{
  "data": {
    "slug": "90a62213",
    "url": "https://luigisbox.sk",
    "domain": "luigisbox.sk",
    "overall_score": 78,
    "scores_json": {
      "seo": {
        "score": 88,
        "checks": [
          {
            "i18n": {
              "key": "seo.meta-title.warning-long",
              "params": {
                "chars": 70
              }
            },
            "name": "Meta Title",
            "value": "70 chars (optimal: 30-60)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Shorten your title to under 60 characters. Google truncates longer titles with '…', which cuts off your message.",
            "whyMatters": "Truncated titles lower click-through rate because the searcher never sees the full message."
          },
          {
            "i18n": {
              "key": "seo.meta-desc.pass",
              "params": {
                "chars": 137
              }
            },
            "name": "Meta Description",
            "value": "137 chars",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.h1.pass",
              "params": {
                "text": "Pre výnimočné vyhľadávanie a odporúčanie produktov"
              }
            },
            "name": "H1 Heading",
            "value": "\"Pre výnimočné vyhľadávanie a odporúčanie produktov\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.h2.pass",
              "params": {
                "count": 9
              }
            },
            "name": "Content Structure (H2 Headings)",
            "value": "9 H2 subheadings found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.og.pass",
              "params": {
                "tags": "og:title, og:description, og:image, og:type"
              }
            },
            "name": "Open Graph Tags",
            "value": "og:title, og:description, og:image, og:type",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.og-format.pass",
              "params": {
                "contentType": "image/webp"
              }
            },
            "name": "Open Graph Image Format",
            "value": "image/webp",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.twitter.pass",
              "params": {
                "card": "summary_large_image"
              }
            },
            "name": "Twitter/X Cards",
            "value": "Card type: summary_large_image",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.canonical.pass",
              "params": {
                "url": "https://www.luigisbox.sk/"
              }
            },
            "name": "Canonical URL",
            "value": "https://www.luigisbox.sk/",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.jsonld.pass",
              "params": {
                "count": 3,
                "types": "Place, PostalAddress, Organization, ImageObject"
              }
            },
            "name": "Structured Data (JSON-LD)",
            "value": "3 block(s): Place, PostalAddress, Organization, ImageObject",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "seo.jsonld-valid.pass",
              "params": {
                "count": 3
              }
            },
            "name": "JSON-LD Validity",
            "value": "3 block(s) parse cleanly",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.robots.pass-sitemap"
            },
            "name": "robots.txt",
            "value": "Present, references sitemap",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.sitemap.unverified"
            },
            "name": "XML Sitemap",
            "value": "Could not be retrieved in time — not verified",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Check /sitemap.xml yourself. If it is generated on every request, cache it to a static file: a sitemap that takes seconds to build is also slow for Googlebot, which fetches it regularly.",
            "whyMatters": "We could not confirm either way within the probe budget, so this is not a finding about your sitemap — it is a note that the check did not complete. A slow-to-generate sitemap is worth caching regardless."
          },
          {
            "i18n": {
              "key": "seo.html-lang.pass",
              "params": {
                "lang": "sk-SK"
              }
            },
            "name": "HTML Language Attribute",
            "value": "lang=\"sk-SK\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.hreflang.pass",
              "params": {
                "count": 10,
                "langs": "en, sk, cs, pl, de"
              }
            },
            "name": "Hreflang Tags (Multilingual)",
            "value": "10 language(s): en, sk, cs, pl, de",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.img-alt.pass",
              "params": {
                "rate": 100,
                "total": 425
              }
            },
            "name": "Image Alt Attributes",
            "value": "100% of 425 images have alt text",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.meta-robots.pass",
              "params": {
                "value": "follow, index, max-snippet:-1, max-video-preview:-1, max-image-preview:large"
              }
            },
            "name": "Meta Robots Tag",
            "value": "follow, index, max-snippet:-1, max-video-preview:-1, max-image-preview:large",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.text-ratio.info",
              "params": {
                "ratio": 2,
                "words": 1801
              }
            },
            "name": "Text-to-HTML Ratio",
            "value": "2% ratio but 1801 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.",
            "whyMatters": "Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on."
          },
          {
            "i18n": {
              "key": "seo.favicon.pass"
            },
            "name": "Favicon",
            "value": "Favicon detected",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.img-format.warning-partial",
              "params": {
                "rate": 10,
                "legacy": 2
              }
            },
            "name": "Image Format Optimization",
            "value": "Only 10% next-gen formats — 2 legacy images remain",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.",
            "whyMatters": "WebP/AVIF images are 30-70% smaller than JPEG/PNG at the same quality. This directly improves page speed, LCP, and mobile experience."
