M fine) was exactly this attack vector.

Ako opraviť: Add integrity='sha384-...' and crossorigin='anonymous' attributes to all third-party <script> tags. Use srihash.org to generate hashes.

security.txt (RFC 9116)Upozornenie

Prečo je to dôležité: security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all. Required by ISO 27001 and SOC 2.

Ako opraviť: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.

CDN / WAF ochranaUpozornenie

Prečo je to dôležité: Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts. Cloudflare blocks 150+ billion daily threats.

Ako opraviť: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.

Bezpečnostné flagy cookiesPrešlo

No cookies set on initial response

Odhalenie technológiePrešlo

Server identity hidden

Password Field SecurityPrešlo

1 password field(s) — allow password manager autofill

Mobil

41/100

Váha: 10% · 5 OK · 10 upozornení · 3 chýb · spolu 18

Mobilný performance skóreZlyhalo

27/100 — critically slow

Prečo je to dôležité: A mobile score below 50 means your store takes 5+ seconds to become usable on a phone. 53% of mobile users abandon sites that take over 3 seconds. You're losing the majority of mobile visitors.

Ako opraviť: Your mobile experience is severely degraded. Priority fixes: 1) Reduce JavaScript by 50%+, 2) Convert all images to WebP with responsive sizing, 3) Enable aggressive caching, 4) Use a CDN.

Form labels (WCAG 3.3.2)Zlyhalo

Iba 0/4 inputs má label (0%)

Prečo je to dôležité: EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb.

Ako opraviť: 4 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).

Hierarchia nadpisov (WCAG 1.3.1)Zlyhalo

Preskočené úrovne: h1→h5, h2→h6, h2→h4

Prečo je to dôležité: Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené.

Ako opraviť: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.

Viewport konfiguráciaUpozornenie

Present, but maximum-scale=1 disables pinch-to-zoom

Prečo je to dôležité: Preventing pinch-to-zoom is an accessibility violation (WCAG 1.4.4). Users with vision impairments need zoom. Google penalizes sites that disable zoom.

Ako opraviť: Remove 'maximum-scale=1' and 'user-scalable=no' from your viewport meta tag. Use: <meta name='viewport' content='width=device-width, initial-scale=1'>

Veľkosť tap cieľaUpozornenie

Prečo je to dôležité: Small tap targets cause 37% more mis-taps on mobile (Google UX research). In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue.

Ako opraviť: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.

Čitateľnosť veľkosti písmaUpozornenie

Prečo je to dôležité: Text smaller than 16px forces mobile users to pinch-zoom. This breaks the responsive layout and creates a frustrating experience. Users over 40 are especially affected — and they have the highest purchasing power.

Ako opraviť: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.

PWA funkcieUpozornenie

Prečo je to dôležité: PWAs combine the best of web and native apps. Starbucks' PWA doubled daily active users. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access.

Ako opraviť: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.

Theme colorUpozornenie

Prečo je to dôležité: Theme-color creates a polished, branded mobile experience. It makes your site look native and professional — small detail, big perception impact.

Ako opraviť: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.

Veľkosť inline CSSUpozornenie

543 KB of inline CSS

Prečo je to dôležité: Large inline CSS blocks increase initial HTML download and parsing time — especially painful on mobile with limited CPU and slower connections.

Ako opraviť: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.

Responsívne obrázky (srcset)Upozornenie

376 images without responsive sizing

Prečo je to dôležité: Without srcset, mobile users download full-size desktop images — wasting 50-80% of bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites.

Ako opraviť: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.

Typy form inputovUpozornenie

phone fields use type='text' instead of type='tel'

Prečo je to dôležité: Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors by 30% and speeds up form completion (Baymard Institute).

Ako opraviť: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.

Express checkout (Apple Pay + Google Pay)Upozornenie

Prečo je to dôležité: Mobile conversion pri express checkout je +15-25 % oproti klasickej karte. V SK/CZ trend roku 2025+.

Ako opraviť: Pridaj Apple Pay + Google Pay cez Stripe/Adyen/Mollie. Biometric auth = -1 click checkout = vyšší conversion.

Lokálne SK/CZ platbyUpozornenie

Iba 2 SK/CZ metód (Tatra Pay, QR platba / Pay by square)

Prečo je to dôležité: 48 % SK online platieb ide cez lokálne banky alebo QR platbu (Tatrabanka study 2024). Iba karta = 50 % cart abandonment na SK trhu.

Ako opraviť: Pridaj ďalšie SK/CZ local methods: ComGate, GoPay, Barion, Besteron, PayU. SK zákazníci preferujú bankové tlačidlá a QR platbu pred kartou.

