# pilulka.sk — Zulien Score 59/100 (známka C)

> Bezplatný audit e-shopu: 59/100 celkové skóre. Platforma: Magento. Firma: Pilulka Lékárny a.s.. 100+ kontrol v 7 kategóriách (výkon, SEO, bezpečnosť, mobil, AI pripravenosť, GDPR, zraniteľnosti).

- **Auditovaný:** https://pilulka.sk
- **Platforma:** Magento
- **Firma:** Pilulka Lékárny a.s.
- **Dátum auditu:** 2026-07-28
- **Plná správa:** https://score.zulien.sk/sk/r/pilulka.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/pilulka.sk

## Zhrnutie auditu

Váš obchod má základy na mieste, ale existujú dôležité medzery. Prioritne pridajte Open Graph značky a XML sitemap na zlepšenie SEO. Bezpečnosť a SEO sú vaše silné stránky.

## Skóre podľa kategórií

| Kategória | Skóre |
|---|---|
| Výkon | 45/100 |
| SEO | 71/100 |
| Bezpečnosť | 71/100 |
| Mobil | 49/100 |
| AI pripravenosť | 60/100 |
| GDPR | 66/100 |
| Zraniteľnosti | 58/100 |
| Prístupnosť | 59/100 |

## Detailné nálezy

### Výkon — 45/100

- **[CHYBA]** Total Blocking Time (TBT) — 608ms (good: <200ms)
  - Riešenie: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.
  - Dôkaz: PSI-lab
- **[CHYBA]** Cumulative Layout Shift (CLS) — 0.453 (good: <0.1) — Core Web Vital FAILING
  - Riešenie: Urgent layout stability issues. 1) Add width/height to all <img> and <video>, 2) Reserve space for ads with min-height, 3) Use font-display: swap for web fonts, 4) Don't dynamically inject content above visible area.
  - Dôkaz: PSI-lab
- **[CHYBA]** Total Page Weight — 4.5 MB, 199 requests — too heavy!
  - Riešenie: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
  - Dôkaz: PSI-lab
- **[CHYBA]** Unused Code (CSS + JS) — 419 KB wasted on unused code!
  - Riešenie: You're loading 419 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
  - Dôkaz: PSI-lab
- **[CHYBA]** CSS File Count — 22 CSS files — too many!
  - Riešenie: Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Server Response Time (TTFB) — 525ms (optimal: <200ms)
  - Riešenie: Optimize server response: enable opcode caching (OPcache), add Redis/Memcached for database caching, use a CDN. Check slow database queries.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Cache-Control Strategy — no-cache
  - Riešenie: Set appropriate cache headers: static assets should have max-age=31536000 with versioned filenames. HTML pages can use max-age=0 with ETag for revalidation.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Critical CSS Strategy — 22 CSS files without critical CSS extraction
  - Riešenie: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Connection Hint Coverage — 4 external domains without preconnect
  - Riešenie: Add <link rel='preconnect'> for key third-party domains: sdp-api.lnd.bz, translate.google.com, pilulkask.vshcdn.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.
  - Dôkaz: PSI-lab
- **[UPOZORNENIE]** Inline JavaScript Size — 770 KB of inline JavaScript
  - Riešenie: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
  - Dôkaz: PSI-lab
- **[INFO]** Render-blocking Resources — Not measured — PageSpeed did not return the render-blocking audit for this URL
  - Dôkaz: PSI-lab
- **[OK]** First Contentful Paint (FCP) — 1.27s
  - Dôkaz: PSI-lab
- **[OK]** Largest Contentful Paint (LCP) — 2.31s — Core Web Vital ✓
  - Dôkaz: PSI-lab
- **[OK]** Speed Index — 2.80s
  - Dôkaz: PSI-lab
- **[OK]** Text Compression (gzip/brotli) — All text resources properly compressed
  - Dôkaz: HTTP-header
- **[OK]** Resource Hints (Preload/Preconnect) — 6 preload, 4 preconnect hint(s)
  - Dôkaz: HTML-heuristic
- **[OK]** Lazy Loading — 24% of images use native lazy loading (197/818)
  - Dôkaz: HTML-heuristic
- **[OK]** Script Loading Strategy — 100% of scripts use async/defer/module (3 async, 0 defer, 1 module)
  - Dôkaz: HTML-heuristic