          },
          {
            "i18n": {
              "key": "seo.semantic.pass",
              "params": {
                "used": "<nav>, <main>, <header>, <footer>",
                "count": 4
              }
            },
            "name": "Semantic HTML Structure",
            "value": "4/6 semantic elements: <nav>, <main>, <header>, <footer>",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.canonical-consistency.warning",
              "params": {
                "url": "https://www.luigisbox.sk/"
              }
            },
            "name": "Canonical URL Consistency",
            "value": "Canonical points to different URL: https://www.luigisbox.sk/",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your canonical URL doesn't match the current page URL. Ensure the canonical points to the preferred version (with or without trailing slash, www vs non-www). Inconsistent canonicals confuse search engines.",
            "whyMatters": "A mismatched canonical tells Google this page is a duplicate of another URL. If unintentional, Google may ignore this page entirely in favor of the canonical target."
          },
          {
            "i18n": {
              "key": "seo.content-depth.pass",
              "params": {
                "words": 1801
              }
            },
            "name": "Content Depth",
            "value": "1801 words — sufficient content",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.deep-heading.pass",
              "params": {
                "h2": 9,
                "h3": 34
              }
            },
            "name": "Deep Heading Hierarchy",
            "value": "H2: 9, H3: 34 — well-structured content",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.internal-links.pass",
              "params": {
                "count": 20
              }
            },
            "name": "Internal Linking",
            "value": "20 internal links — strong site navigation",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.dead-links.warning",
              "params": {
                "hash": 10,
                "empty": 0,
                "total": 10,
                "jsvoid": 0
              }
            },
            "name": "Empty/Dead Links",
            "value": "10 dead links (0 empty, 10 hash-only, 0 javascript:void)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Replace empty href='', href='#', and href='javascript:void(0)' with actual URLs. If interactive, use <button> instead of <a>.",
            "whyMatters": "Dead links waste crawl budget and confuse search engines. They also create poor user experience — users click expecting navigation and nothing happens."
          },
          {
            "i18n": {
              "key": "seo.a11y.pass",
              "params": {
                "detail": "1 ARIA roles, 9 ARIA labels, lang=\"sk-SK\"",
                "signals": 3
              }
            },
            "name": "Accessibility Fundamentals",
            "value": "3/4 a11y signals: 1 ARIA roles, 9 ARIA labels, lang=\"sk-SK\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.sitemap-host.warning",
              "params": {
                "pageHost": "luigisbox.sk",
                "sitemapHost": "www.luigisbox.com"
              }
            },
            "name": "Sitemap Host Consistency",
            "value": "robots.txt Sitemap points to www.luigisbox.com (page is luigisbox.sk)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Update the Sitemap: line in robots.txt to your canonical host. A staging/dev hostname (new., staging., dev.) leaks pre-production to Google and feeds crawlers URLs that 404 or duplicate the live site.",
            "whyMatters": "Google fetches the sitemap from the host declared in robots.txt. A staging domain there either exposes an environment that must not be indexed, or sends every crawl to the wrong host — splitting ranking signals and burning crawl budget."
          }
        ]
      },
      "gdpr": {
        "score": 81,
        "checks": [
          {
            "i18n": {
              "key": "gdpr.cmp.info",
              "params": {
                "gtmNote": " A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML."
              }
            },
            "name": "Cookie Consent Banner (CMP)",
            "value": "No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic",
              "measured": "1 GTM container(s) detected"
            },
            "howToFix": "Confirm a consent management platform actually loads and blocks non-essential cookies until opt-in. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "confidence": "low",
            "whyMatters": "EU regulators enforce cookie consent (CNIL fined Google €150M). If the CMP is GTM-injected this scan can't confirm it — verify manually."
          },
          {
            "i18n": {
              "key": "gdpr.tracking.info",
              "params": {
                "count": 2,
                "gtmNote": " A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.",
                "trackers": "Google Analytics/GTM, Microsoft Clarity"
              }
            },
            "name": "Tracking Scripts & Consent",
            "value": "2 tracker(s) detected (Google Analytics/GTM, Microsoft Clarity); no CMP visible in server HTML but GTM is present",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic",
              "measured": "1 GTM container(s) detected"
            },
            "howToFix": "Confirm these trackers are gated behind consent (GTM consent mode / CMP script blocking) before they fire. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "EDPB Opinion 5/2019"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "confidence": "low",
            "whyMatters": "Loading tracking before consent is a direct GDPR/ePrivacy violation, but GTM-managed consent gating isn't visible server-side — verify in the browser."
