{
  "data": {
    "slug": "666db00f",
    "url": "https://4home.sk",
    "domain": "4home.sk",
    "overall_score": 58,
    "scores_json": {
      "seo": {
        "score": 65,
        "checks": [
          {
            "i18n": {
              "key": "seo.meta-title.warning-short",
              "params": {
                "chars": 23
              }
            },
            "name": "Meta Title",
            "value": "23 chars (optimal: 30-60)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your title is very short. Add descriptive keywords and your brand name for better ranking signals.",
            "whyMatters": "Short titles waste valuable ranking real estate in search results."
          },
          {
            "i18n": {
              "key": "seo.meta-desc.warning-long",
              "params": {
                "chars": 185
              }
            },
            "name": "Meta Description",
            "value": "185 chars (optimal: 120-160)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.",
            "whyMatters": "Google truncates descriptions over 160 chars. Mobile shows even less (~120 chars)."
          },
          {
            "i18n": {
              "key": "seo.h1.fail"
            },
            "name": "H1 Heading",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.",
            "whyMatters": "The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords."
          },
          {
            "i18n": {
              "key": "seo.h2.pass",
              "params": {
                "count": 14
              }
            },
            "name": "Content Structure (H2 Headings)",
            "value": "14 H2 subheadings found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.og.pass",
              "params": {
                "tags": "og:title, og:description, og:image"
              }
            },
            "name": "Open Graph Tags",
            "value": "og:title, og:description, og:image",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.og-format.fail-nonimage",
              "params": {
                "contentType": "text/html"
              }
            },
            "name": "Open Graph Image Format",
            "value": "og:image returned text/html",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Make sure the og:image URL returns an image (Content-Type: image/png or image/jpeg). Common cause: returning HTML or JSON from a broken redirect.",
            "whyMatters": "Social scrapers expect an image at the og:image URL. If they get HTML/JSON instead, no preview renders."
          },
          {
            "i18n": {
              "key": "seo.twitter.warning"
            },
            "name": "Twitter/X Cards",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.",
            "whyMatters": "Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs."
          },
          {
            "i18n": {
              "key": "seo.canonical.pass",
              "params": {
                "url": "https://www.4home.sk"
              }
            },
            "name": "Canonical URL",
            "value": "https://www.4home.sk",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.jsonld.pass",
              "params": {
                "count": 1,
                "types": "Organization, WebSite, SearchAction, EntryPoint"
              }
            },
            "name": "Structured Data (JSON-LD)",
            "value": "1 block(s): Organization, WebSite, SearchAction, EntryPoint",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "seo.jsonld-valid.pass",
              "params": {
                "count": 1
              }
            },
            "name": "JSON-LD Validity",
            "value": "1 block(s) parse cleanly",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.robots.pass-sitemap"
            },
            "name": "robots.txt",
            "value": "Present, references sitemap",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.sitemap.pass-count",
              "params": {
                "count": 35
              }
            },
            "name": "XML Sitemap",
            "value": "Found with ~35+ URLs",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.html-lang.pass",
              "params": {
                "lang": "sk"
              }
            },
            "name": "HTML Language Attribute",
            "value": "lang=\"sk\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.img-alt.fail",
              "params": {
                "rate": 18,
                "total": 1307,
                "missing": 1077
              }
            },
            "name": "Image Alt Attributes",
            "value": "Only 18% of 1307 images have alt text",
            "status": "fail",
            "fixLink": {
              "url": "https://zulien.sk",
              "label": "Fix with SEO module →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "1077 images lack alt text. Write unique, descriptive alt text for each product image. Include product name and key details.",
            "whyMatters": "Google cannot understand images without alt text. This is both an SEO and accessibility failure — and a legal risk under ADA/EAA."
          },
          {
            "i18n": {
              "key": "seo.text-ratio.info",
              "params": {
                "ratio": 3,
                "words": 5532
              }
            },
            "name": "Text-to-HTML Ratio",
            "value": "3% ratio but 5532 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.",
            "whyMatters": "Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on."
          },
          {
            "i18n": {
              "key": "seo.favicon.pass"
            },
            "name": "Favicon",
            "value": "Favicon detected",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.img-format.warning-none",
              "params": {
                "jpg": 1231,
                "png": 26
              }
            },
            "name": "Image Format Optimization",
            "value": "0% next-gen formats — 1231 JPEG, 26 PNG images",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.",
            "whyMatters": "Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations."
          },
          {
            "i18n": {
              "key": "seo.semantic.pass",
              "params": {
                "used": "<article>, <nav>, <header>, <footer>",
                "count": 4
              }
            },
            "name": "Semantic HTML Structure",
            "value": "4/6 semantic elements: <article>, <nav>, <header>, <footer>",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.canonical-consistency.warning",
              "params": {
                "url": "https://www.4home.sk"
              }
            },
            "name": "Canonical URL Consistency",
            "value": "Canonical points to different URL: https://www.4home.sk",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.",
            "whyMatters": "A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target."
          },
          {
            "i18n": {
              "key": "seo.content-depth.pass",
              "params": {
                "words": 5532
              }
            },
            "name": "Content Depth",
            "value": "5532 words — sufficient content",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.deep-heading.pass",
              "params": {
                "h2": 14,
                "h3": 28
              }
            },
            "name": "Deep Heading Hierarchy",
            "value": "H2: 14, H3: 28 — well-structured content",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.internal-links.fail",
              "params": {
                "count": 2
              }
            },
            "name": "Internal Linking",
            "value": "Only 2 internal link(s) — orphaned page",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "This page has very few internal links. Add links to related products, categories, guides, and your main navigation. Orphaned pages rank poorly.",
            "whyMatters": "Pages with fewer than 3 internal links are effectively orphaned — search engines may not discover or prioritize them. Google uses internal link structure as a primary crawl and ranking signal."
          },
          {
            "i18n": {
              "key": "seo.dead-links.pass",
              "params": {
                "total": 1
              }
            },
            "name": "Empty/Dead Links",
            "value": "1 minor dead link(s) — acceptable",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.a11y.warning",
              "params": {
                "missing": "ARIA roles, ARIA labels, skip navigation link",
                "signals": 1
              }
            },
            "name": "Accessibility Fundamentals",
            "value": "1/4 a11y signals — missing: ARIA roles, ARIA labels, skip navigation link",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.",
            "whyMatters": "The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO, as Google treats it as a ranking signal."
          },
          {
            "i18n": {
              "key": "seo.contrast.warning",
              "params": {
                "count": 6
              }
            },
            "name": "Color Contrast Signal",
            "value": "6 very light text colors found — potential contrast issues",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Ensure text has a minimum 4.5:1 contrast ratio against its background (WCAG AA). Use tools like WebAIM Contrast Checker. Light gray text on white is the most common violation.",
            "whyMatters": "Low contrast text is the most common accessibility issue found on home pages. It affects users with color vision deficiency and everyone in bright sunlight."
          }
        ]
      },
      "gdpr": {
        "score": 63,
        "checks": [
          {
            "i18n": {
              "key": "gdpr.cmp.info",
              "params": {
                "gtmNote": " A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML."
