{
  "data": {
    "slug": "e5d9fe65",
    "url": "https://kagency.com",
    "domain": "kagency.com",
    "overall_score": 84,
    "scores_json": {
      "seo": {
        "score": 90,
        "checks": [
          {
            "i18n": {
              "key": "seo.meta-title.pass",
              "params": {
                "chars": 60,
                "title": "Agence web Nantes - Création de sites internet et e-com…"
              }
            },
            "name": "Meta Title",
            "value": "60 chars — \"Agence web Nantes - Création de sites internet et e-com…\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.meta-desc.warning-short",
              "params": {
                "chars": 10
              }
            },
            "name": "Meta Description",
            "value": "10 chars (optimal: 120-160)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Expand your description to at least 120 characters. Include benefits, a CTA, and your target keyword.",
            "whyMatters": "Short descriptions waste SERP real estate and miss the chance to persuade searchers to click."
          },
          {
            "i18n": {
              "key": "seo.h1.pass",
              "params": {
                "text": "L’agence web pour créer votre site internet à Nantes"
              }
            },
            "name": "H1 Heading",
            "value": "\"L’agence web pour créer votre site internet à Nantes\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.h2.pass",
              "params": {
                "count": 10
              }
            },
            "name": "Content Structure (H2 Headings)",
            "value": "10 H2 subheadings found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.og.pass",
              "params": {
                "tags": "og:title, og:image, og:type"
              }
            },
            "name": "Open Graph Tags",
            "value": "og:title, og:image, og:type",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.og-format.pass",
              "params": {
                "contentType": "image/jpeg"
              }
            },
            "name": "Open Graph Image Format",
            "value": "image/jpeg",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.twitter.pass",
              "params": {
                "card": "summary_large_image"
              }
            },
            "name": "Twitter/X Cards",
            "value": "Card type: summary_large_image",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.canonical.pass",
              "params": {
                "url": "https://www.kagency.com/"
              }
            },
            "name": "Canonical URL",
            "value": "https://www.kagency.com/",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.jsonld.pass",
              "params": {
                "count": 2,
                "types": "WebSite, SearchAction, EntryPoint, ProfessionalService"
              }
            },
            "name": "Structured Data (JSON-LD)",
            "value": "2 block(s): WebSite, SearchAction, EntryPoint, ProfessionalService",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "seo.jsonld-valid.pass",
              "params": {
                "count": 2
              }
            },
            "name": "JSON-LD Validity",
            "value": "2 block(s) parse cleanly",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.robots.pass-sitemap"
            },
            "name": "robots.txt",
            "value": "Present, references sitemap",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.sitemap.pass-count",
              "params": {
                "count": 479
              }
            },
            "name": "XML Sitemap",
            "value": "Found with 479 URLs",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.html-lang.pass",
              "params": {
                "lang": "fr"
              }
            },
            "name": "HTML Language Attribute",
            "value": "lang=\"fr\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.img-alt.pass",
              "params": {
                "rate": 100,
                "total": 92
              }
            },
            "name": "Image Alt Attributes",
            "value": "100% of 92 images have alt text",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.meta-robots.pass",
              "params": {
                "value": "index, follow"
              }
            },
            "name": "Meta Robots Tag",
            "value": "index, follow",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.text-ratio.info",
              "params": {
                "ratio": 14,
                "words": 1983
              }
            },
            "name": "Text-to-HTML Ratio",
            "value": "14% ratio but 1983 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.",
            "whyMatters": "Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on."
          },
          {
            "i18n": {
              "key": "seo.favicon.pass"
            },
            "name": "Favicon",
            "value": "Favicon detected",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.img-format.warning-none",
              "params": {
                "jpg": 25,
                "png": 36
              }
            },
            "name": "Image Format Optimization",
            "value": "0% next-gen formats — 25 JPEG, 36 PNG images",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Convert all images to WebP format. Most CMS platforms have plugins for automatic WebP conversion. Use AVIF for even better compression.",
            "whyMatters": "Your images use legacy formats only. Switching to WebP typically reduces page weight by 30-50% — one of the highest-impact performance optimizations."
          },
          {
            "i18n": {
              "key": "seo.semantic.pass",
              "params": {
                "used": "<nav>, <main>, <header>, <footer>",
                "count": 4
              }
            },
            "name": "Semantic HTML Structure",
            "value": "4/6 semantic elements: <nav>, <main>, <header>, <footer>",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.canonical-consistency.warning",
              "params": {
                "url": "https://www.kagency.com/"
              }
            },
            "name": "Canonical URL Consistency",
            "value": "Canonical points to different URL: https://www.kagency.com/",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.",
            "whyMatters": "A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target."
          },
          {
            "i18n": {
              "key": "seo.content-depth.pass",
              "params": {
                "words": 1983
              }
            },
            "name": "Content Depth",
            "value": "1983 words — sufficient content",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.deep-heading.pass",
              "params": {
                "h2": 10,
                "h3": 56
              }
            },
            "name": "Deep Heading Hierarchy",
            "value": "H2: 10, H3: 56 — well-structured content",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.internal-links.pass",
              "params": {
                "count": 77
              }
            },
            "name": "Internal Linking",
            "value": "77 internal links — strong site navigation",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.dead-links.warning",
              "params": {
                "hash": 7,
                "empty": 0,
                "total": 7,
                "jsvoid": 0
              }
            },
            "name": "Empty/Dead Links",
            "value": "7 dead links (0 empty, 7 hash-only, 0 javascript:void)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.",
            "whyMatters": "Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens."