          },
          {
            "i18n": {
              "key": "gdpr.consent-mode.pass"
            },
            "name": "Google Consent Mode v2",
            "value": "Consent mode signals detected (ad_storage, analytics_storage)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.privacy-policy.pass",
              "params": {
                "url": "https://www.luigisbox.sk/zasady-ochrany-osobnych-udajov/"
              }
            },
            "name": "Privacy Policy Page",
            "value": "https://www.luigisbox.sk/zasady-ochrany-osobnych-udajov/",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13",
                "Art. 14"
              ],
              "skLaw": [
                "§ 19",
                "§ 20"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 14 — Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby 2. Okrem informácií uvedených v odseku 1 prevádzkovateľ poskytne dotknutej osobe tieto ďalšie informácie potrebné na zabezpečenie spravodliv",
                  "citation": "čl. 14 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "18/2018",
                  "title": "Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby",
                  "excerpt": "§ 20 Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby (5) d) ak osobné údaje musia zostať dôverné na základe povinnosti mlčanlivosti podľa osobitného predpisu. 15 )",
                  "citation": "§20 ods. 5 písm. d) zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.cookie-policy.warning"
            },
            "name": "Cookie Policy",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.",
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13(1)(c)-(e)"
              ],
              "skLaw": [
                "§ 19"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement."
          },
          {
            "i18n": {
              "key": "gdpr.imprint.pass",
              "params": {
                "url": "https://www.luigisbox.sk/o-nas/"
              }
            },
            "name": "Legal Contact / Imprint Page",
            "value": "https://www.luigisbox.sk/o-nas/",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.terms.warning"
            },
            "name": "Terms & Conditions Page",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Create Terms & Conditions (AGB) covering: ordering process, payment, delivery, returns, warranty, and dispute resolution. Link it from the footer and checkout.",
            "whyMatters": "EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights."
          },
          {
            "i18n": {
              "key": "gdpr.mixed-content.pass"
            },
            "name": "Data Encryption (No Mixed Content)",
            "value": "All resources loaded over HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.third-party.pass",
              "params": {
                "count": 2
              }
            },
            "name": "Third-party Data Sharing",
            "value": "2 third-party domain(s)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.intl-transfers.warning",
              "params": {
                "count": 2,
                "trackers": "Google Analytics/GTM, Microsoft Clarity"
              }
            },
            "name": "International Data Transfers",
            "value": "2 US-based tracker(s) without consent: Google Analytics/GTM, Microsoft Clarity",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.",
            "whyMatters": "The EU-US Data Privacy Framework covers some transfers, but loading US trackers without consent remains a violation. Austrian and French DPAs have ruled Google Analytics non-compliant without proper safeguards."
          },
          {
            "i18n": {
              "key": "gdpr.erasure.warning"
            },
            "name": "Right to Erasure (Data Deletion)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.",
            "legalRefs": {
              "gdpr": [
                "Art. 17"
              ],
              "skLaw": [
                "§ 23"
              ],
              "verified": [
                {
                  "title": "Právo na vymazanie (právo „na zabudnutie“)",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 17 — Právo na vymazanie (právo „na zabudnutie“) 1. Dotknutá osoba má tiež právo dosiahnuť u prevádzkovateľa bez zbytočného odkladu vymazanie osobných údajov, ktoré sa jej týkajú, a prevádzkovateľ je povinný bez zbytočného odkladu vy",
                  "citation": "čl. 17 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Právo na výmaz osobných údajov",
                  "excerpt": "§ 23 Právo na výmaz osobných údajov (1) Dotknutá osoba má právo na to, aby prevádzkovateľ bez zbytočného odkladu vymazal osobné údaje, ktoré sa jej týkajú.",
                  "citation": "§23 ods. 1 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding."
          },
          {
            "i18n": {
              "key": "gdpr.newsletter.warning"
            },
            "name": "Newsletter Consent",
            "value": "Newsletter signup found without visible consent checkbox",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "ePrivacy Art. 13"
              ],
              "skLaw": [
                "§ 14",
                "§ 109 zák. 452/2021"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "452/2021",
                  "title": "—",
                  "excerpt": "§ 109 — (8) Každý, kto ukladá alebo získava prístup k informáciám uloženým v koncovom zariadení užívateľa, je na to oprávnený iba ak užívateľ udelil preukázateľný súhlas spĺňajúci náležitosti podľa osobitného predpisu. 126 ) Povinnosť získa",
                  "citation": "§109 ods. 8 zákona č. 452/2021 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR requires 'freely given, specific, informed' consent for marketing emails. A newsletter form without explicit opt-in violates Article 7, and pre-checked boxes are not valid consent."