### SEO — 71/100

- **[CHYBA]** Open Graph Tags
  - Riešenie: Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** XML Sitemap
  - Riešenie: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.
  - Dôkaz: file-probe
- **[CHYBA]** Product Schema Richness — Missing required fields: description, image
  - Riešenie: Add complete Product schema with at minimum: name, description, image, and offers (with price and availability).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** H1 Heading — 2 H1 tags (should be exactly 1)
  - Riešenie: Consolidate to exactly one H1 tag per page. Use H2-H6 for subheadings.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Twitter/X Cards
  - Riešenie: Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Alt Attributes — Only 70% of 818 images have alt text
  - Riešenie: 246 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Format Optimization — 0% next-gen formats — 2 JPEG, 43 PNG images
  - Riešenie: Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Title/H1 Differentiation — Title and H1 are identical
  - Riešenie: Make your title tag and H1 heading different but complementary. The title should include your brand and be click-optimized for SERP. The H1 should be content-focused for on-page experience.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Semantic HTML Structure — Only 3/6 semantic elements — missing: <article>, <nav>, <aside>
  - Riešenie: Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical URL Consistency — Canonical points to different URL: https://www.pilulka.sk
  - Riešenie: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Empty/Dead Links — 23 dead links (0 empty, 23 hash-only, 0 javascript:void)
  - Riešenie: Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Image Dimension Attributes — Only 5% of images have width/height attributes
  - Riešenie: Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.
  - Dôkaz: HTML-heuristic
- **[INFO]** Text-to-HTML Ratio — 2% ratio but 3825 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content
  - Dôkaz: HTML-heuristic
- **[OK]** Meta Title — 33 chars — "Pilulka.sk - Zdravie s presnosťou"
  - Dôkaz: HTML-heuristic
- **[OK]** Meta Description — 154 chars
  - Dôkaz: HTML-heuristic
- **[OK]** Content Structure (H2 Headings) — 32 H2 subheadings found
  - Dôkaz: HTML-heuristic
- **[OK]** Canonical URL — https://www.pilulka.sk
  - Dôkaz: HTML-heuristic
- **[OK]** Structured Data (JSON-LD) — 1 block(s): WebSite, SearchAction, Organization, ContactPoint
  - Dôkaz: schema
- **[OK]** JSON-LD Validity — 1 block(s) parse cleanly
  - Dôkaz: HTML-heuristic
- **[OK]** robots.txt — Present
  - Dôkaz: file-probe
- **[OK]** HTML Language Attribute — lang="sk"
  - Dôkaz: HTML-heuristic
- **[OK]** Favicon — Favicon detected
  - Dôkaz: file-probe
- **[OK]** Content Depth — 3825 words — sufficient content
  - Dôkaz: HTML-heuristic
- **[OK]** Deep Heading Hierarchy — H2: 32, H3: 174 — well-structured content
  - Dôkaz: HTML-heuristic
- **[OK]** Internal Linking — 754 internal links — strong site navigation
  - Dôkaz: HTML-heuristic
- **[OK]** Accessibility Fundamentals — 3/4 a11y signals: 3 ARIA roles, 197 ARIA labels, lang="sk"
  - Dôkaz: HTML-heuristic

### Bezpečnosť — 71/100

- **[CHYBA]** HSTS (Strict-Transport-Security)
  - Riešenie: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** DNSSEC — No DNSKEY records — zone is unsigned
  - Riešenie: Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.
  - Dôkaz: DNS
- **[UPOZORNENIE]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Riešenie: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
  - Dôkaz: DNS
- **[UPOZORNENIE]** X-Content-Type-Options
  - Riešenie: Add header: X-Content-Type-Options: nosniff
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Referrer-Policy
  - Riešenie: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Permissions-Policy
  - Riešenie: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Cookie Security Flags — 1 cookie(s): 1 missing Secure, 1 missing HttpOnly, 1 missing SameSite
  - Riešenie: Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Technology Disclosure — X-Powered-By: Nuxt
  - Riešenie: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Subresource Integrity (SRI) — Only 0/4 SRI-eligible third-party scripts have integrity hashes
  - Riešenie: Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.
  - Dôkaz: HTML-heuristic
- **[OK]** SSL/TLS Certificate — Valid HTTPS connection established
  - Dôkaz: SSL
- **[OK]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
  - Dôkaz: HTTP-header
- **[OK]** Content-Security-Policy (CSP) — Present and reasonably configured
  - Dôkaz: HTTP-header
- **[OK]** Clickjacking Protection — X-Frame-Options: DENY
  - Dôkaz: HTTP-header
- **[OK]** security.txt (RFC 9116) — Present at /.well-known/security.txt
  - Dôkaz: file-probe
- **[OK]** CDN / WAF Protection — Cloudflare detected — DDoS protection and edge caching active
  - Dôkaz: HTTP-header
- **[OK]** Password Field Security — 1 password field(s) — allow password manager autofill
  - Dôkaz: HTTP-header