          },
          {
            "i18n": {
              "key": "seo.a11y.warning",
              "params": {
                "missing": "ARIA roles, skip navigation link",
                "signals": 2
              }
            },
            "name": "Accessibility Fundamentals",
            "value": "2/4 a11y signals — missing: ARIA roles, skip navigation link",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.",
            "whyMatters": "The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO, as Google treats it as a ranking signal."
          },
          {
            "i18n": {
              "key": "seo.sitemap-freshness.pass",
              "params": {
                "days": 107
              }
            },
            "name": "Sitemap Freshness",
            "value": "Newest <lastmod> 107 day(s) ago",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          }
        ]
      },
      "gdpr": {
        "score": 75,
        "checks": [
          {
            "i18n": {
              "key": "gdpr.cmp.pass",
              "params": {
                "provider": "Cookiebot"
              }
            },
            "name": "Cookie Consent Banner (CMP)",
            "value": "Cookiebot detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.tracking.pass",
              "params": {
                "count": 1,
                "trackers": "Matomo"
              }
            },
            "name": "Tracking Scripts & Consent",
            "value": "1 tracker(s) detected with CMP: Matomo",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "EDPB Opinion 5/2019"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.privacy-policy.pass",
              "params": {
                "url": "https://www.kagency.com/politique-de-confidentialite"
              }
            },
            "name": "Privacy Policy Page",
            "value": "https://www.kagency.com/politique-de-confidentialite",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13",
                "Art. 14"
              ],
              "skLaw": [
                "§ 19",
                "§ 20"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 14 — Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby 2. Okrem informácií uvedených v odseku 1 prevádzkovateľ poskytne dotknutej osobe tieto ďalšie informácie potrebné na zabezpečenie spravodliv",
                  "citation": "čl. 14 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "18/2018",
                  "title": "Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby",
                  "excerpt": "§ 20 Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby (5) d) ak osobné údaje musia zostať dôverné na základe povinnosti mlčanlivosti podľa osobitného predpisu. 15 )",
                  "citation": "§20 ods. 5 písm. d) zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.cookie-policy.warning"
            },
            "name": "Cookie Policy",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.",
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13(1)(c)-(e)"
              ],
              "skLaw": [
                "§ 19"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement."
          },
          {
            "i18n": {
              "key": "gdpr.imprint.warning"
            },
            "name": "Legal Contact / Imprint Page",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add an imprint/about-us page with: company name, registered address, contact email, VAT number, and trade register info. In Germany/Austria/Switzerland this is legally required (Impressumspflicht).",
            "whyMatters": "In DACH countries, a missing Impressum can trigger fines and competitor cease-and-desist letters. For all EU stores, identifying the data controller is a GDPR Article 13 requirement."
          },
          {
            "i18n": {
              "key": "gdpr.terms.warning"
            },
            "name": "Terms & Conditions Page",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.",
            "whyMatters": "EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights."
          },
          {
            "i18n": {
              "key": "gdpr.mixed-content.pass"
            },
            "name": "Data Encryption (No Mixed Content)",
            "value": "All resources loaded over HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.third-party.warning",
              "params": {
                "count": 7,
                "sample": "consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, unpkg.com"
              }
            },
            "name": "Third-party Data Sharing",
            "value": "7 third-party domains loading scripts",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your page loads scripts from 7 external domains. Review each one: consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, unpkg.com... Ensure each has a Data Processing Agreement (DPA) and is listed in your privacy policy.",
            "whyMatters": "Every third-party script is a potential data processor under GDPR. You need a DPA with each one, and they must be disclosed to users. Excessive third parties also increase data breach risk."
          },
          {
            "i18n": {
              "key": "gdpr.erasure.warning"
            },
            "name": "Right to Erasure (Data Deletion)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.",
            "legalRefs": {
              "gdpr": [
                "Art. 17"
              ],
              "skLaw": [
                "§ 23"
              ],
              "verified": [
                {
                  "title": "Právo na vymazanie (právo „na zabudnutie“)",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 17 — Právo na vymazanie (právo „na zabudnutie“) 1. Dotknutá osoba má tiež právo dosiahnuť u prevádzkovateľa bez zbytočného odkladu vymazanie osobných údajov, ktoré sa jej týkajú, a prevádzkovateľ je povinný bez zbytočného odkladu vy",
                  "citation": "čl. 17 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Právo na výmaz osobných údajov",
                  "excerpt": "§ 23 Právo na výmaz osobných údajov (1) Dotknutá osoba má právo na to, aby prevádzkovateľ bez zbytočného odkladu vymazal osobné údaje, ktoré sa jej týkajú.",
                  "citation": "§23 ods. 1 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding."
          },
          {
            "i18n": {
              "key": "gdpr.newsletter.pass"
            },
            "name": "Newsletter Consent",
            "value": "Newsletter form with consent mechanism detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "ePrivacy Art. 13"
              ],
              "skLaw": [
                "§ 14",
                "§ 109 zák. 452/2021"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "452/2021",
                  "title": "—",
                  "excerpt": "§ 109 — (8) Každý, kto ukladá alebo získava prístup k informáciám uloženým v koncovom zariadení užívateľa, je na to oprávnený iba ak užívateľ udelil preukázateľný súhlas spĺňajúci náležitosti podľa osobitného predpisu. 126 ) Povinnosť získa",
                  "citation": "§109 ods. 8 zákona č. 452/2021 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.dpo.warning"
            },
            "name": "Data Protection Officer Contact",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.",
            "whyMatters": "GDPR Article 37 requires a DPO for organizations processing personal data at scale. Even if not mandatory, having a designated privacy contact builds trust and is expected by regulators."