              }
            },
            "name": "Cookie Consent Banner (CMP)",
            "value": "No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic",
              "measured": "1 GTM container(s) detected"
            },
            "howToFix": "Confirm a consent management platform actually loads and blocks non-essential cookies until opt-in. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "confidence": "low",
            "whyMatters": "EU regulators enforce cookie consent (CNIL fined Google €150M). If the CMP is GTM-injected this scan can't confirm it — verify manually."
          },
          {
            "i18n": {
              "key": "gdpr.tracking.pass-none"
            },
            "name": "Tracking Scripts & Consent",
            "value": "No tracking scripts detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "EDPB Opinion 5/2019"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.privacy-policy.pass",
              "params": {
                "url": "/clanky/ochrana-osobnych-udajov/"
              }
            },
            "name": "Privacy Policy Page",
            "value": "/clanky/ochrana-osobnych-udajov/",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13",
                "Art. 14"
              ],
              "skLaw": [
                "§ 19",
                "§ 20"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 14 — Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby 2. Okrem informácií uvedených v odseku 1 prevádzkovateľ poskytne dotknutej osobe tieto ďalšie informácie potrebné na zabezpečenie spravodliv",
                  "citation": "čl. 14 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby",
                  "excerpt": "§ 20 Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby (5) d) ak osobné údaje musia zostať dôverné na základe povinnosti mlčanlivosti podľa osobitného predpisu. 15 )",
                  "citation": "§20 ods. 5 písm. d) zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.cookie-policy.warning"
            },
            "name": "Cookie Policy",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.",
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13(1)(c)-(e)"
              ],
              "skLaw": [
                "§ 19"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement."
          },
          {
            "i18n": {
              "key": "gdpr.imprint.pass",
              "params": {
                "url": "/clanky/o-nas/"
              }
            },
            "name": "Legal Contact / Imprint Page",
            "value": "/clanky/o-nas/",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.terms.pass",
              "params": {
                "url": "/clanky/hlavne-obchodne-podmienky/"
              }
            },
            "name": "Terms & Conditions Page",
            "value": "/clanky/hlavne-obchodne-podmienky/",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.mixed-content.warning"
            },
            "name": "Data Encryption (No Mixed Content)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Replace all http:// resource URLs with https://. Check images, scripts, stylesheets, and iframes. GDPR Article 32 requires 'appropriate technical measures' including encryption.",
            "whyMatters": "Mixed content means some data is transmitted unencrypted. This violates GDPR's data security requirements and triggers browser 'Not Secure' warnings that hurt conversions."
          },
          {
            "i18n": {
              "key": "gdpr.third-party.pass",
              "params": {
                "count": 2
              }
            },
            "name": "Third-party Data Sharing",
            "value": "2 third-party domain(s)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.erasure.warning"
            },
            "name": "Right to Erasure (Data Deletion)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.",
            "legalRefs": {
              "gdpr": [
                "Art. 17"
              ],
              "skLaw": [
                "§ 23"
              ],
              "verified": [
                {
                  "title": "Právo na vymazanie (právo „na zabudnutie“)",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 17 — Právo na vymazanie (právo „na zabudnutie“) 1. Dotknutá osoba má tiež právo dosiahnuť u prevádzkovateľa bez zbytočného odkladu vymazanie osobných údajov, ktoré sa jej týkajú, a prevádzkovateľ je povinný bez zbytočného odkladu vy",
                  "citation": "čl. 17 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Právo na výmaz osobných údajov",
                  "excerpt": "§ 23 Právo na výmaz osobných údajov (1) Dotknutá osoba má právo na to, aby prevádzkovateľ bez zbytočného odkladu vymazal osobné údaje, ktoré sa jej týkajú.",
                  "citation": "§23 ods. 1 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding."
          },
          {
            "i18n": {
              "key": "gdpr.newsletter.warning"
            },
            "name": "Newsletter Consent",
            "value": "Newsletter signup found without visible consent checkbox",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "ePrivacy Art. 13"
              ],
              "skLaw": [
                "§ 14",
                "§ 109 zák. 452/2021"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "title": "—",
                  "excerpt": "§ 109 — (8) Každý, kto ukladá alebo získava prístup k informáciám uloženým v koncovom zariadení užívateľa, je na to oprávnený iba ak užívateľ udelil preukázateľný súhlas spĺňajúci náležitosti podľa osobitného predpisu. 126 ) Povinnosť získa",
                  "citation": "§109 ods. 8 zákona č. 452/2021 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR requires 'freely given, specific, informed' consent for marketing emails. A newsletter form without explicit opt-in violates Article 7, and pre-checked boxes are not valid consent."
          },
          {
            "i18n": {
              "key": "gdpr.dpo.pass"
            },
            "name": "Data Protection Officer Contact",
            "value": "DPO / data protection contact found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.withdrawal.warning"
            },
            "name": "Withdrawal of Consent Mechanism",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.",
            "legalRefs": {
              "gdpr": [
                "Art. 7(3)"
              ],
              "skLaw": [
                "§ 14(4)"
              ],
              "verified": [
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding."
          },
          {
            "i18n": {
              "key": "gdpr.age-verification.warning"
            },
            "name": "Age Verification",
            "value": "Age-restricted content detected without age gate",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Implement age verification for alcohol, tobacco, gambling, or adult content. Use a date-of-birth check or age confirmation modal before accessing the site.",
            "whyMatters": "EU member states require age verification for age-restricted products. German JuSchG (Youth Protection Act) and similar laws mandate age gates. Missing them risks regulatory action and marketplace delisting."
          },
          {
            "i18n": {
              "key": "gdpr.omnibus.warning"
            },
            "name": "Omnibus Price Disclosure (30-day low)",
            "value": "Discounts shown without a visible 'lowest price in last 30 days' reference",
            "status": "warning",
            "fixLink": {
              "url": "https://zulien.sk",
              "label": "Omnibus price-history module →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Whenever you advertise a price reduction, display the lowest price applied in the 30 days before the discount, next to the new price. In PrestaShop add a 30-day price-history anchor (e.g. our zu_pricehistory module) so every sale label is compliant automatically.",
            "legalRefs": {
              "gdpr": [
                "Smernica (EÚ) 2019/2161 (Omnibus)",
                "Smernica 98/6/ES čl. 6a"
              ],
              "czLaw": [
                "zák. 634/1992 Sb. § 12a"
              ],
              "skLaw": [
                "zák. 108/2024 Z.z."
              ]
            },
            "confidence": "low",
            "whyMatters": "The EU Omnibus Directive (2019/2161), enacted in SK as zák. 108/2024 and CZ via zák. 634/1992, makes the 30-day reference price MANDATORY on every advertised discount. ŠOI/ČOI actively inspect for missing disclosures — and a '−40%' off an inflated base is exactly what they target."