### Mobil — 49/100

- **[CHYBA]** Mobile Performance Score — 34/100 — critically slow
  - Riešenie: Your mobile experience is severely degraded. Priority fixes: 1) Reduce JavaScript, 2) Convert all images to WebP with responsive sizing, 3) Enable aggressive caching, 4) Use a CDN.
  - Dôkaz: PSI-lab
- **[CHYBA]** Form Input Labels (WCAG 3.3.2) — Iba 2/4 inputs má label (50%)
  - Riešenie: 2 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Touch Target Size — Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
  - Riešenie: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
  - Dôkaz: PSI-lab · Some tappable targets are too small or too close together (Lighthouse tap-targets audit)
- **[UPOZORNENIE]** Font Size Readability — Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
  - Riešenie: Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.
  - Dôkaz: PSI-lab · Some text renders below the 12px legibility threshold (Lighthouse font-size audit)
- **[UPOZORNENIE]** PWA Features — Has service worker, missing web app manifest
  - Riešenie: Add a web app manifest to enable PWA features. Add <link rel='manifest' href='/manifest.json'> with name, icons, start_url, and display: standalone.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Theme Color
  - Riešenie: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Mobile Navigation (Semantic)
  - Riešenie: Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Text Overflow Handling — No word-break/overflow-wrap CSS detected
  - Riešenie: Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Print Stylesheet — Order/invoice page without print styles
  - Riešenie: Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h2→h5
  - Riešenie: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
  - Dôkaz: HTML-heuristic
- **[INFO]** Payment Methods Detected — Žiadna známa platobná brána nedetekovaná na homepage
  - Dôkaz: HTML-heuristic
- **[INFO]** Express Checkout (Apple Pay + Google Pay) — Apple Pay / Google Pay nedetekované na homepage — express checkout sa zvyčajne zobrazí až v košíku/checkoute
  - Dôkaz: HTML-heuristic
- **[INFO]** SK/CZ Local Payment Methods — Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute
  - Dôkaz: HTML-heuristic
- **[OK]** Viewport Configuration — width=device-width, initial-scale=1
  - Dôkaz: HTML-heuristic
- **[OK]** Content Fits Viewport — No horizontal scrolling needed
  - Dôkaz: HTML-heuristic
- **[OK]** Responsive Design Techniques — Media queries detected
  - Dôkaz: HTML-heuristic
- **[OK]** Responsive Images (srcset) — 365 image(s) use srcset for responsive sizing
  - Dôkaz: HTML-heuristic
- **[OK]** Form Input Types — Optimized: 2 email, 1 search
  - Dôkaz: HTML-heuristic
- **[OK]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text
  - Dôkaz: HTML-heuristic