          },
          {
            "i18n": {
              "key": "gdpr.withdrawal.warning"
            },
            "name": "Withdrawal of Consent Mechanism",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.",
            "legalRefs": {
              "gdpr": [
                "Art. 7(3)"
              ],
              "skLaw": [
                "§ 14(4)"
              ],
              "verified": [
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding."
          }
        ]
      },
      "nis2": {
        "score": -1,
        "checks": [
          {
            "i18n": {
              "key": "nis2.scope.unknown"
            },
            "name": "NIS2 Compliance",
            "value": "Scope undetermined — IČO/company enrichment unavailable for this domain.",
            "status": "info",
            "howToFix": "",
            "whyMatters": ""
          }
        ]
      },
      "mobile": {
        "score": 66,
        "checks": [
          {
            "i18n": {
              "key": "mob.viewport.pass"
            },
            "name": "Viewport Configuration",
            "value": "width=device-width, initial-scale=1",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.perf.warning",
              "params": {
                "score": 56
              }
            },
            "name": "Mobile Performance Score",
            "value": "56/100 (target: 90+)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.",
            "whyMatters": "Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop."
          },
          {
            "i18n": {
              "key": "mob.gap.warning",
              "params": {
                "gap": 42,
                "mobile": 56,
                "desktop": 98
              }
            },
            "name": "Desktop/Mobile Performance Gap",
            "value": "Desktop: 98 vs Mobile: 56 (42 point gap)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your desktop experience is significantly better than mobile. Focus on: reducing JavaScript (mobile CPUs are slower), serving responsive images (smaller files for smaller screens), and minimizing main-thread work.",
            "whyMatters": "Google uses mobile-first indexing — your mobile score IS your SEO score. A big gap means your desktop optimizations aren't reaching mobile users, who are the majority of your traffic."
          },
          {
            "i18n": {
              "key": "mob.taptarget.warning",
              "params": {
                "detail": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)"
              }
            },
            "name": "Touch Target Size",
            "value": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)"
            },
            "howToFix": "Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.",
            "whyMatters": "Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue."
          },
          {
            "i18n": {
              "key": "mob.fontsize.warning",
              "params": {
                "detail": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)"
              }
            },
            "name": "Font Size Readability",
            "value": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)"
            },
            "howToFix": "Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.",
            "whyMatters": "Text below the legibility threshold forces mobile users to pinch-zoom. This measures the actual rendered page (Lighthouse), so it catches sub-12px nodes even when the base font looks fine."
          },
          {
            "i18n": {
              "key": "mob.contentwidth.pass"
            },
            "name": "Content Fits Viewport",
            "value": "No horizontal scrolling needed",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.responsive.pass",
              "params": {
                "techniques": "Media queries"
              }
            },
            "name": "Responsive Design Techniques",
            "value": "Media queries detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.themecolor.warning"
            },
            "name": "Theme Color",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.",
            "whyMatters": "Theme-color creates a polished, branded mobile experience. It makes your site look native and professional."
          },
          {
            "i18n": {
              "key": "mob.nav.pass"
            },
            "name": "Mobile Navigation (Semantic)",
            "value": "<nav> element present — proper navigation landmark",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.srcset.warning",
              "params": {
                "count": 92
              }
            },
            "name": "Responsive Images (srcset)",
            "value": "92 images without responsive sizing",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.",
            "whyMatters": "Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites."
          },
          {
            "i18n": {
              "key": "mob.apple.pass",
              "params": {
                "count": 2
              }
            },
            "name": "Apple Mobile Web App",
            "value": "2/3 Apple mobile meta tags configured",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.inputtypes.warning",
              "params": {
                "issues": "phone fields use type='text' instead of type='tel'"
              }
            },
            "name": "Form Input Types",
            "value": "phone fields use type='text' instead of type='tel'",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Use semantic input types: type='email' for email (shows @ keyboard), type='tel' for phone (shows number pad), type='search' for search (shows search button). These trigger optimized mobile keyboards.",
            "whyMatters": "Correct input types show specialized mobile keyboards — email keyboard with @, phone with number pad. This reduces input errors and speeds up form completion."
          },
          {
            "i18n": {
              "key": "mob.wcaglabels.pass",
              "params": {
                "total": 6
              }
            },
            "name": "Form Input Labels (WCAG 3.3.2)",
            "value": "6/6 inputs have a label",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.wcagheading.pass"
            },
            "name": "Heading Hierarchy (WCAG 1.3.1)",
            "value": "No skipped heading levels",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.wcaglinks.pass"
            },
            "name": "Link Text Quality (WCAG 2.4.4)",
            "value": "All links have descriptive text",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          }
        ]
      },
      "company": null,
      "modules": [],
      "security": {
        "score": 81,
        "checks": [
          {
            "i18n": {
              "key": "sec.ssl.pass"
            },
            "name": "SSL/TLS Certificate",
            "value": "Valid HTTPS connection established",
            "status": "pass",
            "evidence": {
              "source": "SSL"
            }
          },
          {
            "i18n": {
              "key": "sec.dnssec.warning"
            },
            "name": "DNSSEC",
            "value": "No DNSKEY records — zone is unsigned",
            "status": "warning",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "DNSSEC setup help →"
            },
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.",
            "whyMatters": "Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities."
          },
          {
            "i18n": {
              "key": "sec.caa.warning"
            },
            "name": "CAA DNS Record",
            "value": "No CAA records — any CA can issue certificates for this domain",
            "status": "warning",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue \"letsencrypt.org\"`. For multiple CAs add additional `0 issue \"...\"` records. Add `0 iodef \"mailto:security@yourdomain.tld\"` for misissuance reports.",
            "whyMatters": "CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017)."