          },
          {
            "i18n": {
              "key": "gdpr.dispute-resolution.fail"
            },
            "name": "Consumer Dispute Resolution Links",
            "value": "No EU ODR platform or supervisory-authority link found",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.",
            "legalRefs": {
              "gdpr": [
                "Nariadenie (EÚ) 524/2013 (ODR)",
                "Smernica 2013/11/EÚ (ADR)"
              ],
              "czLaw": [
                "zák. 634/1992 Sb. § 14"
              ],
              "skLaw": [
                "zák. 391/2015 Z.z."
              ]
            },
            "whyMatters": "EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach."
          },
          {
            "i18n": {
              "key": "gdpr.withdrawal-complaints.warning",
              "params": {
                "missing": "right of withdrawal (odstúpenie od zmluvy)"
              }
            },
            "name": "Withdrawal & Complaints Policy",
            "value": "Missing: right of withdrawal (odstúpenie od zmluvy)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Publish and footer-link a Withdrawal policy (14-day right of withdrawal + model withdrawal form) and a Complaints procedure (reklamačný poriadok / reklamační řád). Reference them at checkout.",
            "legalRefs": {
              "gdpr": [
                "Smernica 2011/83/EÚ čl. 6(1)(h),(9)"
              ],
              "czLaw": [
                "zák. 89/2012 Sb. § 1829"
              ],
              "skLaw": [
                "zák. 108/2024 Z.z."
              ]
            },
            "whyMatters": "The Consumer Rights Directive (2011/83/EU) and SK zák. 108/2024 / CZ zák. 89/2012 require pre-contractual disclosure of the 14-day withdrawal right and an accessible complaints procedure. Missing them extends customers' cancellation rights and is a standard ŠOI/ČOI finding."
          },
          {
            "i18n": {
              "key": "gdpr.withdrawal-function.warning"
            },
            "name": "Online Withdrawal Function",
            "value": "No online withdrawal function or withdrawal information detected",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.",
            "confidence": "low",
            "whyMatters": "Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually."
          }
        ]
      },
      "nis2": {
        "score": -1,
        "checks": [
          {
            "i18n": {
              "key": "nis2.scope.unknown"
            },
            "name": "NIS2 Compliance",
            "value": "Scope undetermined — IČO/company enrichment unavailable for this domain.",
            "status": "info",
            "howToFix": "",
            "whyMatters": ""
          }
        ]
      },
      "mobile": {
        "score": 64,
        "checks": [
          {
            "i18n": {
              "key": "mob.viewport.pass"
            },
            "name": "Viewport Configuration",
            "value": "width=device-width, initial-scale=1",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.perf.warning",
              "params": {
                "score": 59
              }
            },
            "name": "Mobile Performance Score",
            "value": "59/100 (target: 90+)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.",
            "whyMatters": "Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop."
          },
          {
            "i18n": {
              "key": "mob.taptarget.warning",
              "params": {
                "detail": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)"
              }
            },
            "name": "Touch Target Size",
            "value": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)"
            },
            "howToFix": "Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.",
            "whyMatters": "Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue."
          },
          {
            "i18n": {
              "key": "mob.fontsize.warning",
              "params": {
                "detail": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)"
              }
            },
            "name": "Font Size Readability",
            "value": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)"
            },
            "howToFix": "Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.",
            "whyMatters": "Text below the legibility threshold forces mobile users to pinch-zoom. This measures the actual rendered page (Lighthouse), so it catches sub-12px nodes even when the base font looks fine."
          },
          {
            "i18n": {
              "key": "mob.contentwidth.pass"
            },
            "name": "Content Fits Viewport",
            "value": "No horizontal scrolling needed",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.responsive.warning"
            },
            "name": "Responsive Design Techniques",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Implement responsive CSS with @media queries for key breakpoints: 480px (small mobile), 768px (tablet), 1024px (laptop). Use Flexbox and CSS Grid for fluid layouts.",
            "whyMatters": "Non-responsive sites are automatically penalized by Google in mobile search results. With mobile-first indexing, this is a critical ranking factor."
          },
          {
            "i18n": {
              "key": "mob.pwa.warning"
            },
            "name": "PWA Features",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.",
            "whyMatters": "PWAs combine the best of web and native apps. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access."
          },
          {
            "i18n": {
              "key": "mob.themecolor.pass"
            },
            "name": "Theme Color",
            "value": "theme-color meta tag present",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.nav.pass"
            },
            "name": "Mobile Navigation (Semantic)",
            "value": "<nav> element present — proper navigation landmark",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.srcset.pass",
              "params": {
                "count": 27
              }
            },
            "name": "Responsive Images (srcset)",
            "value": "27 image(s) use srcset for responsive sizing",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.inputtypes.warning",
              "params": {
                "issues": "phone fields use type='text' instead of type='tel'"
              }
            },
            "name": "Form Input Types",
            "value": "phone fields use type='text' instead of type='tel'",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.",
            "whyMatters": "Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors and speeds up form completion."
          },
          {
            "i18n": {
              "key": "mob.stickycta.warning"
            },
            "name": "Mobile Sticky CTA",
            "value": "Add-to-cart button found but no sticky/fixed positioning detected",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a sticky add-to-cart bar at the bottom of mobile screens. Use position: sticky or position: fixed with bottom: 0. The CTA should always be visible without scrolling.",
            "whyMatters": "Mobile users scroll extensively. A sticky add-to-cart bar keeps the primary action visible. Without it, users must scroll back up to purchase — many won't."
          },
          {
            "i18n": {
              "key": "mob.textoverflow.warning"
            },
            "name": "Text Overflow Handling",
            "value": "No word-break/overflow-wrap CSS detected",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add 'overflow-wrap: break-word' to your body or main content container. Without it, long URLs, product SKUs, or German compound words can break mobile layouts.",
            "whyMatters": "Long strings without word-break cause horizontal overflow on mobile — a common cause of 'content wider than viewport' failures. Compound words and URLs are frequent culprits."
          },
          {
            "i18n": {
              "key": "mob.print.warning"
            },
            "name": "Print Stylesheet",
            "value": "Order/invoice page without print styles",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add @media print CSS rules to hide navigation, ads, and non-essential elements. Ensure order details, prices, and company info are visible when printed.",
            "whyMatters": "Customers print order confirmations and invoices. Without print styles, they get navigation bars, cookie banners, and broken layouts. This is a common usability complaint for e-commerce."
          },
          {
            "i18n": {
              "key": "mob.payments.pass",
              "params": {
                "list": "Apple Pay",
                "count": 1
              }
            },
            "name": "Payment Methods Detected",
            "value": "1 method(s): Apple Pay",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.express.warning",
              "params": {
                "missing": "Google Pay",
                "present": "Apple Pay"
              }
            },
            "name": "Express Checkout (Apple Pay + Google Pay)",
            "value": "Iba Apple Pay detekovaný — chýba Google Pay",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Pridaj Google Pay cez Stripe, Adyen alebo Mollie. Mobile conversion rate rastie keď je express checkout dostupný.",
            "whyMatters": "iOS/Android majú 50/50 share. Jeden bez druhého znamená stratený revenue na polovici mobilných používateľov."
