# zlatnictvohorvath.sk — Zulien Score 64/100 (známka C)

> Bezplatný audit e-shopu: 64/100 celkové skóre. Platforma: Magento. 100+ kontrol v 7 kategóriách (výkon, SEO, bezpečnosť, mobil, AI pripravenosť, GDPR, zraniteľnosti).

- **Auditovaný:** https://www.zlatnictvohorvath.sk/
- **Platforma:** Magento
- **Dátum auditu:** 2026-06-13
- **Plná správa:** https://score.zulien.sk/sk/r/zlatnictvohorvath.sk
- **JSON API:** https://euyszfecnvwsqpigioyx.supabase.co/functions/v1/api-v1/score/zlatnictvohorvath.sk

## Skóre podľa kategórií

| Kategória | Skóre |
|---|---|
| Výkon | 67/100 |
| SEO | 91/100 |
| Bezpečnosť | 55/100 |
| Mobil | 46/100 |
| AI pripravenosť | 53/100 |
| GDPR | 52/100 |
| Zraniteľnosti | 59/100 |

## Detailné nálezy

### Výkon — 67/100

- **[CHYBA]** Total Blocking Time (TBT) — 947ms (good: <200ms)
  - Riešenie: Critical: audit all JavaScript. 1) Remove unused plugins/modules, 2) Defer analytics and chat widgets, 3) Code-split large bundles, 4) Move heavy computation to web workers.
- **[CHYBA]** Total Page Weight — 4.0 MB, 186 requests — too heavy!
  - Riešenie: Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.
- **[CHYBA]** Unused Code (CSS + JS) — 592 KB wasted on unused code!
  - Riešenie: You're loading 592 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.
- **[UPOZORNENIE]** CSS File Count — 8 CSS files loaded
  - Riešenie: Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.
- **[UPOZORNENIE]** Font Preloading — Custom fonts detected without preload hints
  - Riešenie: Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.
- **[UPOZORNENIE]** Critical CSS Strategy — 8 CSS files without critical CSS extraction
  - Riešenie: Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel="stylesheet"'>.
- **[UPOZORNENIE]** Inline JavaScript Size — 468 KB of inline JavaScript
  - Riešenie: Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.
- **[OK]** Server Response Time (TTFB) — 108ms
- **[OK]** First Contentful Paint (FCP) — 1.08s
- **[OK]** Largest Contentful Paint (LCP) — 1.70s — Core Web Vital ✓
- **[OK]** Cumulative Layout Shift (CLS) — 0.000 — Core Web Vital ✓
- **[OK]** Speed Index — 2.27s
- **[OK]** Render-blocking Resources — No render-blocking resources found
- **[OK]** Text Compression (gzip/brotli) — All text resources properly compressed
- **[OK]** Resource Hints (Preload/Preconnect) — 4 preload, 0 preconnect hint(s)
- **[OK]** Lazy Loading — 32% of images use native lazy loading (112/348)
- **[OK]** Script Loading Strategy — 100% of scripts use async/defer/module (1 async, 0 defer, 1 module)