Obsah sa zmestí do viewportuPrešlo

No horizontal scrolling needed

Responsívny dizajnPrešlo

Flexbox, CSS Grid, Media queries detected

Mobilná navigácia (sémantická)Prešlo

<nav> element present — proper navigation landmark

Payment Methods DetectedPrešlo

2 method(s): Tatra Pay, QR platba / Pay by square

Kvalita textu odkazov (WCAG 2.4.4)Prešlo

Všetky odkazy majú popisný text

AI pripravenosť

48/100

Váha: 10% · 4 OK · 18 upozornení · 4 chýb · spolu 39

llms.txt (AI site descriptor)Zlyhalo

Prečo je to dôležité: llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store.

Ako opraviť: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings. Detailed description paragraph. ## Products - [Product Category](URL): Description ## About - [About Us](URL): Company history and values See llmstxt.org for the full specification.

Product Schema CompletenessZlyhalo

Prečo je to dôležité: No Product schema = invisible to AI shopping. 58% of consumers now use AI for product discovery (Adobe 2025). Without Product schema, your products don't exist in this channel.

Ako opraviť: Add complete Product JSON-LD schema: name, description, image, sku, brand, offers (price, priceCurrency, availability, seller), aggregateRating, review. This is mandatory for AI-powered commerce.

Pripravenosť na Knowledge GraphZlyhalo

Prečo je to dôležité: Without Knowledge Graph signals, AI treats your brand as unverified. You won't get a Google Knowledge Panel, and AI assistants can't confidently attribute information to your brand.

Ako opraviť: Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.

Kvalita alt textov pre AIZlyhalo

Only 14% quality alt text — 182 missing, 142 poor

Prečo je to dôležité: Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally.

Ako opraviť: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.

llms-full.txt (kompletný AI content)Upozornenie

Prečo je to dôležité: llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services.

Ako opraviť: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.

Breadcrumb schemaUpozornenie

Prečo je to dôležité: AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'.

Ako opraviť: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.

Site Search schema (SearchAction)Upozornenie

Prečo je to dôležité: SearchAction enables Google's sitelinks search box and allows AI shopping assistants to search your catalog directly. It's how AI agents find specific products in your store.

Ako opraviť: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.

Signály autorskej expertízy (E-E-A-T)Upozornenie

Prečo je to dôležité: AI models weight author expertise heavily. Pages from identified experts get cited 3x more than anonymous content. This is especially important for product guides, reviews, and advice content.

Ako opraviť: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.

Reviews & Ratings schemaUpozornenie

Prečo je to dôležité: Products with star ratings appear in Google's rich results and get 35% more clicks. AI shopping assistants (ChatGPT, Bing Copilot) rank products with reviews significantly higher in recommendations.

Ako opraviť: Add AggregateRating schema (ratingValue, reviewCount, bestRating) and individual Review schemas. AI shopping assistants prioritize products with verified reviews and ratings.

AI plugin manifestUpozornenie

Prečo je to dôležité: ai-plugin.json enables AI agents to interact with your store programmatically — search products, check prices, process orders. This is the bridge between AI assistants and your e-commerce functionality.

Ako opraviť: Create /.well-known/ai-plugin.json if you have an API. This enables direct AI agent integration (ChatGPT Actions, custom GPTs). Include: name_for_model, description_for_model, auth config, and link to OpenAPI spec.

Product Feed (AI Commerce)Upozornenie

Prečo je to dôležité: Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations.

Ako opraviť: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery.

Heureka XML feed (SK/CZ marketplace)Upozornenie

Prečo je to dôležité: Heureka.sk a Heureka.cz sú dominantné cenové porovnávače na SK/CZ trhu (40%+ all e-com discovery traffic). Bez XML feedu nie ste viditeľní na hlavnom trhovisku — strata 20-30 % potenciálneho traffic. Žiaden generický audit tool toto nekontroluje.

Ako opraviť: Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).

Speakable content (voice AI)Upozornenie

Prečo je to dôležité: Voice AI commerce is growing rapidly. SpeakableSpecification tells voice assistants which content to read aloud. Early adoption positions your store for the voice shopping wave.

Ako opraviť: Add SpeakableSpecification schema to identify content sections suitable for voice assistants (Google Assistant, Alexa, Siri). Mark your product summaries and FAQs as speakable.

Prítomnosť štatistík & dátUpozornenie

No statistical data found in content

Prečo je to dôležité: Content without data is 41% less likely to be cited by AI. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics.