          },
          {
            "i18n": {
              "key": "gdpr.dpo.pass"
            },
            "name": "Data Protection Officer Contact",
            "value": "DPO / data protection contact found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.withdrawal.pass"
            },
            "name": "Withdrawal of Consent Mechanism",
            "value": "Consent withdrawal / opt-out mechanism found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 7(3)"
              ],
              "skLaw": [
                "§ 14(4)"
              ],
              "verified": [
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "act": "18/2018",
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          }
        ]
      },
      "nis2": {
        "score": -1,
        "checks": [
          {
            "i18n": {
              "key": "nis2.scope.unknown"
            },
            "name": "NIS2 Compliance",
            "value": "Scope undetermined — IČO/company enrichment unavailable for this domain.",
            "status": "info",
            "howToFix": "",
            "whyMatters": ""
          }
        ]
      },
      "mobile": {
        "score": 85,
        "checks": [
          {
            "i18n": {
              "key": "mob.viewport.pass"
            },
            "name": "Viewport Configuration",
            "value": "width=device-width, initial-scale=1",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.perf.pass",
              "params": {
                "score": 90
              }
            },
            "name": "Mobile Performance Score",
            "value": "90/100 — excellent",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "mob.taptarget.warning",
              "params": {
                "detail": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)"
              }
            },
            "name": "Touch Target Size",
            "value": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)"
            },
            "howToFix": "Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.",
            "whyMatters": "Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue."
          },
          {
            "i18n": {
              "key": "mob.fontsize.warning",
              "params": {
                "detail": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)"
              }
            },
            "name": "Font Size Readability",
            "value": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)"
            },
            "howToFix": "Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.",
            "whyMatters": "Text below the legibility threshold forces mobile users to pinch-zoom. This measures the actual rendered page (Lighthouse), so it catches sub-12px nodes even when the base font looks fine."
          },
          {
            "i18n": {
              "key": "mob.contentwidth.pass"
            },
            "name": "Content Fits Viewport",
            "value": "No horizontal scrolling needed",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.responsive.pass",
              "params": {
                "techniques": "Flexbox, CSS Grid, Media queries"
              }
            },
            "name": "Responsive Design Techniques",
            "value": "Flexbox, CSS Grid, Media queries detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.themecolor.warning"
            },
            "name": "Theme Color",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.",
            "whyMatters": "Theme-color creates a polished, branded mobile experience. It makes your site look native and professional."
          },
          {
            "i18n": {
              "key": "mob.nav.pass"
            },
            "name": "Mobile Navigation (Semantic)",
            "value": "<nav> element present — proper navigation landmark",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.inlinecss.warning",
              "params": {
                "kb": 340
              }
            },
            "name": "Inline CSS Size",
            "value": "340 KB of inline CSS",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.",
            "whyMatters": "Large inline CSS blocks increase initial HTML download and parsing time — especially painful on mobile with limited CPU and slower connections."
          },
          {
            "i18n": {
              "key": "mob.srcset.pass",
              "params": {
                "count": 48
              }
            },
            "name": "Responsive Images (srcset)",
            "value": "48 image(s) use srcset for responsive sizing",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.inputtypes.pass",
              "params": {
                "optimized": "1 email"
              }
            },
            "name": "Form Input Types",
            "value": "Optimized: 1 email",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.wcaglabels.fail",
              "params": {
                "rate": 0,
                "total": 7,
                "missing": 7,
                "withLabel": 0
              }
            },
            "name": "Form Input Labels (WCAG 3.3.2)",
            "value": "Only 0/7 inputs have a label (0%)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "7 input elements have no label. Every input needs a matching <label for=\"id\">Text</label> or an aria-label. A placeholder is NOT a label (WCAG 3.3.2). On a checkout or registration form this costs conversion and breaches EN 301 549 (EAA 2026).",
            "whyMatters": "The European Accessibility Act applies from 28 June 2025. Shops above 10 employees or €2M turnover must meet WCAG 2.1 AA — missing labels are among the most commonly actionable failures."