### AI pripravenosť — 60/100

- **[CHYBA]** AI Bot Access Policy — Major AI bots BLOCKED: ClaudeBot, Google-Extended, GPTBot
  - Riešenie: Remove Disallow rules for ClaudeBot, Google-Extended, GPTBot in robots.txt. These are the primary crawlers for ChatGPT Search, Claude, Perplexity, and Google AI Overviews. Without access, your store is invisible to AI-powered search.
  - Dôkaz: file-probe
- **[CHYBA]** Product Schema Completeness — Only 45% complete — critical fields missing
  - Riešenie: Your Product schema is critically incomplete. Add at minimum: name, description, image, offers (with price, priceCurrency, availability), brand, sku, and aggregateRating.
  - Dôkaz: schema
- **[CHYBA]** Heading Hierarchy for AI — 2 H1, 32 H2, 174 H3 — poor structure
  - Riešenie: Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Content Freshness Signals
  - Riešenie: Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.
  - Dôkaz: HTML-heuristic
- **[CHYBA]** Image Alt Text Quality for AI — Only 28% quality alt text — 246 missing, 215 poor
  - Riešenie: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Structured Data Foundation — 3 distinct schema types (WebSite, BusinessEntity, Product) — add more for comprehensive AI coverage
  - Riešenie: Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.
  - Dôkaz: schema
- **[UPOZORNENIE]** FAQ Schema (Direct AI Answers)
  - Riešenie: Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).
  - Dôkaz: schema
- **[UPOZORNENIE]** Breadcrumb Schema
  - Riešenie: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
  - Dôkaz: schema
- **[UPOZORNENIE]** Answer-First Content Format — Content doesn't start with a strong summary paragraph
  - Riešenie: Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Semantic HTML Structure — 3/6 elements — missing: <article>, <nav>, <aside>
  - Riešenie: Add: <article>, <nav>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Structured Content (Lists & Tables) — 26 lists found — consider adding comparison tables
  - Riešenie: Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Entity Clarity & Brand Signals — 5 sameAs links but incomplete OG tags
  - Riešenie: For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Author Expertise Signals (E-E-A-T)
  - Riešenie: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Product Feed (AI Commerce)
  - Riešenie: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.
  - Dôkaz: file-probe · probed /feed/products.xml, /google-shopping.xml, /export/google-shopping.xml — none returned a product feed
- **[UPOZORNENIE]** Heureka XML Feed
  - Riešenie: Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).
  - Dôkaz: file-probe
- **[UPOZORNENIE]** Extractable Answer Blocks — 16 paragraphs, avg 210 words — too long for AI snippets
  - Riešenie: Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Section Length Optimization — Avg section: 20 words — only 0% in 80-200 word optimal range
  - Riešenie: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Q&A Format Headings
  - Riešenie: Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://www.pilulka.sk
  - Riešenie: Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Return Policy Schema
  - Riešenie: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
  - Dôkaz: schema
- **[UPOZORNENIE]** Shipping Details Schema
  - Riešenie: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
  - Dôkaz: schema
- **[UPOZORNENIE]** Content Readability for AI — Grade 20 — too complex for broad AI citation (technical threshold: 14)
  - Riešenie: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Expert Quotations & Citations
  - Riešenie: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** WebMCP Agentic Readiness
  - Riešenie: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
  - Dôkaz: HTML-heuristic
- **[INFO]** llms.txt (AI Site Descriptor) — Not present — not required for AI visibility
  - Dôkaz: file-probe
- **[INFO]** llms-full.txt (Complete AI Content) — Not present — not required for AI visibility
  - Dôkaz: file-probe
- **[INFO]** AI Plugin Manifest — Not present — not required (the ChatGPT-plugins manifest was retired in 2024)
  - Dôkaz: file-probe
- **[INFO]** Speakable Content (Voice AI) — Not present — optional; SpeakableSpecification has limited assistant adoption
  - Dôkaz: HTML-heuristic
- **[INFO]** ai.txt (AI Permissions) — Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt
  - Dôkaz: file-probe
- **[INFO]** Agent-Commerce Readiness — 54/100 — čiastočne pripravené (Prístup 50 · Porozumenie 50 · Objaviteľnosť 67 · Transakcia 50)
- **[INFO]** Agent: Prístup — dostane sa agent dnu — 50/100 (2 signály/-ov)
- **[INFO]** Agent: Porozumenie — rozumie produktom — 50/100 (3 signály/-ov)
- **[INFO]** Agent: Objaviteľnosť — nájde celý katalóg — 67/100 (3 signály/-ov)
- **[INFO]** Agent: Transakcia — vie konať (kôš/podmienky) — 50/100 (3 signály/-ov)
- **[OK]** Content Accessibility for AI — 3825 words in raw HTML (1.7% text ratio) — readable by AI crawlers without executing JS
  - Dôkaz: HTML-heuristic
- **[OK]** Organization Schema + Entity Linking — Organization found with 5 sameAs links — strong entity identity
  - Dôkaz: schema
- **[OK]** Site Search Schema (SearchAction) — WebSite SearchAction configured — AI can search your store
  - Dôkaz: schema
- **[OK]** Content Depth for AI — 3825 words — rich content for AI analysis and citation
  - Dôkaz: HTML-heuristic
- **[OK]** Reviews & Ratings Schema — AggregateRating/Review data found — social proof for AI
  - Dôkaz: schema
- **[OK]** Statistics & Data Presence — 5 data points found — strong citation magnet
  - Dôkaz: HTML-heuristic
- **[OK]** Common Question Coverage — Answers 4/5 key shopper questions: price, shipping, returns/refunds, payment
  - Dôkaz: HTML-heuristic
- **[OK]** Internal Link Density — 197 contextual internal links per 1,000 words — strong knowledge graph signal
  - Dôkaz: HTML-heuristic
- **[OK]** Knowledge Graph Readiness — 3/4 entity signals — strong Knowledge Graph presence
  - Dôkaz: HTML-heuristic
- **[OK]** Content-to-Boilerplate Ratio — 84% of text in <main>/<article> — clean content signal
  - Dôkaz: HTML-heuristic
- **[OK]** AggregateRating Schema — Review aggregate rating schema present
  - Dôkaz: schema
- **[OK]** Customer Reviews — Aggregate — 1 source: AggregateRating schema — ★ 4.8 · 35 999 reviews
  - Dôkaz: HTML-heuristic