### SEO — 91/100

- **[CHYBA]** XML Sitemap
  - Riešenie: Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.
- **[UPOZORNENIE]** Canonical URL Consistency — Canonical points to different URL: https://zlatnictvohorvath.sk
  - Riešenie: Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.
- **[UPOZORNENIE]** Color Contrast Signal — 89 very light text colors found — potential contrast issues
  - Riešenie: Ensure text has minimum 4.5:1 contrast ratio against background (WCAG AA). Use tools like WebAIM Contrast Checker. Light gray text on white is the most common violation.
- **[INFO]** Twitter/X Cards — SPA detected — see note below
- **[INFO]** Structured Data (JSON-LD) — SPA detected — see note below
- **[INFO]** Image Alt Attributes — Only 64% of 348 images have alt text · SPA detected — see note below
- **[INFO]** Text-to-HTML Ratio — 1% — very thin content (1456 words) · SPA detected — see note below
- **[INFO]** Semantic HTML Structure — Only 3/6 semantic elements — missing: <article>, <main>, <aside> · SPA detected — see note below
- **[OK]** Meta Title — 46 chars — "Zlatníctvo Horváth \| E-shop a Kamenná Predajňa"
- **[OK]** Meta Description — 160 chars
- **[OK]** H1 Heading — "Homepage"
- **[OK]** Content Structure (H2 Headings) — 11 H2 subheadings found
- **[OK]** Open Graph Tags — og:title, og:description, og:image, og:type
- **[OK]** Open Graph Image Format — image/webp
- **[OK]** Canonical URL — https://zlatnictvohorvath.sk
- **[OK]** robots.txt — Present
- **[OK]** HTML Language Attribute — lang="sk"
- **[OK]** Hreflang Tags (Multilingual) — 2 language(s): sk-SK, x-default
- **[OK]** Meta Robots Tag — index, follow
- **[OK]** Favicon — Favicon detected
- **[OK]** Image Format Optimization — 53% next-gen formats (185 WebP, 0 AVIF)
- **[OK]** Content Depth — 1456 words — sufficient content
- **[OK]** Deep Heading Hierarchy — H2: 11, H3: 3 — well-structured content
- **[OK]** Internal Linking — 86 internal links — strong site navigation
- **[OK]** Accessibility Fundamentals — 3/4 a11y signals: 3 ARIA roles, 4 ARIA labels, lang="sk"

### Bezpečnosť — 55/100

- **[CHYBA]** HSTS (Strict-Transport-Security)
  - Riešenie: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.
- **[CHYBA]** Content-Security-Policy (CSP)
  - Riešenie: Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.
- **[CHYBA]** Clickjacking Protection
  - Riešenie: Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.
- **[UPOZORNENIE]** CAA DNS Record — No CAA records — any CA can issue certificates for this domain
  - Riešenie: Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue "letsencrypt.org"`. For multiple CAs add additional `0 issue "..."` records. Add `0 iodef "mailto:security@yourdomain.tld"` for misissuance reports.
- **[UPOZORNENIE]** X-Content-Type-Options
  - Riešenie: Add header: X-Content-Type-Options: nosniff
- **[UPOZORNENIE]** Referrer-Policy
  - Riešenie: Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.
- **[UPOZORNENIE]** Permissions-Policy
  - Riešenie: Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.
- **[UPOZORNENIE]** Technology Disclosure — Server: nginx/1.29.4, X-Powered-By: Nuxt
  - Riešenie: Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.
- **[UPOZORNENIE]** Subresource Integrity (SRI) — Only 0/2 external scripts have integrity hashes
  - Riešenie: Add integrity='sha384-...' and crossorigin='anonymous' attributes to all third-party <script> tags. Use srihash.org to generate hashes.
- **[UPOZORNENIE]** security.txt (RFC 9116)
  - Riešenie: Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.
- **[UPOZORNENIE]** Server Version Disclosure — Nginx 1.29.4 exposed in headers
  - Riešenie: Hide server version. Apache: add 'ServerTokens Prod' and 'ServerSignature Off' to httpd.conf. Nginx: add 'server_tokens off;' to nginx.conf.
- **[UPOZORNENIE]** CDN / WAF Protection
  - Riešenie: Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.
- **[OK]** SSL/TLS Certificate — Valid HTTPS connection established
- **[OK]** DNSSEC — Zone is DNSSEC-signed (DNSKEY published)
- **[OK]** HTTP → HTTPS Redirect — HTTP properly redirects to HTTPS
- **[OK]** Cookie Security Flags — No cookies set on initial response
- **[OK]** Password Field Security — 1 password field(s) — allow password manager autofill