          },
          {
            "i18n": {
              "key": "sec.https-redirect.pass"
            },
            "name": "HTTP → HTTPS Redirect",
            "value": "HTTP properly redirects to HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.hsts.pass",
              "params": {
                "detail": "max-age=31536000, preload, includeSubDomains"
              }
            },
            "name": "HSTS (Strict-Transport-Security)",
            "value": "max-age=31536000, preload, includeSubDomains",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.csp.warning",
              "params": {
                "detail": "'unsafe-inline'"
              }
            },
            "name": "Content-Security-Policy (CSP)",
            "value": "Present but uses 'unsafe-inline'",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Remove 'unsafe-inline' by using nonces or hashes for inline scripts. Remove 'unsafe-eval' by eliminating eval() calls. These exceptions weaken CSP significantly.",
            "whyMatters": "'unsafe-inline' allows injected scripts to execute — defeating the main purpose of CSP. Major XSS protection is bypassed."
          },
          {
            "i18n": {
              "key": "sec.clickjacking.pass",
              "params": {
                "detail": "SAMEORIGIN, SAMEORIGIN"
              }
            },
            "name": "Clickjacking Protection",
            "value": "X-Frame-Options: SAMEORIGIN, SAMEORIGIN",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.x-content-type.pass"
            },
            "name": "X-Content-Type-Options",
            "value": "nosniff",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.referrer-policy.pass",
              "params": {
                "detail": "strict-origin-when-cross-origin"
              }
            },
            "name": "Referrer-Policy",
            "value": "strict-origin-when-cross-origin",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.permissions-policy.pass",
              "params": {
                "detail": "geolocation=(), camera=(), microphone=()"
              }
            },
            "name": "Permissions-Policy",
            "value": "geolocation=(), camera=(), microphone=()",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.cookie-flags.pass-none"
            },
            "name": "Cookie Security Flags",
            "value": "No cookies set on initial response",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.tech-disclosure.pass",
              "params": {
                "detail": "nginx"
              }
            },
            "name": "Technology Disclosure",
            "value": "Server: nginx (no version)",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.sri.warning",
              "params": {
                "eligible": 9,
                "exemptNote": " (2 auto-updating provider script(s) excluded — SRI not applicable)",
                "withIntegrity": 3
              }
            },
            "name": "Subresource Integrity (SRI)",
            "value": "Only 3/9 SRI-eligible third-party scripts have integrity hashes (2 auto-updating provider script(s) excluded — SRI not applicable)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.",
            "whyMatters": "Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach."
          },
          {
            "i18n": {
              "key": "sec.security-txt.warning"
            },
            "name": "security.txt (RFC 9116)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.",
            "whyMatters": "security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all."
          },
          {
            "i18n": {
              "key": "sec.server-version.pass",
              "params": {
                "name": "Nginx"
              }
            },
            "name": "Server Version Disclosure",
            "value": "Nginx — version hidden",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.cdn.warning"
            },
            "name": "CDN / WAF Protection",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.",
            "whyMatters": "Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts."
          }
        ]
      },
      "tech_stack": [
        {
          "name": "jQuery",
          "version": "3.7.1",
          "category": "js-library",
          "outdated": false
        },
        {
          "name": "Bootstrap",
          "category": "css-framework"
        },
        {
          "name": "Font Awesome",
          "category": "js-library"
        },
        {
          "name": "Swiper",
          "category": "js-library"
        },
        {
          "name": "reCAPTCHA",
          "category": "js-library"
        },
        {
          "name": "Nginx",
          "category": "server"
        }
      ],
      "performance": {
        "score": 89,
        "checks": [
          {
            "i18n": {
              "key": "perf.ttfb.pass",
              "params": {
                "ms": 16
              }
            },
            "name": "Server Response Time (TTFB)",
            "value": "16ms",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.fcp.pass",
              "params": {
                "s": "0.71"
              }
            },
            "name": "First Contentful Paint (FCP)",
            "value": "0.71s",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.lcp.pass",
              "params": {
                "s": "1.11"
              }
            },
            "name": "Largest Contentful Paint (LCP)",
            "value": "1.11s — Core Web Vital ✓",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.tbt.pass",
              "params": {
                "ms": 61
              }
            },
            "name": "Total Blocking Time (TBT)",
            "value": "61ms",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.cls.pass",
              "params": {
                "cls": "0.002"
              }
            },
            "name": "Cumulative Layout Shift (CLS)",
            "value": "0.002 — Core Web Vital ✓",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.speed-index.pass",
              "params": {
                "s": "0.93"
              }
            },
            "name": "Speed Index",
            "value": "0.93s",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.page-weight.fail",
              "params": {
                "mb": "3.3",
                "requests": 61
              }
            },
            "name": "Total Page Weight",
            "value": "3.3 MB, 61 requests — too heavy!",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Performance Optimization →"
            },
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.",
            "whyMatters": "Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales."
          },
          {
            "i18n": {
              "key": "perf.js-budget.warning",
              "params": {
                "kb": 1028
              }
            },
            "name": "JavaScript Budget",
            "value": "1028 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "1028 KB JavaScript"
            },
            "howToFix": "Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.",
            "confidence": "high",
            "whyMatters": "Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB."
          },
          {
            "i18n": {
              "key": "perf.request-budget.pass",
              "params": {
                "count": 61
              }
            },
            "name": "Request Budget",
            "value": "61 requests — within the budget of 80",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab",
              "measured": "61 requests"
            },
            "confidence": "high",
            "whyMatters": "Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed."