          },
          {
            "i18n": {
              "key": "mob.skczpay.info"
            },
            "name": "SK/CZ Local Payment Methods",
            "value": "Žiadna SK/CZ local payment metóda nedetekovaná na homepage — bankové tlačidlá/QR sa zvyčajne zobrazia až v checkoute",
            "status": "info",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Integrovať SK payments — Inger"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Ak SK/CZ local platby nemáš, integruj GoPay alebo ComGate — obe podporujú Tatra Pay, VÚB Pay, ČSOB Pay, Raiffeisen, QR platba v jednom API. Alternatívne Barion pre CZ trh.",
            "whyMatters": "SK/CZ shop bez bankových tlačidiel a QR platby = masívny cart abandonment. Priemerný SK e-shop má viacero payment metód. (Sken vidí iba homepage — over manuálne v checkoute.)"
          },
          {
            "i18n": {
              "key": "mob.wcaglabels.warning",
              "params": {
                "rate": 98,
                "total": 225,
                "missing": 5,
                "withLabel": 220
              }
            },
            "name": "Form Input Labels (WCAG 3.3.2)",
            "value": "220/225 inputs má label (98%)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "5 input elementov nemá <label for=\"id\">, aria-label, aria-labelledby alebo title. Placeholder nie je dostatočný (WCAG 3.3.2). Pridaj <label for=\"email\">Email</label><input id=\"email\"> alebo <input aria-label=\"Email\">.",
            "whyMatters": "Formulárové inputy bez labelov sú nedostupné pre screen reader používateľov a zhoršujú konverziu aj pre bežných používateľov (neviditeľné placeholder texty, stratená informácia pri fokusovaní)."
          },
          {
            "i18n": {
              "key": "mob.wcagheading.warning",
              "params": {
                "skips": "h2→h4"
              }
            },
            "name": "Heading Hierarchy (WCAG 1.3.1)",
            "value": "Preskočené úrovne: h2→h4",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.",
            "whyMatters": "Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené."
          },
          {
            "i18n": {
              "key": "mob.wcaglinks.warning",
              "params": {
                "count": 1
              }
            },
            "name": "Link Text Quality (WCAG 2.4.4)",
            "value": "1 odkazov má generický text (\"click here\", \"more\", \"tu\"...)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Nahraď 'Click here' / 'Read more' / 'Viac' popisným textom: 'Prečítaj si viac o GDPR', 'Pozri cenník modulov'. Screen readers čítajú odkazy mimo kontextu — samostatné 'viac' nemá význam.",
            "whyMatters": "WCAG 2.4.4: Účel odkazu musí byť zrejmý z textu. Vágne odkazy zhoršujú UX, konverziu aj SEO (Google anchor text relevancia)."
          }
        ]
      },
      "company": null,
      "modules": [],
      "security": {
        "score": 55,
        "checks": [
          {
            "i18n": {
              "key": "sec.ssl.pass"
            },
            "name": "SSL/TLS Certificate",
            "value": "Valid HTTPS connection established",
            "status": "pass",
            "evidence": {
              "source": "SSL"
            }
          },
          {
            "i18n": {
              "key": "sec.dnssec.pass"
            },
            "name": "DNSSEC",
            "value": "Zone is DNSSEC-signed (DNSKEY published)",
            "status": "pass",
            "evidence": {
              "source": "DNS"
            },
            "whyMatters": "DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities."
          },
          {
            "i18n": {
              "key": "sec.caa.warning"
            },
            "name": "CAA DNS Record",
            "value": "No CAA records — any CA can issue certificates for this domain",
            "status": "warning",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue \"letsencrypt.org\"`. For multiple CAs add additional `0 issue \"...\"` records. Add `0 iodef \"mailto:security@yourdomain.tld\"` for misissuance reports.",
            "whyMatters": "CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017)."
          },
          {
            "i18n": {
              "key": "sec.https-redirect.pass"
            },
            "name": "HTTP → HTTPS Redirect",
            "value": "HTTP properly redirects to HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.hsts.fail"
            },
            "name": "HSTS (Strict-Transport-Security)",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.",
            "whyMatters": "Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi."
          },
          {
            "i18n": {
              "key": "sec.csp.fail"
            },
            "name": "Content-Security-Policy (CSP)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Security Hardening →"
            },
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.",
            "whyMatters": "CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection."
          },
          {
            "i18n": {
              "key": "sec.clickjacking.fail"
            },
            "name": "Clickjacking Protection",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.",
            "whyMatters": "Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it."
          },
          {
            "i18n": {
              "key": "sec.x-content-type.warning"
            },
            "name": "X-Content-Type-Options",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: X-Content-Type-Options: nosniff",
            "whyMatters": "Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it."
          },
          {
            "i18n": {
              "key": "sec.referrer-policy.pass",
              "params": {
                "detail": "no-referrer-when-downgrade"
              }
            },
            "name": "Referrer-Policy",
            "value": "no-referrer-when-downgrade",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.permissions-policy.warning"
            },
            "name": "Permissions-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.",
            "whyMatters": "Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge."
          },
          {
            "i18n": {
              "key": "sec.cookie-flags.warning",
              "params": {
                "count": 3,
                "missing": "3 missing Secure, 3 missing HttpOnly, 3 missing SameSite"
              }
            },
            "name": "Cookie Security Flags",
            "value": "3 cookie(s): 3 missing Secure, 3 missing HttpOnly, 3 missing SameSite",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.",
            "whyMatters": "Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks."
          },
          {
            "i18n": {
              "key": "sec.tech-disclosure.warning",
              "params": {
                "detail": "Server: Microsoft-IIS/10.0, X-Powered-By: ASP.NET"
              }
            },
            "name": "Technology Disclosure",
            "value": "Server: Microsoft-IIS/10.0, X-Powered-By: ASP.NET",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.",
            "whyMatters": "Exposing exact server/PHP versions lets attackers search CVE databases for specific exploits. This is the first step in most automated attacks."
          },
          {
            "i18n": {
              "key": "sec.sri.warning",
              "params": {
                "eligible": 2,
                "exemptNote": "",
                "withIntegrity": 0
              }
            },
            "name": "Subresource Integrity (SRI)",
            "value": "Only 0/2 SRI-eligible third-party scripts have integrity hashes",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.",
            "whyMatters": "Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach."
          },
          {
            "i18n": {
              "key": "sec.security-txt.warning"
            },
            "name": "security.txt (RFC 9116)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.",
            "whyMatters": "security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all."
          },
          {
            "i18n": {
              "key": "sec.server-version.pass",
              "params": {
                "name": "Microsoft-IIS/10.0"
              }
            },
            "name": "Server Version Disclosure",
            "value": "Microsoft-IIS/10.0 — version hidden",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.cdn.warning"
            },
            "name": "CDN / WAF Protection",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.",
            "whyMatters": "Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts."
          },
          {
            "i18n": {
              "key": "sec.iframe-sandbox.warning",
              "params": {
                "total": 1,
                "untrusted": 1,
                "trustedNote": ""
              }
            },
            "name": "Iframe Sandboxing",
            "value": "1/1 unknown iframe(s) without sandbox attribute",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.",
            "confidence": "low",
            "whyMatters": "Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS."