### Mobil — 46/100

- **[CHYBA]** Mobile Performance Score — 36/100 — critically slow
  - Riešenie: Your mobile experience is severely degraded. Priority fixes: 1) Reduce JavaScript by 50%+, 2) Convert all images to WebP with responsive sizing, 3) Enable aggressive caching, 4) Use a CDN.
- **[CHYBA]** Form Input Labels (WCAG 3.3.2) — Iba 0/3 inputs má label (0%)
  - Riešenie: 3 input elementov nemá label. Každý input musí mať priradený <label for="id">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).
- **[UPOZORNENIE]** Viewport Configuration — Present, but maximum-scale=1 disables pinch-to-zoom
  - Riešenie: Remove 'maximum-scale=1' and 'user-scalable=no' from your viewport meta tag. Use: <meta name='viewport' content='width=device-width, initial-scale=1'>
- **[UPOZORNENIE]** Touch Target Size
  - Riešenie: Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.
- **[UPOZORNENIE]** Font Size Readability
  - Riešenie: Set minimum 16px font size for body text. Use relative units (rem/em) instead of px for scalability. Product titles: 18px+, prices: 20px+, CTAs: 16px+ with bold.
- **[UPOZORNENIE]** PWA Features
  - Riešenie: Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.
- **[UPOZORNENIE]** Theme Color
  - Riešenie: Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.
- **[UPOZORNENIE]** Inline CSS Size — 441 KB of inline CSS
  - Riešenie: Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.
- **[UPOZORNENIE]** Responsive Images (srcset) — 348 images without responsive sizing
  - Riešenie: Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.
- **[UPOZORNENIE]** Form Input Types — phone fields use type='text' instead of type='tel'
  - Riešenie: Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.
- **[UPOZORNENIE]** Express Checkout (Apple Pay + Google Pay)
  - Riešenie: Pridaj Apple Pay + Google Pay cez Stripe/Adyen/Mollie. Biometric auth = -1 click checkout = vyšší conversion.
- **[UPOZORNENIE]** SK/CZ Local Payment Methods — Iba 2 SK/CZ metód (Tatra Pay, QR platba / Pay by square)
  - Riešenie: Pridaj ďalšie SK/CZ local methods: ComGate, GoPay, Barion, Besteron, PayU. SK zákazníci preferujú bankové tlačidlá a QR platbu pred kartou.
- **[UPOZORNENIE]** Heading Hierarchy (WCAG 1.3.1) — Preskočené úrovne: h2→h4, h2→h6
  - Riešenie: Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.
- **[OK]** Content Fits Viewport — No horizontal scrolling needed
- **[OK]** Responsive Design Techniques — Flexbox, CSS Grid, Media queries detected
- **[OK]** Mobile Navigation (Semantic) — <nav> element present — proper navigation landmark
- **[OK]** Payment Methods Detected — 2 method(s): Tatra Pay, QR platba / Pay by square
- **[OK]** Link Text Quality (WCAG 2.4.4) — Všetky odkazy majú popisný text