          },
          {
            "i18n": {
              "key": "mob.wcagheading.pass"
            },
            "name": "Heading Hierarchy (WCAG 1.3.1)",
            "value": "No skipped heading levels",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.wcaglinks.warning",
              "params": {
                "count": 1
              }
            },
            "name": "Link Text Quality (WCAG 2.4.4)",
            "value": "1 links have generic text (\"click here\", \"more\", \"here\"...)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Replace 'Click here' and 'Read more' with descriptive text: 'Read more about GDPR', 'See module pricing'. Screen readers read links out of context, so a bare 'more' carries no meaning.",
            "whyMatters": "WCAG 2.4.4: the purpose of a link must be clear from its text. Vague links hurt usability, conversion and SEO (Google reads anchor text for relevance)."
          }
        ]
      },
      "company": null,
      "modules": [],
      "security": {
        "score": 55,
        "checks": [
          {
            "i18n": {
              "key": "sec.ssl.pass"
            },
            "name": "SSL/TLS Certificate",
            "value": "Valid HTTPS connection established",
            "status": "pass",
            "evidence": {
              "source": "SSL"
            }
          },
          {
            "i18n": {
              "key": "sec.dnssec.warning"
            },
            "name": "DNSSEC",
            "value": "No DNSKEY records — zone is unsigned",
            "status": "warning",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "DNSSEC setup help →"
            },
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.",
            "whyMatters": "Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities."
          },
          {
            "i18n": {
              "key": "sec.caa.warning"
            },
            "name": "CAA DNS Record",
            "value": "No CAA records — any CA can issue certificates for this domain",
            "status": "warning",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue \"letsencrypt.org\"`. For multiple CAs add additional `0 issue \"...\"` records. Add `0 iodef \"mailto:security@yourdomain.tld\"` for misissuance reports.",
            "whyMatters": "CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017)."
          },
          {
            "i18n": {
              "key": "sec.https-redirect.pass"
            },
            "name": "HTTP → HTTPS Redirect",
            "value": "HTTP properly redirects to HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.hsts.fail"
            },
            "name": "HSTS (Strict-Transport-Security)",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.",
            "whyMatters": "Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi."
          },
          {
            "i18n": {
              "key": "sec.csp.fail"
            },
            "name": "Content-Security-Policy (CSP)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Security Hardening →"
            },
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.",
            "whyMatters": "CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection."
          },
          {
            "i18n": {
              "key": "sec.clickjacking.fail"
            },
            "name": "Clickjacking Protection",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.",
            "whyMatters": "Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it."
          },
          {
            "i18n": {
              "key": "sec.x-content-type.warning"
            },
            "name": "X-Content-Type-Options",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: X-Content-Type-Options: nosniff",
            "whyMatters": "Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it."
          },
          {
            "i18n": {
              "key": "sec.referrer-policy.warning"
            },
            "name": "Referrer-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.",
            "whyMatters": "Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths."
          },
          {
            "i18n": {
              "key": "sec.permissions-policy.warning"
            },
            "name": "Permissions-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.",
            "whyMatters": "Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge."
          },
          {
            "i18n": {
              "key": "sec.cookie-flags.pass",
              "params": {
                "count": 1
              }
            },
            "name": "Cookie Security Flags",
            "value": "1 cookie(s) — all have Secure, HttpOnly, SameSite",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.tech-disclosure.pass",
              "params": {
                "detail": "cloudflare"
              }
            },
            "name": "Technology Disclosure",
            "value": "Server: cloudflare (no version)",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.sri.warning",
              "params": {
                "eligible": 2,
                "exemptNote": "",
                "withIntegrity": 0
              }
            },
            "name": "Subresource Integrity (SRI)",
            "value": "Only 0/2 SRI-eligible third-party scripts have integrity hashes",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add integrity='sha384-...' and crossorigin='anonymous' to version-pinned third-party <script> tags (use srihash.org). Auto-updating provider scripts (analytics, payment SDKs, consent tools) are correctly excluded — they can't use SRI.",
            "whyMatters": "Without SRI, if a version-pinned third-party CDN is compromised, attackers can inject malicious code into your site — the same vector as the British Airways Magecart breach."
          },
          {
            "i18n": {
              "key": "sec.security-txt.warning"
            },
            "name": "security.txt (RFC 9116)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.",
            "whyMatters": "security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all."