          },
          {
            "i18n": {
              "key": "sec.password-autocomplete.pass",
              "params": {
                "count": 1
              }
            },
            "name": "Password Field Security",
            "value": "1 password field(s) — allow password manager autofill",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          }
        ]
      },
      "tech_stack": [
        {
          "name": "jQuery",
          "category": "js-library"
        },
        {
          "name": "Microsoft-IIS/10.0",
          "category": "server"
        }
      ],
      "performance": {
        "score": 53,
        "checks": [
          {
            "i18n": {
              "key": "perf.ttfb.warning",
              "params": {
                "ms": 246
              }
            },
            "name": "Server Response Time (TTFB)",
            "value": "246ms (optimal: <200ms)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Optimize server response: enable opcode caching (OPcache), add Redis/Memcached for database caching, use a CDN. Check slow database queries.",
            "whyMatters": "TTFB is the foundation — every other metric is delayed by a slow server. A 200ms vs 600ms TTFB means 400ms added to FCP, LCP, and everything else."
          },
          {
            "i18n": {
              "key": "perf.fcp.fail",
              "params": {
                "s": "3.54"
              }
            },
            "name": "First Contentful Paint (FCP)",
            "value": "3.54s (good: <1.8s)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Store Optimization →"
            },
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Critical: enable full-page caching, eliminate render-blocking resources, preload critical CSS, defer all non-essential JS, and compress images.",
            "whyMatters": "FCP over 3s means users stare at a blank screen for 3+ seconds. Most mobile users abandon sites that take over 3 seconds to show content."
          },
          {
            "i18n": {
              "key": "perf.lcp.warning",
              "params": {
                "s": "3.84"
              }
            },
            "name": "Largest Contentful Paint (LCP)",
            "value": "3.84s (good: <2.5s) — Core Web Vital",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Optimize your largest element (usually hero image or product image): preload it with <link rel='preload'>, use WebP/AVIF format, set explicit width/height, and serve from CDN.",
            "whyMatters": "LCP is a Core Web Vital that directly impacts Google rankings. Sites failing LCP are demoted in search results. The most common cause of slow LCP is unoptimized hero images."
          },
          {
            "i18n": {
              "key": "perf.tbt.warning",
              "params": {
                "ms": 584
              }
            },
            "name": "Total Blocking Time (TBT)",
            "value": "584ms (good: <200ms)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Reduce JavaScript execution: defer non-critical scripts, code-split large bundles, remove unused plugins. Third-party scripts (analytics, chat, ads) are often the biggest offenders.",
            "whyMatters": "TBT measures how long the main thread is blocked. During this time, clicks and taps don't respond — your store feels frozen. This directly impacts perceived quality."
          },
          {
            "i18n": {
              "key": "perf.cls.pass",
              "params": {
                "cls": "0.000"
              }
            },
            "name": "Cumulative Layout Shift (CLS)",
            "value": "0.000 — Core Web Vital ✓",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.speed-index.fail",
              "params": {
                "s": "8.08"
              }
            },
            "name": "Speed Index",
            "value": "8.08s (good: <3.4s)",
            "status": "fail",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Your page loads very slowly visually. Prioritize critical rendering path: inline critical CSS, defer non-essential JS, preload hero image, and use a CDN.",
            "whyMatters": "Speed Index over 5.8s means users watch a near-blank page for almost 6 seconds. At this speed you lose a large share of potential customers to competitors."
          },
          {
            "i18n": {
              "key": "perf.page-weight.fail",
              "params": {
                "mb": "4.5",
                "requests": 204
              }
            },
            "name": "Total Page Weight",
            "value": "4.5 MB, 204 requests — too heavy!",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Performance Optimization →"
            },
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.",
            "whyMatters": "Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales."
          },
          {
            "i18n": {
              "key": "perf.render-blocking.info"
            },
            "name": "Render-blocking Resources",
            "value": "Not measured — PageSpeed did not return the render-blocking audit for this URL",
            "status": "info",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run."
          },
          {
            "i18n": {
              "key": "perf.unused-code.fail",
              "params": {
                "kb": 737
              }
            },
            "name": "Unused Code (CSS + JS)",
            "value": "737 KB wasted on unused code!",
            "status": "fail",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "You're loading 737 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.",
            "whyMatters": "Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs."
          },
          {
            "i18n": {
              "key": "perf.text-compression.pass"
            },
            "name": "Text Compression (gzip/brotli)",
            "value": "All text resources properly compressed",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "perf.resource-hints.warning"
            },
            "name": "Resource Hints (Preload/Preconnect)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.",
            "whyMatters": "Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS."
          },
          {
            "i18n": {
              "key": "perf.lazy-load.pass",
              "params": {
                "lazy": 5,
                "rate": 0,
                "total": 1307
              }
            },
            "name": "Lazy Loading",
            "value": "0% of images use native lazy loading (5/1307)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.script-strategy.fail",
              "params": {
                "rate": 18,
                "total": 11,
                "blocking": 9
              }
            },
            "name": "Script Loading Strategy",
            "value": "Only 18% of 11 scripts optimized — most are render-blocking",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Performance Optimization →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add defer or async to all <script src='...'> tags. Render-blocking scripts are a leading cause of slow FCP. Defer maintains execution order, async does not.",
            "whyMatters": "9 render-blocking scripts can add 1-3 seconds to page load. Each synchronous script creates a sequential download-parse-execute chain."
          },
          {
            "i18n": {
              "key": "perf.css-count.pass",
              "params": {
                "count": 3
              }
            },
            "name": "CSS File Count",
            "value": "3 CSS file(s) — well consolidated",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.critical-css.pass"
            },
            "name": "Critical CSS Strategy",
            "value": "Critical CSS / async CSS loading detected",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          }
        ]
      },
      "ai_readiness": {
        "score": 66,
        "checks": [
          {
            "i18n": {
              "key": "air.bot-access.pass",
              "params": {
                "detail": "No AI bot restrictions (allowed by default)"
              }
            },
            "name": "AI Bot Access Policy",
            "value": "No AI bot restrictions (allowed by default)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "air.llms-txt.fail"
            },
            "name": "llms.txt (AI Site Descriptor)",
            "value": "Not present — not required for AI visibility",
            "status": "info",
            "fixLink": {
              "url": "https://llmstxt.org",
              "label": "About llms.txt →"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Optional: /llms.txt (a Markdown site descriptor per llmstxt.org) is future-proofing, mainly consumed by coding/IDE agents. It does NOT affect whether ChatGPT/Perplexity/Gemini cite your store. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead.",
            "whyMatters": "No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md."
          },
          {
            "i18n": {
              "key": "air.llms-full.warning"
            },
            "name": "llms-full.txt (Complete AI Content)",
            "value": "Not present — not required for AI visibility",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md."