### AI pripravenosť — 53/100

- **[CHYBA]** llms.txt (AI Site Descriptor)
  - Riešenie: Create /llms.txt in Markdown format: # Your Store Name > One-line summary of your business and key offerings.  Detailed description paragraph.  ## Products - [Product Category](URL): Description  ## About - [About Us](URL): Company history and values  See llmstxt.org for the full specification.
- **[CHYBA]** Product Schema Completeness
  - Riešenie: Add complete Product JSON-LD schema: name, description, image, sku, brand, offers (price, priceCurrency, availability, seller), aggregateRating, review. This is mandatory for AI-powered commerce.
- **[CHYBA]** Image Alt Text Quality for AI — Only 38% quality alt text — 126 missing, 90 poor
  - Riešenie: Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.
- **[UPOZORNENIE]** llms-full.txt (Complete AI Content)
  - Riešenie: Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.
- **[UPOZORNENIE]** Breadcrumb Schema
  - Riešenie: Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.
- **[UPOZORNENIE]** Site Search Schema (SearchAction)
  - Riešenie: Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.
- **[UPOZORNENIE]** Author Expertise Signals (E-E-A-T)
  - Riešenie: For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.
- **[UPOZORNENIE]** Reviews & Ratings Schema
  - Riešenie: Add AggregateRating schema (ratingValue, reviewCount, bestRating) and individual Review schemas. AI shopping assistants prioritize products with verified reviews and ratings.
- **[UPOZORNENIE]** AI Plugin Manifest
  - Riešenie: Create /.well-known/ai-plugin.json if you have an API. This enables direct AI agent integration (ChatGPT Actions, custom GPTs). Include: name_for_model, description_for_model, auth config, and link to OpenAPI spec.
- **[UPOZORNENIE]** Product Feed (AI Commerce)
  - Riešenie: Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery.
- **[UPOZORNENIE]** Heureka XML Feed
  - Riešenie: Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).
- **[UPOZORNENIE]** Speakable Content (Voice AI)
  - Riešenie: Add SpeakableSpecification schema to identify content sections suitable for voice assistants (Google Assistant, Alexa, Siri). Mark your product summaries and FAQs as speakable.
- **[UPOZORNENIE]** Statistics & Data Presence — Only 1 data point(s) — add more
  - Riešenie: Add specific statistics, percentages, dollar amounts, and quantified claims. E.g., '93% of customers report...', 'saves an average of €200/year', '3x faster than...' Data makes content citable.
- **[UPOZORNENIE]** Section Length Optimization — Avg section: 77 words — only 17% in 80-200 word optimal range
  - Riešenie: Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.
- **[UPOZORNENIE]** Return Policy Schema
  - Riešenie: Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.
- **[UPOZORNENIE]** Shipping Details Schema
  - Riešenie: Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.
- **[UPOZORNENIE]** Knowledge Graph Readiness — 1/4 signals — missing: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema
  - Riešenie: Add: @id in JSON-LD, sameAs links (Wikipedia, LinkedIn), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.
- **[UPOZORNENIE]** Content Readability for AI — Grade 20 — too complex for broad AI citation (technical threshold: 14)
  - Riešenie: Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.
- **[UPOZORNENIE]** Expert Quotations & Citations
  - Riešenie: Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).
- **[UPOZORNENIE]** ai.txt (AI Permissions)
  - Riešenie: Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.
- **[UPOZORNENIE]** WebMCP Agentic Readiness
  - Riešenie: WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.
- **[UPOZORNENIE]** Trust Widget — Žiaden trust widget (Heureka / Trustpilot / AggregateRating) nedetekovaný
  - Riešenie: Pre SK/CZ shopy: inštaluj Heureka Ověřeno zákazníky widget (zadarmo pre overených predajcov — https://sluzby.heureka.sk). Alternatívne: Trustpilot, Google Reviews s AggregateRating schema. Trust widget na product + kategória + footer.
- **[INFO]** Content Accessibility for AI — Only 1456 words visible in HTML — content may be JS-dependent · SPA detected — see note below
- **[INFO]** Structured Data Foundation — SPA detected — see note below
- **[INFO]** Organization Schema + Entity Linking — SPA detected — see note below
- **[INFO]** FAQ Schema (Direct AI Answers) — SPA detected — see note below
- **[INFO]** Answer-First Content Format — Content doesn't start with a strong summary paragraph · SPA detected — see note below
- **[INFO]** Semantic HTML Structure — 3/6 elements — missing: <article>, <main>, <aside> · SPA detected — see note below
- **[INFO]** Structured Content (Lists & Tables) — 27 lists found — consider adding comparison tables · SPA detected — see note below
- **[INFO]** Content Freshness Signals — SPA detected — see note below
- **[INFO]** Entity Clarity & Brand Signals — OG tags complete but no sameAs entity links · SPA detected — see note below
- **[INFO]** Extractable Answer Blocks — 44 paragraphs, avg 10 words — too short for citation · SPA detected — see note below
- **[INFO]** Canonical Tag for AI Deduplication — Canonical points to different URL: https://zlatnictvohorvath.sk · SPA detected — see note below
- **[INFO]** Content-to-Boilerplate Ratio — No <main> or <article> elements — AI can't isolate content from boilerplate · SPA detected — see note below
- **[OK]** AI Bot Access Policy — No AI bot restrictions (allowed by default)
- **[OK]** Content Depth for AI — 1456 words — rich content for AI analysis and citation
- **[OK]** Heading Hierarchy for AI — Proper structure: 1 H1 → 11 H2s → 3 H3s — clear content outline
- **[OK]** Q&A Format Headings — 3 question-format headings — excellent for AI Q&A extraction
- **[OK]** Internal Link Density — 59 contextual internal links per 1,000 words — strong knowledge graph signal