          },
          {
            "i18n": {
              "key": "perf.third-party-budget.info"
            },
            "name": "Third-party Services",
            "value": "Not measured — PageSpeed did not return the third-party audit for this URL",
            "status": "info",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Re-run the scan, or check the third-party summary directly at PageSpeed Insights.",
            "whyMatters": "We report this as unmeasured rather than as zero third parties, because those are very different findings."
          },
          {
            "i18n": {
              "key": "perf.render-blocking.info"
            },
            "name": "Render-blocking Resources",
            "value": "Not measured — PageSpeed did not return the render-blocking audit for this URL",
            "status": "info",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run."
          },
          {
            "i18n": {
              "key": "perf.unused-code.fail",
              "params": {
                "kb": 521
              }
            },
            "name": "Unused Code (CSS + JS)",
            "value": "521 KB wasted on unused code!",
            "status": "fail",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "You're loading 521 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.",
            "whyMatters": "Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs."
          },
          {
            "i18n": {
              "key": "perf.text-compression.pass"
            },
            "name": "Text Compression (gzip/brotli)",
            "value": "All text resources properly compressed",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "perf.resource-hints.pass",
              "params": {
                "preload": 1,
                "preconnect": 2
              }
            },
            "name": "Resource Hints (Preload/Preconnect)",
            "value": "1 preload, 2 preconnect hint(s)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.lazy-load.pass",
              "params": {
                "lazy": 75,
                "rate": 82,
                "total": 92
              }
            },
            "name": "Lazy Loading",
            "value": "82% of images use native lazy loading (75/92)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.font-display.pass",
              "params": {
                "value": "swap"
              }
            },
            "name": "Font Loading Strategy",
            "value": "font-display set in external stylesheet",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.script-strategy.warning",
              "params": {
                "rate": 58,
                "total": 12
              }
            },
            "name": "Script Loading Strategy",
            "value": "Only 58% of 12 scripts use async/defer",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add 'defer' to scripts that don't need to run immediately, 'async' for independent scripts. Use type='module' for modern ES modules. Only critical inline scripts should be synchronous.",
            "whyMatters": "Synchronous scripts block HTML parsing — the browser stops rendering until each script downloads and executes. Async/defer allows parallel downloading without blocking."
          },
          {
            "i18n": {
              "key": "perf.css-count.fail",
              "params": {
                "count": 11
              }
            },
            "name": "CSS File Count",
            "value": "11 CSS files — too many!",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Bundle your CSS files into 1-3 files maximum. Use a build tool (Webpack, Vite, Gulp) to concatenate and minify. Critical CSS should be inlined, the rest deferred.",
            "whyMatters": "Each CSS file blocks rendering. With 11 files, the browser must download all of them before painting anything. This can add 1-2+ seconds on mobile networks."
          },
          {
            "i18n": {
              "key": "perf.font-preload.warning"
            },
            "name": "Font Preloading",
            "value": "Custom fonts detected without preload hints",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.",
            "whyMatters": "Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms."
          },
          {
            "i18n": {
              "key": "perf.critical-css.warning",
              "params": {
                "count": 11
              }
            },
            "name": "Critical CSS Strategy",
            "value": "11 CSS files without critical CSS extraction",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel=\"stylesheet\"'>.",
            "whyMatters": "Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites."
          },
          {
            "i18n": {
              "key": "perf.connection-hints.warning",
              "params": {
                "count": 7,
                "domains": "consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net"
              }
            },
            "name": "Connection Hint Coverage",
            "value": "7 external domains without preconnect",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Add <link rel='preconnect'> for key third-party domains: consent.cookiebot.com, code.jquery.com, cdn.jsdelivr.net. Preconnect saves 100-300ms per domain by starting DNS+TCP+TLS early.",
            "whyMatters": "Third-party connections require DNS lookup, TCP handshake, and TLS negotiation. Preconnect performs these in parallel with HTML parsing, saving 100-300ms per origin."
          }
        ]
      },
      "ai_readiness": {
        "score": 71,
        "checks": [
          {
            "i18n": {
              "key": "air.bot-access.pass",
              "params": {
                "detail": "No AI bot restrictions (allowed by default)"
              }
            },
            "name": "AI Bot Access Policy",
            "value": "No AI bot restrictions (allowed by default)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "air.agent-live.pass"
            },
            "name": "AI Agent Access (live)",
            "value": "ChatGPT-User and PerplexityBot get the same page as a browser",
            "status": "pass",
            "weight": 2,
            "evidence": {
              "source": "file-probe",
              "measured": "ChatGPT-User, PerplexityBot: same page as a browser",
              "probedUrl": "https://kagency.com"
            }
          },
          {
            "i18n": {
              "key": "air.llms-txt.pass",
              "params": {
                "chars": 4000,
                "extras": "H1, links, summary"
              }
            },
            "name": "llms.txt (AI Site Descriptor)",
            "value": "Present (4000 chars, H1, links, summary) — informational; no engine consumes it for citation",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md."
          },
          {
            "i18n": {
              "key": "air.llms-full.warning"
            },
            "name": "llms-full.txt (Complete AI Content)",
            "value": "Not present — not required for AI visibility",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md."
          },
          {
            "i18n": {
              "key": "air.content-access.pass",
              "params": {
                "ratio": "13.8",
                "words": 1983
              }
            },
            "name": "Content Accessibility for AI",
            "value": "1983 words in raw HTML (13.8% text ratio) — readable by AI crawlers without executing JS",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.schema-foundation.warning-multi",
              "params": {
                "note": "",
                "count": 2,
                "types": "WebSite, ProfessionalService"
              }
            },
            "name": "Structured Data Foundation",
            "value": "2 distinct schema types (WebSite, ProfessionalService) — add more for comprehensive AI coverage",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Expand your structured data with genuinely different types: Organization, Product, BreadcrumbList, WebSite with SearchAction, and FAQPage. Adding synonyms of the same entity (Store + LocalBusiness + Organization) does not help — variety of meaning does.",
            "whyMatters": "AI assistants (ChatGPT, Perplexity, Google AI Overviews) synthesize answers from structured data. Comprehensive schema markup makes your store easier to cite."