          },
          {
            "i18n": {
              "key": "air.content-access.pass",
              "params": {
                "ratio": "2.8",
                "words": 5532
              }
            },
            "name": "Content Accessibility for AI",
            "value": "5532 words in raw HTML (2.8% text ratio) — readable by AI crawlers without executing JS",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.schema-foundation.warning-multi",
              "params": {
                "note": "",
                "count": 2,
                "types": "BusinessEntity, WebSite"
              }
            },
            "name": "Structured Data Foundation",
            "value": "2 distinct schema types (BusinessEntity, WebSite) — add more for comprehensive AI coverage",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.",
            "whyMatters": "AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite."
          },
          {
            "i18n": {
              "key": "air.product-schema.info",
              "params": {
                "pageType": "homepage"
              }
            },
            "name": "Product Schema Completeness",
            "value": "No Product schema on this homepage — Product schema lives on product detail pages, which this single-URL scan didn't visit",
            "status": "info",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "To audit Product schema, run the scan on a product detail URL. On product pages add: name, description, image, offers (price, priceCurrency, availability), brand, sku, aggregateRating.",
            "whyMatters": "Product schema only belongs on product pages, so its absence on this page is expected — not a defect. Scan a product URL to evaluate it."
          },
          {
            "i18n": {
              "key": "air.org-schema.pass",
              "params": {
                "count": 2
              }
            },
            "name": "Organization Schema + Entity Linking",
            "value": "Organization found with 2 sameAs links — strong entity identity",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "air.faq-schema.warning"
            },
            "name": "FAQ Schema (Direct AI Answers)",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).",
            "whyMatters": "ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI."
          },
          {
            "i18n": {
              "key": "air.breadcrumb.warning"
            },
            "name": "Breadcrumb Schema",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.",
            "whyMatters": "AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'."
          },
          {
            "i18n": {
              "key": "air.sitesearch.pass"
            },
            "name": "Site Search Schema (SearchAction)",
            "value": "WebSite SearchAction configured — AI can search your store",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "air.content-depth.pass",
              "params": {
                "words": 5532
              }
            },
            "name": "Content Depth for AI",
            "value": "5532 words — rich content for AI analysis and citation",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.answer-first.pass",
              "params": {
                "words": 59
              }
            },
            "name": "Answer-First Content Format",
            "value": "First paragraph: 59 words — good content density above the fold",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.headings.fail",
              "params": {
                "h1": 0,
                "h2": 14,
                "h3": 28
              }
            },
            "name": "Heading Hierarchy for AI",
            "value": "0 H1, 14 H2, 28 H3 — poor structure",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).",
            "whyMatters": "AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content."
          },
          {
            "i18n": {
              "key": "air.semantic-html.pass",
              "params": {
                "count": 4,
                "elements": "<article>, <nav>, <header>, <footer>"
              }
            },
            "name": "Semantic HTML Structure",
            "value": "4/6 semantic elements: <article>, <nav>, <header>, <footer>",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.structured-content.warning-partial",
              "params": {
                "what": "222 lists",
                "missing": "comparison tables"
              }
            },
            "name": "Structured Content (Lists & Tables)",
            "value": "222 lists found — consider adding comparison tables",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.",
            "whyMatters": "AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text."
          },
          {
            "i18n": {
              "key": "air.freshness.fail"
            },
            "name": "Content Freshness Signals",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.",
            "whyMatters": "With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages."
          },
          {
            "i18n": {
              "key": "air.entity-clarity.pass",
              "params": {
                "count": 2,
                "platforms": ": Facebook, YouTube"
              }
            },
            "name": "Entity Clarity & Brand Signals",
            "value": "OG tags complete + 2 sameAs links: Facebook, YouTube",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.eeat.warning-noarticle"
            },
            "name": "Author Expertise Signals (E-E-A-T)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.",
            "whyMatters": "AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content."
          },
          {
            "i18n": {
              "key": "air.review-schema.info",
              "params": {
                "pageType": "homepage"
              }
            },
            "name": "Reviews & Ratings Schema",
            "value": "No review schema on this homepage — review/rating schema typically lives on product pages",
            "status": "info",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Scan a product URL to audit review schema. On product pages add AggregateRating (ratingValue, reviewCount, bestRating) and individual Review schemas.",
            "whyMatters": "Review schema is product-page-specific, so its absence here is expected, not a defect."
          },
          {
            "i18n": {
              "key": "air.ai-plugin.warning"
            },
            "name": "AI Plugin Manifest",
            "value": "Not present — not required (the ChatGPT-plugins manifest was retired in 2024)",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "ai-plugin.json belonged to the retired ChatGPT-plugins system. Modern agent integration uses MCP / tool APIs — see the WebMCP / Agent-Commerce Readiness signals instead."
          },
          {
            "i18n": {
              "key": "air.product-feed.warning"
            },
            "name": "Product Feed (AI Commerce)",
            "status": "warning",
            "fixLink": {
              "url": "https://audit.mergado.com/",
              "label": "Free feed audit — Mergado"
            },
            "evidence": {
              "sample": "probed /feed/products.xml, /google-shopping.xml, /export/google-shopping.xml — none returned a product feed",
              "source": "file-probe"
            },
            "howToFix": "Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.",
            "whyMatters": "Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations."
          },
          {
            "i18n": {
              "key": "air.heureka-feed.warning-missing"
            },
            "name": "Heureka XML Feed",
            "status": "warning",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Setup Heureka Feed — Inger"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).",
            "whyMatters": "Heureka.sk a Heureka.cz sú dominantné cenové porovnávače na SK/CZ trhu. Bez XML feedu nie ste viditeľní na hlavnom trhovisku. Žiaden generický audit tool toto nekontroluje."
          },
          {
            "i18n": {
              "key": "air.speakable.warning"
            },
            "name": "Speakable Content (Voice AI)",
            "value": "Not present — optional; SpeakableSpecification has limited assistant adoption",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.extractable.warning-long",
              "params": {
                "avg": 251,
                "count": 21
              }
            },
            "name": "Extractable Answer Blocks",
            "value": "21 paragraphs, avg 251 words — too long for AI snippets",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.",
            "whyMatters": "AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable."
          },
          {
            "i18n": {
              "key": "air.statistics.pass",
              "params": {
                "count": 45
              }
            },
            "name": "Statistics & Data Presence",
            "value": "45 data points found — strong citation magnet",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.section-length.warning",
              "params": {
                "avg": 197,
                "ratio": 0
              }
            },
            "name": "Section Length Optimization",
            "value": "Avg section: 197 words — only 0% in 80-200 word optimal range",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.",
            "whyMatters": "For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance."
          },
          {
            "i18n": {
              "key": "air.qa-headings.warning-none"
            },
            "name": "Q&A Format Headings",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.",
            "whyMatters": "Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries."