Ako opraviť: Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.

Optimalizácia dĺžky sekciíUpozornenie

Avg section: 92 words — only 7% in 80-200 word optimal range

Prečo je to dôležité: Pages with 120-180 word sections earn 70% more AI citations (Otterly Citation Economy 2026). For Google AI Overviews specifically, 100-150 words per section is the sweet spot.

Ako opraviť: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.

Return Policy schemaUpozornenie

Prečo je to dôležité: AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons.

Ako opraviť: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.

Shipping Details schemaUpozornenie

Prečo je to dôležité: Fulfillment speed now factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a massive conversion driver.

Ako opraviť: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.

Čitateľnosť obsahu pre AIUpozornenie

Grade 20 — too complex for broad AI citation (technical threshold: 14)

Prečo je to dôležité: Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are 28% more likely to be cited by AI.

Ako opraviť: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.

Expertné citácieUpozornenie

Prečo je to dôležité: Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions.

Ako opraviť: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).

ai.txt (AI oprávnenia)Upozornenie

Prečo je to dôležité: ai.txt is an emerging standard (proposed May 2025) for fine-grained AI permissions beyond robots.txt. Early adoption signals AI-forward thinking and gives you control over how AI uses your content.

Ako opraviť: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.

WebMCP agentic pripravenosťUpozornenie

Prečo je to dôležité: WebMCP is called 'the new Schema.org moment' — it's how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard.

Ako opraviť: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.

Trust widgetUpozornenie

Žiaden trust widget (Heureka / Trustpilot / AggregateRating) nedetekovaný

Prečo je to dôležité: SK/CZ kupujúci majú 2× vyššiu dôveru k Heureka Ověřeno ako k iným trust signálom (Heureka research 2024). LLM-y (ChatGPT, Perplexity) a Google SGE citujú shopy s AggregateRating schema prednostne.

Ako opraviť: Pre SK/CZ shopy: inštaluj Heureka Ověřeno zákazníky widget (zadarmo pre overených predajcov — https://sluzby.heureka.sk). Alternatívne: Trustpilot, Google Reviews s AggregateRating schema. Trust widget na product + kategória + footer.

Politika prístupu AI botovPrešlo

No AI bot restrictions (allowed by default)

Hĺbka obsahu pre AIPrešlo

2153 words — rich content for AI analysis and citation

Hierarchia nadpisov pre AIPrešlo

Proper structure: 1 H1 → 13 H2s → 8 H3s — clear content outline

Hustota interných odkazovPrešlo

179 contextual internal links per 1,000 words — strong knowledge graph signal

Prístupnosť obsahu pre AIInfo

Only 2153 words visible in HTML — content may be JS-dependent · SPA detected — see note below

Prečo je to dôležité: AI crawlers see only raw HTML. The LLMClicks audit tool found that JS-dependent pages score 70% lower in AI readiness. Server-rendered content is the #1 prerequisite for AI visibility.

Základ štruktúrovaných dátInfo

2 schema types found (ImageObject, PostalAddress) — add more for comprehensive AI coverage · SPA detected — see note below

Prečo je to dôležité: AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Research shows sites with comprehensive schema markup are 36% more likely to be cited by AI.

Organization schema + entity linkingInfo

SPA detected — see note below

Prečo je to dôležité: Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel.

FAQ schema (priame AI odpovede)Info

SPA detected — see note below

Prečo je to dôležité: FAQ schema provides 30% higher AI citation rates (LLMClicks research). ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. It's the fastest way to get your content cited by AI.

Answer-first formát obsahuInfo

Content doesn't start with a strong summary paragraph · SPA detected — see note below

Prečo je to dôležité: AI assistants extract content from the first 100 words to generate summaries. The LLMClicks analyzer found pages with answer-first format get 40% more AI citations. Most AI systems read top-down.

Sémantická HTML štruktúraInfo

3/6 elements — missing: <article>, <main>, <aside> · SPA detected — see note below

Prečo je to dôležité: AI crawlers don't see your CSS. They rely on semantic HTML to distinguish main content from navigation, ads, and boilerplate. The WordLift AI Audit weights semantic HTML as a primary machine-readability signal.

Štruktúrovaný obsah (zoznamy & tabuľky)Info

52 lists found — consider adding comparison tables · SPA detected — see note below

Prečo je to dôležité: AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with much higher accuracy than paragraph text. Structured content = more AI citations.

Signály čerstvosti obsahuInfo

SPA detected — see note below

Prečo je to dôležité: No freshness signals = AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages.