### GDPR — 52/100

- **[CHYBA]** Tracking Scripts Without Consent — 1 tracker(s) loading without consent: Google Analytics/GTM
  - Riešenie: These tracking scripts fire before user consent: Google Analytics/GTM. Configure your CMP to block them until explicit opt-in. Use Tag Manager's consent mode or CMP script blocking.
- **[CHYBA]** Google Consent Mode v2
  - Riešenie: Implement Google Consent Mode v2 with gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied' }). Required since March 2024 for EU audiences.
- **[UPOZORNENIE]** Personal Data Exposure in Source — 1 email(s) found in page source: obchod@zlatnictvohorvath.sk
  - Riešenie: Remove plain-text email addresses from HTML source. Use contact forms instead, or obfuscate emails with JavaScript encoding.
- **[UPOZORNENIE]** International Data Transfers — 1 US-based tracker(s) without consent: Google Analytics/GTM
  - Riešenie: US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.
- **[UPOZORNENIE]** Forms Without Privacy Notice — 1 form(s) on page with no privacy policy link
  - Riešenie: Add a link to your privacy policy next to or below every form that collects personal data (contact, registration, newsletter). Include a checkbox for consent where required.
- **[UPOZORNENIE]** Right to Erasure (Data Deletion)
  - Riešenie: Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.
- **[UPOZORNENIE]** Newsletter Consent — Newsletter signup found without visible consent checkbox
  - Riešenie: Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.
- **[UPOZORNENIE]** Data Protection Officer Contact
  - Riešenie: Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.
- **[UPOZORNENIE]** Withdrawal of Consent Mechanism
  - Riešenie: Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.
- **[INFO]** Cookie Consent Banner (CMP) — SPA detected — see note below
- **[INFO]** Privacy Policy Page — SPA detected — see note below
- **[INFO]** Cookie Policy — SPA detected — see note below
- **[OK]** Legal Contact / Imprint Page — /o-nas
- **[OK]** Terms & Conditions Page — /obchodne-podmienky
- **[OK]** Data Encryption (No Mixed Content) — All resources loaded over HTTPS
- **[OK]** Third-party Data Sharing — 1 third-party domain(s)

### Zraniteľnosti — 59/100

- **[CHYBA]** Form CSRF Protection — 1 form(s) without CSRF tokens
  - Riešenie: Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.
- **[CHYBA]** Suspicious Inline Script Patterns — Detected: Payment data exfiltration pattern
  - Riešenie: Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.
- **[CHYBA]** Payment Page Security — Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection
  - Riešenie: CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.
- **[CHYBA]** Clickjacking on Sensitive Page — Login/payment page without X-Frame-Options or CSP frame-ancestors
  - Riešenie: URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.
- **[UPOZORNENIE]** X-Powered-By Header — Nuxt
  - Riešenie: Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').
- **[UPOZORNENIE]** Inline JavaScript Exposure — 468 KB of inline JavaScript
  - Riešenie: Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).
- **[UPOZORNENIE]** DMARC Policy (Email Auth) — DMARC set to p=none (monitoring only, no enforcement)
  - Riešenie: Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.
- **[UPOZORNENIE]** Cross-Origin Isolation
  - Riešenie: Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.
- **[OK]** CMS Version Disclosure — No generator tag — CMS identity hidden
- **[OK]** Sensitive Files Exposed — .env, .git, composer.json — all properly blocked
- **[OK]** Install Script Exposed — No /install/ or /setup/ paths accessible
- **[OK]** Directory Listing — Disabled — file structure hidden
- **[OK]** Admin Panel at Default URL — Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)
- **[OK]** Debug Mode / Error Exposure — No debug indicators found in page output
- **[OK]** SPF Record (Email Security) — SPF configured: v=spf1 a mx include:_spf.nameserver.sk -all
- **[OK]** DKIM Signing (Email Auth) — DKIM configured (selectors: default)

### NIS2

- **[INFO]** NIS2 Compliance — Scope undetermined — IČO/company enrichment unavailable for this domain.

---

Zulien Score je bezplatný automatizovaný heuristický audit pokrývajúci výkon (Core Web Vitals, TTFB, page weight), SEO (meta tagy, štruktúrované dáta, sitemap), bezpečnosť (SSL/TLS, HSTS, CSP), mobilnú použiteľnosť, AI pripravenosť, súlad s GDPR / ePrivacy a zraniteľnosti. Výsledky sú cache-ované na 6 hodín a re-skenovateľné na požiadanie.

[Zobraziť plnú interaktívnu správu na Zulien Score →](https://score.zulien.sk/sk/r/zlatnictvohorvath.sk)