          },
          {
            "i18n": {
              "key": "sec.cdn.pass",
              "params": {
                "cdn": "Cloudflare"
              }
            },
            "name": "CDN / WAF Protection",
            "value": "Cloudflare detected — DDoS protection and edge caching active",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.iframe-sandbox.warning",
              "params": {
                "total": 1,
                "untrusted": 1,
                "trustedNote": ""
              }
            },
            "name": "Iframe Sandboxing",
            "value": "1/1 unknown iframe(s) without sandbox attribute",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a sandbox attribute to non-provider <iframe> elements. Use sandbox='allow-scripts allow-same-origin' for third-party embeds. Trusted media/payment embeds (YouTube, Maps, Stripe, reCAPTCHA) are correctly excluded — they need full privileges to work.",
            "confidence": "low",
            "whyMatters": "Unsandboxed iframes from unknown sources can access your DOM, run scripts, and navigate the top window. They should be sandboxed to prevent clickjacking and XSS."
          }
        ]
      },
      "tech_stack": [
        {
          "eol": false,
          "name": "WordPress",
          "category": "cms",
          "outdated": false
        },
        {
          "name": "jQuery",
          "category": "js-library"
        },
        {
          "name": "Slick Slider",
          "category": "js-library"
        },
        {
          "name": "Fancybox",
          "category": "js-library"
        },
        {
          "name": "Cloudflare",
          "category": "cdn"
        }
      ],
      "performance": {
        "score": 91,
        "checks": [
          {
            "i18n": {
              "key": "perf.ttfb.pass",
              "params": {
                "ms": 41
              }
            },
            "name": "Server Response Time (TTFB)",
            "value": "41ms",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.fcp.pass",
              "params": {
                "s": "0.65"
              }
            },
            "name": "First Contentful Paint (FCP)",
            "value": "0.65s",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.lcp.pass",
              "params": {
                "s": "0.81"
              }
            },
            "name": "Largest Contentful Paint (LCP)",
            "value": "0.81s — Core Web Vital ✓",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.tbt.pass",
              "params": {
                "ms": 40
              }
            },
            "name": "Total Blocking Time (TBT)",
            "value": "40ms",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.cls.pass",
              "params": {
                "cls": "0.001"
              }
            },
            "name": "Cumulative Layout Shift (CLS)",
            "value": "0.001 — Core Web Vital ✓",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.speed-index.warning",
              "params": {
                "s": "4.81"
              }
            },
            "name": "Speed Index",
            "value": "4.81s (good: <3.4s)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Speed Index measures visual completeness over time. Improve it by: prioritizing above-fold content, preloading critical resources, and minimizing render-blocking assets.",
            "whyMatters": "Speed Index captures the overall visual loading experience. A slow Speed Index means users watch content load piece by piece instead of seeing a complete page."
          },
          {
            "i18n": {
              "key": "perf.page-weight.pass",
              "params": {
                "size": "669 KB",
                "requests": 56
              }
            },
            "name": "Total Page Weight",
            "value": "669 KB (56 requests)",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.js-budget.pass",
              "params": {
                "kb": 130
              }
            },
            "name": "JavaScript Budget",
            "value": "130 KB — within the 600 KB budget",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab",
              "measured": "130 KB JavaScript"
            },
            "confidence": "high",
            "whyMatters": "JavaScript is the most expensive resource on a page: it must be downloaded, parsed and executed before the page responds to input. Staying under 600 KB is what keeps mid-range phones responsive."
          },
          {
            "i18n": {
              "key": "perf.request-budget.pass",
              "params": {
                "count": 56
              }
            },
            "name": "Request Budget",
            "value": "56 requests — within the budget of 80",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab",
              "measured": "56 requests"
            },
            "confidence": "high",
            "whyMatters": "Every request costs a round trip. Under HTTP/2 they share a connection, but each still has to be discovered, queued and parsed."
          },
          {
            "i18n": {
              "key": "perf.third-party-budget.info"
            },
            "name": "Third-party Services",
            "value": "Not measured — PageSpeed did not return the third-party audit for this URL",
            "status": "info",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Re-run the scan, or check the third-party summary directly at PageSpeed Insights.",
            "whyMatters": "We report this as unmeasured rather than as zero third parties, because those are very different findings."
          },
          {
            "i18n": {
              "key": "perf.render-blocking.info"
            },
            "name": "Render-blocking Resources",
            "value": "Not measured — PageSpeed did not return the render-blocking audit for this URL",
            "status": "info",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run."