          },
          {
            "i18n": {
              "key": "air.org-schema.fail"
            },
            "name": "Organization Schema + Entity Linking",
            "status": "fail",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).",
            "whyMatters": "Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel."
          },
          {
            "i18n": {
              "key": "air.faq-schema.warning"
            },
            "name": "FAQ Schema (Direct AI Answers)",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).",
            "whyMatters": "ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI."
          },
          {
            "i18n": {
              "key": "air.sitesearch.pass"
            },
            "name": "Site Search Schema (SearchAction)",
            "value": "WebSite SearchAction configured — AI can search your store",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "air.content-depth.pass",
              "params": {
                "words": 1983
              }
            },
            "name": "Content Depth for AI",
            "value": "1983 words — rich content for AI analysis and citation",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.answer-first.pass",
              "params": {
                "words": 37
              }
            },
            "name": "Answer-First Content Format",
            "value": "First paragraph: 37 words — good content density above the fold",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.headings.pass",
              "params": {
                "h2": 10,
                "h3": 56
              }
            },
            "name": "Heading Hierarchy for AI",
            "value": "Proper structure: 1 H1 → 10 H2s → 56 H3s — clear content outline",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.semantic-html.pass",
              "params": {
                "count": 4,
                "elements": "<nav>, <main>, <header>, <footer>"
              }
            },
            "name": "Semantic HTML Structure",
            "value": "4/6 semantic elements: <nav>, <main>, <header>, <footer>",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.structured-content.warning-partial",
              "params": {
                "what": "13 lists",
                "missing": "comparison tables"
              }
            },
            "name": "Structured Content (Lists & Tables)",
            "value": "13 lists found — consider adding comparison tables",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.",
            "whyMatters": "AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text."
          },
          {
            "i18n": {
              "key": "air.freshness.fail"
            },
            "name": "Content Freshness Signals",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.",
            "whyMatters": "With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages."
          },
          {
            "i18n": {
              "key": "air.entity-clarity.warning-noog",
              "params": {
                "count": 2
              }
            },
            "name": "Entity Clarity & Brand Signals",
            "value": "2 sameAs links but incomplete OG tags",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "For full entity clarity: 1) Complete Open Graph tags (og:title, og:description, og:image, og:type), 2) Add sameAs in Organization schema linking to Wikipedia, LinkedIn, Facebook, and other profiles.",
            "whyMatters": "AI needs to confidently identify your brand entity. Open Graph and sameAs together create a cross-platform identity that AI models recognize."
          },
          {
            "i18n": {
              "key": "air.eeat.warning-noarticle"
            },
            "name": "Author Expertise Signals (E-E-A-T)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.",
            "whyMatters": "AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content."
          },
          {
            "i18n": {
              "key": "air.extractable.warning-short",
              "params": {
                "avg": 19,
                "count": 43
              }
            },
            "name": "Extractable Answer Blocks",
            "value": "43 paragraphs, avg 19 words — too short for citation",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.",
            "whyMatters": "AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable."
          },
          {
            "i18n": {
              "key": "air.statistics.warning-none"
            },
            "name": "Statistics & Data Presence",
            "value": "No statistical data found in content",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.",
            "whyMatters": "Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics."
          },
          {
            "i18n": {
              "key": "air.section-length.warning",
              "params": {
                "avg": 42,
                "ratio": 14
              }
            },
            "name": "Section Length Optimization",
            "value": "Avg section: 42 words — only 14% in 80-200 word optimal range",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.",
            "whyMatters": "For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance."
          },
          {
            "i18n": {
              "key": "air.qa-headings.warning-some",
              "params": {
                "count": 1
              }
            },
            "name": "Q&A Format Headings",
            "value": "1 question heading(s) — add more",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Phrase H2/H3 headings as questions: 'How does...?', 'What is...?', 'Why should...?' followed by a direct 1-2 sentence answer. This is a leading format AI assistants use to generate responses.",
            "whyMatters": "AI search engines like Perplexity and ChatGPT match user questions to heading-answer pairs. Q&A format headings are directly extractable by AI and trigger FAQ-style rich results."
          },
          {
            "i18n": {
              "key": "air.internal-links.pass",
              "params": {
                "rate": 39
              }
            },
            "name": "Internal Link Density",
            "value": "39 contextual internal links per 1,000 words — strong knowledge graph signal",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.canonical.warning-different",
              "params": {
                "url": "https://www.kagency.com/"
              }
            },
            "name": "Canonical Tag for AI Deduplication",
            "value": "Canonical points to different URL: https://www.kagency.com/",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.",
            "whyMatters": "AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely."
          },
          {
            "i18n": {
              "key": "air.kg-readiness.warning",
              "params": {
                "count": 1,
                "missing": "@id in JSON-LD, consistent brand name (title/schema/OG), Organization schema"
              }
            },
            "name": "Knowledge Graph Readiness",
            "value": "1/4 signals — missing: @id in JSON-LD, consistent brand name (title/schema/OG), Organization schema",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add: @id in JSON-LD, consistent brand name (title/schema/OG), Organization schema. Use @id in JSON-LD to create a unique node identifier. Ensure your brand name is identical in title, schema, and OG tags. Link to Wikipedia/Wikidata via sameAs.",
            "whyMatters": "@id creates a persistent entity identifier that connects your schema across pages and platforms, which is how AI builds a verified brand entity."