### GDPR — 66/100

- **[CHYBA]** Consumer Dispute Resolution Links — No EU ODR platform or supervisory-authority link found
  - Riešenie: Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Cookie Policy
  - Riešenie: Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** International Data Transfers — 3 US-based tracker(s) without consent: Google Analytics/GTM, Microsoft Clarity, Google Ads
  - Riešenie: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Right to Erasure (Data Deletion)
  - Riešenie: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Newsletter Consent — Newsletter signup found without visible consent checkbox
  - Riešenie: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Withdrawal of Consent Mechanism
  - Riešenie: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Omnibus Price Disclosure (30-day low) — Discounts shown without a visible 'lowest price in last 30 days' reference
  - Riešenie: Whenever you advertise a price reduction, display the lowest price applied in the 30 days before the discount, next to the new price. In PrestaShop add a 30-day price-history anchor (e.g. our zu_pricehistory module) so every sale label is compliant automatically.
  - Dôkaz: HTML-heuristic · istota: low
- **[UPOZORNENIE]** Withdrawal & Complaints Policy — Missing: right of withdrawal (odstúpenie od zmluvy)
  - Riešenie: Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Online Withdrawal Function — No online withdrawal function or withdrawal information detected
  - Riešenie: Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.
  - Dôkaz: HTML-heuristic · istota: low
- **[INFO]** Cookie Consent Banner (CMP) — No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)
  - Dôkaz: HTML-heuristic · 1 GTM container(s) detected · istota: low
- **[INFO]** Tracking Scripts & Consent — 4 tracker(s) detected (Google Analytics/GTM, Microsoft Clarity, Matomo, Google Ads); no CMP visible in server HTML but GTM is present
  - Dôkaz: HTML-heuristic · 1 GTM container(s) detected · istota: low
- **[INFO]** Google Consent Mode v2 — No Consent Mode signals in server HTML, but GTM is present — Consent Mode is commonly configured inside GTM
  - Dôkaz: HTML-heuristic · 1 GTM container(s) detected · istota: low
- **[OK]** Privacy Policy Page — https://www.pilulka.sk/zasady-o-ochrane-osobnych-udajov
  - Dôkaz: HTML-heuristic
- **[OK]** Legal Contact / Imprint Page — https://www.pilulka.sk/o-nas
  - Dôkaz: HTML-heuristic
- **[OK]** Terms & Conditions Page — https://pilulkask.vshcdn.net/_nuxt/default.CGVycd2Q.css
  - Dôkaz: HTML-heuristic
- **[OK]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
  - Dôkaz: HTML-heuristic
- **[OK]** Third-party Data Sharing — 4 third-party domain(s)
  - Dôkaz: HTML-heuristic
- **[OK]** Data Protection Officer Contact — DPO / data protection contact found
  - Dôkaz: HTML-heuristic