          },
          {
            "i18n": {
              "key": "perf.unused-code.warning",
              "params": {
                "kb": 51,
                "jsKb": 33,
                "cssKb": 18
              }
            },
            "name": "Unused Code (CSS + JS)",
            "value": "51 KB unused (CSS: 18 KB, JS: 33 KB)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Remove unused CSS with PurgeCSS or UnCSS. Code-split JavaScript so only needed code loads per page. Audit plugins — each adds CSS/JS.",
            "whyMatters": "Unused code is downloaded and parsed but never executed — pure waste. Removing it speeds up parse time and reduces bandwidth."
          },
          {
            "i18n": {
              "key": "perf.text-compression.pass"
            },
            "name": "Text Compression (gzip/brotli)",
            "value": "All text resources properly compressed",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "perf.resource-hints.warning"
            },
            "name": "Resource Hints (Preload/Preconnect)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add resource hints: <link rel='preconnect' href='https://fonts.googleapis.com'> for third-party origins, <link rel='preload' as='image' href='hero.webp'> for critical resources.",
            "whyMatters": "Preconnect saves 100-500ms per third-party origin by establishing connections early. Preload starts downloading critical resources before the browser discovers them in CSS/JS."
          },
          {
            "i18n": {
              "key": "perf.lazy-load.pass",
              "params": {
                "lazy": 23,
                "rate": 5,
                "total": 425
              }
            },
            "name": "Lazy Loading",
            "value": "5% of images use native lazy loading (23/425)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.font-display.pass",
              "params": {
                "value": "swap"
              }
            },
            "name": "Font Loading Strategy",
            "value": "font-display: swap",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.cache-control.pass",
              "params": {
                "detail": "max-age=86400"
              }
            },
            "name": "Cache-Control Strategy",
            "value": "max-age=86400",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "perf.http3.pass"
            },
            "name": "HTTP/3 (QUIC) Support",
            "value": "HTTP/3 enabled via Alt-Svc header",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "perf.script-strategy.pass",
              "params": {
                "rate": 85,
                "async": 3,
                "defer": 14,
                "module": 0
              }
            },
            "name": "Script Loading Strategy",
            "value": "85% of scripts use async/defer/module (3 async, 14 defer, 0 module)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.font-preload.warning"
            },
            "name": "Font Preloading",
            "value": "Custom fonts detected without preload hints",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Preload your primary font: <link rel='preload' href='/fonts/main.woff2' as='font' type='font/woff2' crossorigin>. For Google Fonts: preconnect to fonts.gstatic.com.",
            "whyMatters": "Fonts are discovered late in the render pipeline (after CSS is parsed). Preloading tells the browser to download them immediately, reducing Flash of Invisible Text (FOIT) by 200-500ms."
          }
        ]
      },
      "ai_readiness": {
        "score": 80,
        "checks": [
          {
            "i18n": {
              "key": "air.bot-access.warning",
              "params": {
                "bots": "Bytespider, PetalBot"
              }
            },
            "name": "AI Bot Access Policy",
            "value": "Minor bots blocked: Bytespider, PetalBot",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "You're blocking some AI crawlers (Bytespider, PetalBot). While not critical, these bots feed training data for AI models that may recommend your products.",
            "whyMatters": "Even minor AI bots contribute to how AI models understand your brand. More AI exposure means more AI citations and product recommendations."
          },
          {
            "i18n": {
              "key": "air.agent-live.pass"
            },
            "name": "AI Agent Access (live)",
            "value": "ChatGPT-User and PerplexityBot get the same page as a browser",
            "status": "pass",
            "weight": 2,
            "evidence": {
              "source": "file-probe",
              "measured": "ChatGPT-User, PerplexityBot: same page as a browser",
              "probedUrl": "https://luigisbox.sk"
            }
          },
          {
            "i18n": {
              "key": "air.llms-txt.pass",
              "params": {
                "chars": 4000,
                "extras": "H1, links, summary"
              }
            },
            "name": "llms.txt (AI Site Descriptor)",
            "value": "Present (4000 chars, H1, links, summary) — informational; no engine consumes it for citation",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md."
          },
          {
            "i18n": {
              "key": "air.llms-full.warning"
            },
            "name": "llms-full.txt (Complete AI Content)",
            "value": "Not present — not required for AI visibility",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md."