          },
          {
            "i18n": {
              "key": "air.readability.warning-high-technical",
              "params": {
                "grade": 20
              }
            },
            "name": "Content Readability for AI",
            "value": "Grade 20 — too complex for broad AI citation (technical threshold: 14)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.",
            "whyMatters": "Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often."
          },
          {
            "i18n": {
              "key": "air.alt-text.warning",
              "params": {
                "pct": 66,
                "poor": 30,
                "missing": 0
              }
            },
            "name": "Image Alt Text Quality for AI",
            "value": "66% good, 30 poor, 0 missing",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Improve alt text: use 3-15 descriptive words per image. Include product name, key feature, and context. Bad: 'image1' or 'photo'. Good: 'Red leather wallet with RFID protection — front view'.",
            "whyMatters": "AI uses alt text to understand images for visual search (Google Lens, Bing Visual Search), product recommendations, and accessibility. Quality alt text opens more discovery channels."
          },
          {
            "i18n": {
              "key": "air.expert-quotes.pass",
              "params": {
                "count": 29
              }
            },
            "name": "Expert Quotations & Citations",
            "value": "29 blockquotes/citations found — strong authority signal",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.ai-txt.warning"
            },
            "name": "ai.txt (AI Permissions)",
            "value": "Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "ai.txt is an emerging fine-grained AI-permissions proposal not yet honored by the major engines. The robots.txt AI-bot rules are the signal that actually gates crawler access."
          },
          {
            "i18n": {
              "key": "air.webmcp.warning"
            },
            "name": "WebMCP Agentic Readiness",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.",
            "whyMatters": "WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard."
          },
          {
            "i18n": {
              "key": "air.boilerplate.pass",
              "params": {
                "ratio": 88
              }
            },
            "name": "Content-to-Boilerplate Ratio",
            "value": "88% of text in <main>/<article> — clean content signal",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.social-proof.pass",
              "params": {
                "signals": "testimonials, case studies / portfolio, 29 quotations"
              }
            },
            "name": "Social Proof (Testimonials / Case Studies)",
            "value": "Strong social proof: testimonials, case studies / portfolio, 29 quotations",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          }
        ]
      },
      "phaseTimings": {
        "tail": 33,
        "total": 972,
        "phase1": 422,
        "preflight": 256,
        "phase1.dns": 199,
        "phase1.html": 200,
        "phase1.files": 420,
        "phase1.zbozi": 151,
        "phase1.headers": 153,
        "phase1.heureka": 151,
        "phase1.aiAgents": 165,
        "phase1.merchant": 150
      },
      "accessibility": {
        "score": 96,
        "checks": [
          {
            "i18n": {
              "key": "a11y.lang.pass",
              "params": {
                "lang": "fr"
              }
            },
            "name": "Page Language",
            "value": "<html lang=\"fr\"> is set",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.alt.pass",
              "params": {
                "total": 92
              }
            },
            "name": "Image Alt Text",
            "value": "All 92 images have alt attributes",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.forms.pass",
              "params": {
                "total": 6
              }
            },
            "name": "Form Labels",
            "value": "All 6 form inputs are labelled",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.headings.pass"
            },
            "name": "Heading Structure",
            "value": "Single <h1> with a consistent heading outline",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.links.pass"
            },
            "name": "Link Text",
            "value": "Links use descriptive text",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "confidence": "low"
          },
          {
            "i18n": {
              "key": "a11y.landmarks.pass"
            },
            "name": "Landmark Regions",
            "value": "Semantic landmarks present (<main>, <nav>/<header>)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.zoom.pass"
            },
            "name": "Zoom & Scaling",
            "value": "Pinch-zoom is not disabled",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.skiplink.missing"
            },
            "name": "Skip Link",
            "value": "No skip-to-content link detected",
            "status": "warning",
            "weight": 1,
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a visually-hidden \"Skip to content\" link as the first focusable element, targeting <main id=\"main\">.",
            "legalRefs": {
              "gdpr": [],
              "czLaw": [
                "§ 4 zák. 424/2023"
              ],
              "skLaw": [
                "§ 4 zák. 351/2022"
              ],
              "verified": [
                {
                  "act": "351/2022",
                  "excerpt": "§ 4 — (1) Ak odseky 2 až 4 neustanovujú inak, poskytovaná služba musí spĺňať ustanovené požiadavky na prístupnosť služby pre osoby so zdravotným postihnutím; ak ide o výrobky použité na poskytnutie služby, požiadavky na prístupnosť výrobkov",
                  "citation": "§4 zákona č. 351/2022 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "424/2023",
                  "title": "Požadavky na přístupnost a volný pohyb",
                  "excerpt": "§ 4 Požadavky na přístupnost a volný pohyb (1) Požadavky na přístupnost výrobků podle § 2 odst. 1 stanoví příloha č. 1 oddíly I a II. (2) Požadavky na přístupnost služeb podle § 2 odst. 2 stanoví příloha č. 1 oddíly III a IV.",
                  "citation": "§4 zákona č. 424/2023 Sb.",
                  "jurisdiction": "cz"
                }
              ]
            },
            "confidence": "low",
            "whyMatters": "Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1)."