### Zraniteľnosti — 58/100

- **[CHYBA]** Form CSRF Protection — 3 form(s) without CSRF tokens
  - Riešenie: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
  - Dôkaz: HTML-heuristic · istota: low
- **[CHYBA]** Suspicious Inline Script Patterns — Detected: Payment data exfiltration pattern, Dynamic script injection
  - Riešenie: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
  - Dôkaz: file-probe
- **[CHYBA]** Payment Page Security — Payment page missing: No HSTS, No X-Content-Type-Options
  - Riešenie: CRITICAL: Your payment page is missing security headers: No HSTS, No X-Content-Type-Options. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
  - Dôkaz: file-probe
- **[CHYBA]** API Key Exposure in Source — 1 potential API key(s) in HTML: apiKey:"eyJpIjo0NjYsImMiOjE2Nz...
  - Riešenie: URGENT: Rotate all exposed API keys immediately! Move secrets to server-side environment variables. Never include API keys in client-side HTML or JavaScript. Use server-side proxy endpoints for API calls.
  - Dôkaz: file-probe
- **[CHYBA]** Server Error Leak — PHP/server error messages visible in page output
  - Riešenie: Set display_errors=Off in php.ini and log_errors=On. Configure a custom error page. Never show stack traces, SQL errors, or file paths to users.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** CORS Configuration — Access-Control-Allow-Origin: * (allows any domain)
  - Riešenie: Replace the wildcard CORS header with specific allowed origins. Avoid Access-Control-Allow-Origin: * on pages with authentication or sensitive data.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** X-Powered-By Header — Nuxt
  - Riešenie: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').
  - Dôkaz: file-probe
- **[UPOZORNENIE]** Inline JavaScript Exposure — 770 KB of inline JavaScript
  - Riešenie: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
  - Dôkaz: HTML-heuristic · istota: low
- **[UPOZORNENIE]** Source Maps Exposed — JavaScript source maps (.js.map) are publicly accessible
  - Riešenie: Remove source maps from production or block access via server config. In Vite/Webpack: set sourcemap: false for production builds.
  - Dôkaz: file-probe
- **[UPOZORNENIE]** Cross-Origin Isolation
  - Riešenie: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
  - Dôkaz: HTTP-header
- **[UPOZORNENIE]** Login Form Security — Login form blocks password manager autofill
  - Riešenie: Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.
  - Dôkaz: file-probe
- **[INFO]** BIMI Brand Indicators
  - Dôkaz: file-probe
- **[OK]** CMS Version Disclosure — No generator tag — CMS identity hidden
  - Dôkaz: HTML-heuristic
- **[OK]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
  - Dôkaz: file-probe
- **[OK]** Install Script Exposed — No /install/ or /setup/ paths accessible
  - Dôkaz: file-probe
- **[OK]** Directory Listing — Disabled — file structure hidden
  - Dôkaz: file-probe
- **[OK]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
  - Dôkaz: file-probe
- **[OK]** Debug Mode / Error Exposure — No debug indicators found in page output
  - Dôkaz: HTML-heuristic
- **[OK]** SPF Record (Email Security) — SPF configured: v=spf1 include:_spf.google.com +a +mx +ip4:5.9.109.214 +ip4:5.9.109.219 +ip4:37.
  - Dôkaz: DNS
- **[OK]** DMARC Policy (Email Auth) — DMARC enforced: p=quarantine
  - Dôkaz: DNS
- **[OK]** DKIM Signing (Email Auth) — DKIM configured (selectors: google, s1)
  - Dôkaz: file-probe

### NIS2

- **[INFO]** NIS2 Compliance — Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).

### Prístupnosť — 59/100

- **[CHYBA]** Image Alt Text — 246 of 818 images have no alt attribute
  - Riešenie: Add descriptive alt text to every meaningful image; use alt="" for purely decorative ones so screen readers skip them.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Form Labels — 2 of 4 form inputs missing a label
  - Riešenie: Add a <label for> or aria-label to the remaining inputs.
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Heading Structure — 2 <h1> headings found (expected one)
  - Riešenie: Use a single <h1> and don't jump heading levels (e.g. <h2> straight to <h4>).
  - Dôkaz: HTML-heuristic
- **[UPOZORNENIE]** Skip Link — No skip-to-content link detected
  - Riešenie: Add a visually-hidden "Skip to content" link as the first focusable element, targeting <main id="main">.
  - Dôkaz: HTML-heuristic · istota: low
- **[INFO]** EAA Legal Basis — In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.
- **[OK]** Page Language — <html lang="sk"> is set
  - Dôkaz: HTML-heuristic
- **[OK]** Link Text — Links use descriptive text
  - Dôkaz: HTML-heuristic · istota: low
- **[OK]** Landmark Regions — Semantic landmarks present (<main>, <nav>/<header>)
  - Dôkaz: HTML-heuristic
- **[OK]** Zoom & Scaling — Pinch-zoom is not disabled
  - Dôkaz: HTML-heuristic

---

Zulien Score je bezplatný automatizovaný heuristický audit pokrývajúci výkon (Core Web Vitals, TTFB, page weight), SEO (meta tagy, štruktúrované dáta, sitemap), bezpečnosť (SSL/TLS, HSTS, CSP), mobilnú použiteľnosť, AI pripravenosť, súlad s GDPR / ePrivacy a zraniteľnosti. Výsledky sú cache-ované na 6 hodín a re-skenovateľné na požiadanie.

[Zobraziť plnú interaktívnu správu na Zulien Score →](https://score.zulien.sk/sk/r/pilulka.sk)