Jasnosť entity & brand signályInfo

SPA detected — see note below

Prečo je to dôležité: AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors. This is a fundamental AI visibility requirement.

Extrahovateľné bloky odpovedíInfo

53 paragraphs, avg 11 words — too short for citation · SPA detected — see note below

Prečo je to dôležité: Pages with 40-80 word paragraphs earn 70% more AI citations (Otterly 2026 data). AI extracts individual paragraphs as answer snippets — dense walls of text get skipped.

Nadpisy vo Q&A formáteInfo

SPA detected — see note below

Prečo je to dôležité: Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries.

Canonical tag pre AI deduplikáciuInfo

Canonical points to different URL: https://www.farlesk.sk · SPA detected — see note below

Prečo je to dôležité: AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely.

Pomer obsahu k boilerplateInfo

No <main> or <article> elements — AI can't isolate content from boilerplate · SPA detected — see note below

Prečo je to dôležité: Without semantic containers, AI crawlers must guess where content starts and navigation ends. This leads to poor content extraction and fewer citations.

GDPR

61/100

Váha: 10% · 6 OK · 5 upozornení · 2 chýb · spolu 15

Tracking skripty bez súhlasuZlyhalo

1 tracker(s) loading without consent: Google Analytics/GTM

Prečo je to dôležité: Loading ANY tracking before consent is a direct GDPR/ePrivacy violation. This is the most commonly fined offense — French CNIL issued €150M+ in fines for this in 2022 alone.

Ako opraviť: These tracking scripts fire before user consent: Google Analytics/GTM. Configure your CMP to block them until explicit opt-in. Use Tag Manager's consent mode or CMP script blocking.

GDPR Art. 6(1)(a) · GDPR Art. 7 · SK 18/2018 § 14

Google Consent Mode v2Zlyhalo

Prečo je to dôležité: Google requires Consent Mode v2 for all EU traffic since March 2024. Without it, Google Ads remarketing and conversion data will not function, and you lose measurement data.

Ako opraviť: Implement Google Consent Mode v2 with gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied' }). Required since March 2024 for EU audiences.

GDPR Art. 6(1)(a) · GDPR Art. 7 · SK 18/2018 § 14

Personal Data Exposure in SourceUpozornenie

3 email(s) found in page source: eshop@farlesk.sk, objednavky@farlesk.sk, 9c4da2877f5ae509dcef7a855e10104b@o4508148132020224.ingest.de.sentry.io

Prečo je to dôležité: Exposing personal email addresses in HTML violates the data minimization principle (GDPR Art. 5). It also invites spam harvesting.

Ako opraviť: Remove plain-text email addresses from HTML source. Use contact forms instead, or obfuscate emails with JavaScript encoding.

Medzinárodné prenosy dátUpozornenie

1 US-based tracker(s) without consent: Google Analytics/GTM

Prečo je to dôležité: The EU-US Data Privacy Framework covers some transfers, but loading US trackers without consent remains a violation. Austrian and French DPAs have ruled Google Analytics non-compliant without proper safeguards.

Ako opraviť: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.

Právo na vymazanie (GDPR Art. 17)Upozornenie

Prečo je to dôležité: GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process. Italian DPA fined companies €20M+ for obstructing erasure requests.

Ako opraviť: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.

Newsletter súhlasUpozornenie

Newsletter signup found without visible consent checkbox

Prečo je to dôležité: GDPR requires 'freely given, specific, informed' consent for marketing emails. A newsletter form without explicit opt-in violates Article 7. Italian DPA fined companies for pre-checked newsletter boxes.

Ako opraviť: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.

Mechanizmus odvolania súhlasuUpozornenie

Prečo je to dôležité: GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding.

Ako opraviť: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.

Stránka ochrany súkromiaPrešlo

/p/ochrana-osobnych-udajov

Právny kontakt / impressumPrešlo

/p/o-nas

Obchodné podmienkyPrešlo

/p/obchodne-podmienky

Šifrovanie dát (žiadny mixed content)Prešlo

All resources loaded over HTTPS

Zdieľanie dát s treťou stranouPrešlo

4 third-party domain(s)

Kontakt na DPOPrešlo

DPO / data protection contact found

Cookie consent banner (CMP)Info

SPA detected — see note below

Prečo je to dôležité: Since 2024, EU regulators actively enforce cookie consent. CNIL fined Google €150M and Amazon €35M for non-compliant cookie banners. Fines can reach 4% of global annual revenue.

Zásady cookiesInfo

SPA detected — see note below

Prečo je to dôležité: The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement.