          },
          {
            "i18n": {
              "key": "a11y.legal-basis"
            },
            "name": "EAA Legal Basis",
            "value": "In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.",
            "status": "info",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "howToFix": "",
            "isUpsell": true,
            "legalRefs": {
              "gdpr": [],
              "czLaw": [
                "§ 4 zák. 424/2023"
              ],
              "skLaw": [
                "§ 4 zák. 351/2022",
                "§ 5 zák. 351/2022"
              ],
              "verified": [
                {
                  "act": "351/2022",
                  "excerpt": "§ 4 — (1) Ak odseky 2 až 4 neustanovujú inak, poskytovaná služba musí spĺňať ustanovené požiadavky na prístupnosť služby pre osoby so zdravotným postihnutím; ak ide o výrobky použité na poskytnutie služby, požiadavky na prístupnosť výrobkov",
                  "citation": "§4 zákona č. 351/2022 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "351/2022",
                  "excerpt": "§ 5 — (1) Ak ustanovené požiadavky na prístupnosť služby pre osoby so zdravotným postihnutím nezahŕňajú jednu alebo viac funkcií vyplývajúcich z poskytovania služby, tieto funkcie musia byť prístupné na základe dodržiavania ustanovených kri",
                  "citation": "§5 zákona č. 351/2022 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "424/2023",
                  "title": "Požadavky na přístupnost a volný pohyb",
                  "excerpt": "§ 4 Požadavky na přístupnost a volný pohyb (1) Požadavky na přístupnost výrobků podle § 2 odst. 1 stanoví příloha č. 1 oddíly I a II. (2) Požadavky na přístupnost služeb podle § 2 odst. 2 stanoví příloha č. 1 oddíly III a IV.",
                  "citation": "§4 zákona č. 424/2023 Sb.",
                  "jurisdiction": "cz"
                }
              ]
            },
            "whyMatters": ""
          }
        ]
      },
      "vulnerability": {
        "score": 88,
        "checks": [
          {
            "i18n": {
              "key": "vuln.cms-version.pass"
            },
            "name": "CMS Version Disclosure",
            "value": "No generator tag — CMS identity hidden",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.sensitive-files.pass"
            },
            "name": "Sensitive Files Exposed",
            "value": ".env, .git, composer.json — all properly blocked",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.install-script.pass"
            },
            "name": "Install Script Exposed",
            "value": "No /install/ or /setup/ paths accessible",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.directory-listing.pass"
            },
            "name": "Directory Listing",
            "value": "Disabled — file structure hidden",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.admin-url.pass"
            },
            "name": "Admin Panel at Default URL",
            "value": "Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.debug-mode.pass"
            },
            "name": "Debug Mode / Error Exposure",
            "value": "No debug indicators found in page output",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.jquery.pass",
              "params": {
                "version": "3.7.1"
              }
            },
            "name": "jQuery Version",
            "value": "jQuery 3.7.1",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.csrf.fail",
              "params": {
                "count": 1
              }
            },
            "name": "Form CSRF Protection",
            "value": "1 form(s) without CSRF tokens",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.",
            "confidence": "low",
            "whyMatters": "CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session."
          },
          {
            "i18n": {
              "key": "vuln.package-json.warning"
            },
            "name": "package.json Exposed",
            "value": "package.json accessible — reveals all dependencies and versions",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Block access to package.json via .htaccess or server config. It should never be served to the public.",
            "whyMatters": "package.json reveals your exact dependency versions, allowing attackers to search for known CVEs in each library. It's a complete vulnerability roadmap."
          },
          {
            "i18n": {
              "key": "vuln.spf.pass",
              "params": {
                "record": "v=spf1 a:spf-senders.oceamail.com ip4:80.74.68.89 ip4:80.74.64.0/24 ip4:80.74.78"
              }
            },
            "name": "SPF Record (Email Security)",
            "value": "SPF configured: v=spf1 a:spf-senders.oceamail.com ip4:80.74.68.89 ip4:80.74.64.0/24 ip4:80.74.78",
            "status": "pass",
            "evidence": {
              "source": "DNS"
            }
          },
          {
            "i18n": {
              "key": "vuln.dmarc.warning-none"
            },
            "name": "DMARC Policy (Email Auth)",
            "value": "DMARC set to p=none (monitoring only, no enforcement)",
            "status": "warning",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Upgrade DMARC policy from p=none to p=quarantine or p=reject. p=none only monitors — it doesn't block spoofed emails. Start with quarantine, then move to reject after verifying legitimate emails pass.",
            "whyMatters": "DMARC p=none provides zero protection against email spoofing. It only generates reports. Move to p=quarantine to actually block forged emails from reaching your customers' inboxes."
          },
          {
            "i18n": {
              "key": "vuln.dkim.pass",
              "params": {
                "selectors": "default"
              }
            },
            "name": "DKIM Signing (Email Auth)",
            "value": "DKIM configured (selectors: default)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.cross-origin.warning"
            },
            "name": "Cross-Origin Isolation",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.",
            "whyMatters": "Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers."
          }
        ]
      },
      "executive_summary": {
        "en": "Your store performs well overall, but needs attention to security and AI readiness. Add CSRF protection to forms immediately. Your accessibility and SEO are excellent.",
        "sk": "Váš web funguje solídne, ale má rezervy v bezpečnosti a AI pripravnosti. Prioritne pridajte CSRF ochranu do formulárov. Výborná je vaša prístupnosť a SEO."
      },
      "opendata_security": null,
      "platform_evidence": [],
      "maintenance_bypass": false,
      "scanner_token_sent": false
    },
    "created_at": "2026-10-08T19:46:24.374756+00:00",
    "status": "complete",
    "platform_detected": null,
    "company_ico": null,
    "company_name": null,
    "company_country": null,
    "company_nace": null,
    "company_size": null,
    "nis2_scope": null,
    "nis2_sector": null,
    "company_risk_score": null,
    "company_risk_level": null
  }
}