          },
          {
            "i18n": {
              "key": "air.question-coverage.pass",
              "params": {
                "n": 4,
                "labels": "price, shipping, availability, payment"
              }
            },
            "name": "Common Question Coverage",
            "value": "Answers 4/5 key shopper questions: price, shipping, availability, payment",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.internal-links.fail"
            },
            "name": "Internal Link Density",
            "value": "Almost no internal links in content",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add contextual internal links throughout your content: link to related products, categories, guides, and FAQs. Use descriptive anchor text (not 'click here'). Target 3-5 links per 1,000 words.",
            "whyMatters": "Without internal links, AI crawlers treat each page as isolated content. Internal linking creates a semantic web that helps AI understand your product catalog, categories, and content relationships."
          },
          {
            "i18n": {
              "key": "air.canonical.warning-different",
              "params": {
                "url": "https://www.4home.sk"
              }
            },
            "name": "Canonical Tag for AI Deduplication",
            "value": "Canonical points to different URL: https://www.4home.sk",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.",
            "whyMatters": "AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely."
          },
          {
            "i18n": {
              "key": "air.return-policy.warning"
            },
            "name": "Return Policy Schema",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.",
            "whyMatters": "AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons."
          },
          {
            "i18n": {
              "key": "air.shipping-schema.warning"
            },
            "name": "Shipping Details Schema",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.",
            "whyMatters": "Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver."
          },
          {
            "i18n": {
              "key": "air.kg-readiness.pass",
              "params": {
                "count": 3
              }
            },
            "name": "Knowledge Graph Readiness",
            "value": "3/4 entity signals — strong Knowledge Graph presence",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.readability.warning-high",
              "params": {
                "grade": 20
              }
            },
            "name": "Content Readability for AI",
            "value": "Grade 20 — too complex for broad AI citation",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.",
            "whyMatters": "Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often."
          },
          {
            "i18n": {
              "key": "air.alt-text.fail",
              "params": {
                "pct": 3,
                "poor": 190,
                "missing": 1077
              }
            },
            "name": "Image Alt Text Quality for AI",
            "value": "Only 3% quality alt text — 1077 missing, 190 poor",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.",
            "whyMatters": "Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally."
          },
          {
            "i18n": {
              "key": "air.expert-quotes.warning-none"
            },
            "name": "Expert Quotations & Citations",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).",
            "whyMatters": "Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions."
          },
          {
            "i18n": {
              "key": "air.ai-txt.warning"
            },
            "name": "ai.txt (AI Permissions)",
            "value": "Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "ai.txt is an emerging fine-grained AI-permissions proposal not yet honored by the major engines. The robots.txt AI-bot rules are the signal that actually gates crawler access."
          },
          {
            "i18n": {
              "key": "air.webmcp.warning"
            },
            "name": "WebMCP Agentic Readiness",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.",
            "whyMatters": "WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard."
          },
          {
            "i18n": {
              "key": "air.boilerplate.pass-semantic"
            },
            "name": "Content-to-Boilerplate Ratio",
            "value": "Semantic content containers found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.heureka-ovreno.pass",
              "params": {
                "suffix": ""
              }
            },
            "name": "Heureka Ověřeno Widget",
            "value": "Heureka trust widget detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "whyMatters": "Heureka Ověřeno is the dominant SK/CZ social-proof program. Verified shops with a public obchody.heureka.* profile show stronger long-term provenance than just a widget script."
          },
          {
            "i18n": {
              "key": "air.reviews-aggregate.warning",
              "params": {
                "detail": "1 source: Heureka Ověřeno"
              }
            },
            "name": "Customer Reviews — Aggregate",
            "value": "1 source: Heureka Ověřeno",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Single review source detected without published reviewCount. Add AggregateRating JSON-LD (ratingValue + reviewCount + bestRating) so the count is machine-readable, and add a second source (Heureka Ověřeno + Trustpilot is the SK/CZ standard).",
            "whyMatters": "Without a second review source and a machine-readable reviewCount, AI assistants can't verify scale of social proof — single-source ratings are routinely deweighted as potentially curated."
          },
          {
            "name": "Agent-Commerce Readiness",
            "value": "73/100 — čiastočne pripravené (Prístup 100 · Porozumenie 75 · Objaviteľnosť 67 · Transakcia 50)",
            "status": "info",
            "whyMatters": "Či dokáže autonómny nákupný AI agent (ChatGPT operator, Perplexity, budúce agentické asistenty) na vašom obchode: prísť dnu, prečítať a porozumieť produktom, objaviť celý katalóg a konať (kôš, podmienky). Toto meria málokto — a pre SK/CZ shopy nikto. Skóre spája AI-bot prístup, Product schema, produktové feedy (Merchant/Heureka/Zboží), WebMCP a nákupné podmienky do jedného agent-first pohľadu. Nadväzuje na pripravovaný verejný MCP konektor (\"naskenuj tento obchod\")."
          },
          {
            "name": "Agent: Prístup — dostane sa agent dnu",
            "value": "100/100 (2 signály/-ov)",
            "status": "info"
          },
          {
            "name": "Agent: Porozumenie — rozumie produktom",
            "value": "75/100 (2 signály/-ov)",
            "status": "info"
          },
          {
            "name": "Agent: Objaviteľnosť — nájde celý katalóg",
            "value": "67/100 (3 signály/-ov)",
            "status": "info"
          },
          {
            "name": "Agent: Transakcia — vie konať (kôš/podmienky)",
            "value": "50/100 (3 signály/-ov)",
            "status": "info"
          }
        ]
      },
      "phaseTimings": {
        "tail": 622,
        "total": 4949,
        "phase1": 2718,
        "preflight": 1102,
        "phase1.dns": 441,
        "phase1.html": 1591,
        "phase1.files": 2716,
        "phase1.zbozi": 1596,
        "phase1.headers": 920,
        "phase1.heureka": 1127,
        "phase1.merchant": 1594
      },
      "accessibility": {
        "score": 36,
        "checks": [
          {
            "i18n": {
              "key": "a11y.lang.pass",
              "params": {
                "lang": "sk"
              }
            },
            "name": "Page Language",
            "value": "<html lang=\"sk\"> is set",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.alt.fail",
              "params": {
                "total": 1307,
                "missing": 1077
              }
            },
            "name": "Image Alt Text",
            "value": "1077 of 1307 images have no alt attribute",
            "status": "fail",
            "weight": 2,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add descriptive alt text to every meaningful image; use alt=\"\" for purely decorative ones so screen readers skip them.",
            "whyMatters": "Images without alt text are invisible to blind users and to Google Images. EN 301 549 § 9.1.1.1 (WCAG 1.1.1) requires a text alternative for all non-text content."
          },
          {
            "i18n": {
              "key": "a11y.forms.warning",
              "params": {
                "total": 225,
                "unlabeled": 5
              }
            },
            "name": "Form Labels",
            "value": "5 of 225 form inputs missing a label",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a <label for> or aria-label to the remaining inputs.",
            "whyMatters": "Inputs without a programmatic label are inaccessible to assistive technology (WCAG 1.3.1 / EN 301 549 § 9.1.3.1)."