Zraniteľnosť

64/100

Váha: 10% · 10 OK · 5 upozornení · 4 chýb · spolu 19

CSRF ochrana formulárovZlyhalo

1 form(s) without CSRF tokens

Prečo je to dôležité: CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session.

Ako opraviť: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.

Podozrivé inline skriptyZlyhalo

Detected: Dynamic script injection

Prečo je to dôležité: These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. The 2024 Akamai report found skimmers disguised as Google Tag Manager on thousands of e-commerce sites.

Ako opraviť: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.

Payment Page SecurityZlyhalo

Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection

Prečo je to dôležité: Payment pages without proper security headers violate PCI DSS. This can result in fines of $5,000-$100,000/month from payment processors, and makes card data theft significantly easier.

Ako opraviť: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.

Clickjacking na citlivej stránkeZlyhalo

Prečo je to dôležité: Clickjacking on payment/login pages is a high-severity vulnerability. Users unknowingly submit credentials or payments through invisible iframes. PCI DSS requires frame-busting on payment pages.

Ako opraviť: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.

Únik e-mailovej adresyUpozornenie

3 email(s) in page source

Prečo je to dôležité: Exposed emails get harvested by spam bots within hours. This leads to phishing attacks targeting your staff and customers.

Ako opraviť: Replace plain-text emails with contact forms or encode them with JavaScript. Use '[at]' obfuscation or create a /contact page.

Odhalený inline JavaScriptUpozornenie

2599 KB of inline JavaScript

Prečo je to dôležité: Large amounts of inline JavaScript prevent proper CSP implementation and increase the risk of XSS. External scripts can be protected with SRI hashes.

Ako opraviť: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).

DMARC policy (e-mail auth)Upozornenie

DMARC set to p=none (monitoring only, no enforcement)

Prečo je to dôležité: DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes.

Ako opraviť: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.

Cross-Origin IsolationUpozornenie

Prečo je to dôležité: Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers.

Ako opraviť: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.

Integrita CDN skriptov (SRI)Upozornenie

1 CDN script(s) without Subresource Integrity

Prečo je to dôležité: CDN scripts without SRI can be tampered with if the CDN is compromised. The polyfill.io attack (2024, 380K+ sites) and British Airways breach (£20M fine) were both CDN supply chain attacks.

Ako opraviť: Add integrity='sha384-...' crossorigin='anonymous' to CDN scripts from: code.jquery.com. Generate hashes at srihash.org.

Odhalenie verzie CMSPrešlo

No generator tag — CMS identity hidden

Odhalené citlivé súboryPrešlo

.env, .git, composer.json — all properly blocked

Odhalený inštalačný scriptPrešlo

No /install/ or /setup/ paths accessible

Directory listingPrešlo

Disabled — file structure hidden

Admin panel na predvolenej URLPrešlo

Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)

Debug mód / odhalenie chýbPrešlo

No debug indicators found in page output

jQuery VersionPrešlo

jQuery 3.7.1

Bootstrap VersionPrešlo

Bootstrap 5.3.8

SPF záznam (e-mail security)Prešlo

SPF configured: v=spf1 a mx include:_spf.speedweb.sk -all

DKIM podpisovanie (e-mail auth)Prešlo

DKIM configured (selectors: default, s1, mail)

Ďalšie kroky

Začnite s chybami — každá červená položka má návod Ako opraviť. Zamerajte sa na kategórie Bezpečnosť a GDPR, ktoré majú zákonné dôsledky.
Opakujte audit po oprave — spustite nový sken na score.zulien.sk a porovnajte skóre.
Konzultujte zložitejšie problémy — pre hlboký audit alebo expertné posúdenie navštívte inger.sk.
Sledujte súlad s NIS2 a GDPR — ak váš e-shop spadá pod NIS2 (obrat >10 mil. EUR alebo >50 zamestnancov), potrebujete formálny rámec súladu.

Online report

Plnú interaktívnu verziu s klikateľnými odkazmi a možnosťou opätovného skenu nájdete tu:

https://score.zulien.sk/r/farlesk.sk

Upozornenie: Tento report je automaticky vygenerovaný nástrojom Zulien Score. Zistenia vychádzajú z verejne dostupných dát a technickej analýzy. Pre právne záväzné posúdenie (napríklad súladu s GDPR) odporúčame konzultáciu s DPO alebo advokátom špecializujúcim sa na ochranu osobných údajov. Zulien Score nie je licencovaná právna ani auditná spoločnosť.

Zulien Score · score.zulien.sk · by Zulien · Hosted at inger.sk