          },
          {
            "i18n": {
              "key": "a11y.headings.no-h1"
            },
            "name": "Heading Structure",
            "value": "The page has no <h1> heading",
            "status": "fail",
            "weight": 2,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.",
            "whyMatters": "Screen-reader users navigate by headings; a missing or broken heading outline forces them to read linearly. EN 301 549 § 9.1.3.1 / 9.2.4.6 (WCAG 1.3.1 / 2.4.6)."
          },
          {
            "i18n": {
              "key": "a11y.links.pass"
            },
            "name": "Link Text",
            "value": "Links use descriptive text",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "confidence": "low"
          },
          {
            "i18n": {
              "key": "a11y.landmarks.no-main"
            },
            "name": "Landmark Regions",
            "value": "No <main> landmark region found",
            "status": "fail",
            "weight": 1,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Wrap the primary content in <main> and use <nav>, <header>, <footer> for the page regions.",
            "whyMatters": "Landmarks let assistive-tech users jump straight to the main content and skip repeated navigation. EN 301 549 § 9.1.3.1 (WCAG 1.3.1)."
          },
          {
            "i18n": {
              "key": "a11y.zoom.pass"
            },
            "name": "Zoom & Scaling",
            "value": "Pinch-zoom is not disabled",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.skiplink.missing"
            },
            "name": "Skip Link",
            "value": "No skip-to-content link detected",
            "status": "warning",
            "weight": 1,
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a visually-hidden \"Skip to content\" link as the first focusable element, targeting <main id=\"main\">.",
            "confidence": "low",
            "whyMatters": "Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1)."
          },
          {
            "i18n": {
              "key": "a11y.legal-basis"
            },
            "name": "EAA Legal Basis",
            "value": "In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.",
            "status": "info",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "howToFix": "",
            "isUpsell": true,
            "whyMatters": ""
          }
        ]
      },
      "vulnerability": {
        "score": 62,
        "checks": [
          {
            "i18n": {
              "key": "vuln.cms-version.pass"
            },
            "name": "CMS Version Disclosure",
            "value": "No generator tag — CMS identity hidden",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.sensitive-files.pass"
            },
            "name": "Sensitive Files Exposed",
            "value": ".env, .git, composer.json — all properly blocked",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.install-script.pass"
            },
            "name": "Install Script Exposed",
            "value": "No /install/ or /setup/ paths accessible",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.directory-listing.pass"
            },
            "name": "Directory Listing",
            "value": "Disabled — file structure hidden",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.admin-url.pass"
            },
            "name": "Admin Panel at Default URL",
            "value": "Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.debug-mode.pass"
            },
            "name": "Debug Mode / Error Exposure",
            "value": "No debug indicators found in page output",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.csrf.fail",
              "params": {
                "count": 6
              }
            },
            "name": "Form CSRF Protection",
            "value": "6 form(s) without CSRF tokens",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.",
            "confidence": "low",
            "whyMatters": "CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session."
          },
          {
            "i18n": {
              "key": "vuln.x-powered-by.warning",
              "params": {
                "detail": "ASP.NET",
                "header": "ASP.NET"
              }
            },
            "name": "X-Powered-By Header",
            "value": "ASP.NET",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').",
            "whyMatters": "\"ASP.NET\" reveals your server technology and version. Attackers use this to find matching CVEs."
          },
          {
            "i18n": {
              "key": "vuln.spf.pass",
              "params": {
                "record": "v=spf1 a mx include:_spf.mail4eshop.com include:_spf.quanti.cz include:Spf.prote"
              }
            },
            "name": "SPF Record (Email Security)",
            "value": "SPF configured: v=spf1 a mx include:_spf.mail4eshop.com include:_spf.quanti.cz include:Spf.prote",
            "status": "pass",
            "evidence": {
              "source": "DNS"
            }
          },
          {
            "i18n": {
              "key": "vuln.dmarc.warning-none"
            },
            "name": "DMARC Policy (Email Auth)",
            "value": "DMARC set to p=none (monitoring only, no enforcement)",
            "status": "warning",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.",
            "whyMatters": "DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes."
          },
          {
            "i18n": {
              "key": "vuln.dkim.warning"
            },
            "name": "DKIM Signing (Email Auth)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.",
            "whyMatters": "DKIM cryptographically signs outgoing email to prove it comes from your domain. Without DKIM, email providers downgrade trust score — transactional emails land in spam. Gmail and Yahoo require DKIM since 2024 for bulk senders."
          },
          {
            "i18n": {
              "key": "vuln.mixed-content.warning",
              "params": {
                "urls": "http://cdn.4home.cz/8885b095-2506-4278-8f4c-c19ade2f7604/b2b.png, http://obchody.heureka.sk/4home-sk/recenze",
                "count": 2
              }
            },
            "name": "Mixed Content Resources",
            "value": "2 HTTP resource(s) on HTTPS page",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Replace HTTP URLs with HTTPS: http://cdn.4home.cz/8885b095-2506-4278-8f4c-c19ade2f7604/b2b.png, http://obchody.heureka.sk/4home-sk/recenze",
            "whyMatters": "Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site."
          },
          {
            "i18n": {
              "key": "vuln.login-form.warning-autocomplete"
            },
            "name": "Login Form Security",
            "value": "Login form blocks password manager autofill",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Remove autocomplete='off' from login forms. Password managers improve security by enabling unique, complex passwords per site.",
            "whyMatters": "NIST guidelines recommend allowing password autofill. Blocking it forces users to choose weak, memorable passwords — a leading cause of credential compromise."
          },
          {
            "i18n": {
              "key": "vuln.payment-page.fail",
              "params": {
                "issues": "No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection"
              }
            },
            "name": "Payment Page Security",
            "value": "Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get PCI Compliance Audit →"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.",
            "whyMatters": "Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance."
          },
          {
            "i18n": {
              "key": "vuln.clickjacking.fail"
            },
            "name": "Clickjacking on Sensitive Page",
            "value": "Login/payment page without X-Frame-Options or CSP frame-ancestors",
            "status": "fail",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "URGENT: Add X-Frame-Options: DENY and CSP frame-ancestors 'none' to pages with login forms or payment fields. Attackers can overlay your page in a transparent iframe.",
            "whyMatters": "Clickjacking on payment/login pages is a high-severity vulnerability. Users unknowingly submit credentials or payments through invisible iframes. PCI DSS requires frame-busting on payment pages."
          }
        ]
      },
      "executive_summary": {
        "en": "Your site needs improvements in security and accessibility. Add HSTS security headers to your server immediately. Good news: your SEO foundation is solid and you're ready for AI.",
        "sk": "Váš web potrebuje zlepšenia v bezpečnosti a dostupnosti. Ihneď pridajte HSTS zabezpečenie do svojho servera. Pozitívne je vaša SEO pripravená a rady na AI technológie."
      },
      "opendata_security": null
    },
    "created_at": "2026-07-29T06:26:00.951696+00:00",
    "status": "complete",
    "platform_detected": null,
    "company_ico": null,
    "company_name": null,
    "company_country": null,
    "company_nace": null,
    "company_size": null,
    "nis2_scope": null,
    "nis2_sector": null,
    "company_risk_score": null,
    "company_risk_level": null
  }
}