          },
          {
            "i18n": {
              "key": "air.content-access.pass",
              "params": {
                "ratio": "2.0",
                "words": 1801
              }
            },
            "name": "Content Accessibility for AI",
            "value": "1801 words in raw HTML (2.0% text ratio) — readable by AI crawlers without executing JS",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.schema-foundation.pass",
              "params": {
                "note": "",
                "count": 9,
                "types": "Place, BusinessEntity, WebSite, ImageObject, WebPage, Person",
                "blocks": 3
              }
            },
            "name": "Structured Data Foundation",
            "value": "3 JSON-LD blocks with 9 distinct schema types: Place, BusinessEntity, WebSite, ImageObject, WebPage, Person",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "air.org-schema.pass",
              "params": {
                "count": 4
              }
            },
            "name": "Organization Schema + Entity Linking",
            "value": "Organization found with 4 sameAs links — strong entity identity",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "air.faq-schema.warning"
            },
            "name": "FAQ Schema (Direct AI Answers)",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).",
            "whyMatters": "ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI."
          },
          {
            "i18n": {
              "key": "air.breadcrumb.warning"
            },
            "name": "Breadcrumb Schema",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.",
            "whyMatters": "AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'."
          },
          {
            "i18n": {
              "key": "air.sitesearch.pass"
            },
            "name": "Site Search Schema (SearchAction)",
            "value": "WebSite SearchAction configured — AI can search your store",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "air.content-depth.pass",
              "params": {
                "words": 1801
              }
            },
            "name": "Content Depth for AI",
            "value": "1801 words — rich content for AI analysis and citation",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.answer-first.warning"
            },
            "name": "Answer-First Content Format",
            "value": "Content doesn't start with a strong summary paragraph",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.",
            "whyMatters": "AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often."
          },
          {
            "i18n": {
              "key": "air.headings.pass",
              "params": {
                "h2": 9,
                "h3": 34
              }
            },
            "name": "Heading Hierarchy for AI",
            "value": "Proper structure: 1 H1 → 9 H2s → 34 H3s — clear content outline",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.semantic-html.pass",
              "params": {
                "count": 4,
                "elements": "<nav>, <main>, <header>, <footer>"
              }
            },
            "name": "Semantic HTML Structure",
            "value": "4/6 semantic elements: <nav>, <main>, <header>, <footer>",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.structured-content.warning-partial",
              "params": {
                "what": "33 lists",
                "missing": "comparison tables"
              }
            },
            "name": "Structured Content (Lists & Tables)",
            "value": "33 lists found — consider adding comparison tables",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.",
            "whyMatters": "AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text."
          },
          {
            "i18n": {
              "key": "air.freshness.warning-noschema"
            },
            "name": "Content Freshness Signals",
            "value": "Schema dates found but no visible date on page",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add both: 1) dateModified and datePublished in your Article/Product JSON-LD schema, 2) A visible 'Last updated: [date]' on the page. Both signals reinforce content freshness for AI.",
            "whyMatters": "AI models weight recency in their citation algorithms. Freshness signals tell AI your content is current and reliable."
          },
          {
            "i18n": {
              "key": "air.entity-clarity.pass",
              "params": {
                "count": 4,
                "platforms": ": Facebook, X/Twitter, LinkedIn, YouTube"
              }
            },
            "name": "Entity Clarity & Brand Signals",
            "value": "OG tags complete + 4 sameAs links: Facebook, X/Twitter, LinkedIn, YouTube",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.eeat.pass"
            },
            "name": "Author Expertise Signals (E-E-A-T)",
            "value": "Article schema with Person/author — strong expertise signal for AI",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.review-schema.pass"
            },
            "name": "Reviews & Ratings Schema",
            "value": "AggregateRating/Review data found — social proof for AI",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "air.speakable.warning"
            },
            "name": "Speakable Content (Voice AI)",
            "value": "Not present — optional; SpeakableSpecification has limited assistant adoption",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.extractable.pass",
              "params": {
                "avg": 59,
                "count": 47
              }
            },
            "name": "Extractable Answer Blocks",
            "value": "47 paragraphs, avg 59 words — optimal for AI extraction",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.statistics.pass",
              "params": {
                "count": 10
              }
            },
            "name": "Statistics & Data Presence",
            "value": "10 data points found — strong citation magnet",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.section-length.warning",
              "params": {
                "avg": 33,
                "ratio": 5
              }
            },
            "name": "Section Length Optimization",
            "value": "Avg section: 33 words — only 5% in 80-200 word optimal range",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.",
            "whyMatters": "For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance."
          },
          {
            "i18n": {
              "key": "air.qa-headings.warning-none"
            },
            "name": "Q&A Format Headings",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.",
            "whyMatters": "Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries."
          },
          {
            "i18n": {
              "key": "air.internal-links.pass",
              "params": {
                "rate": 11
              }
            },
            "name": "Internal Link Density",
            "value": "11 contextual internal links per 1,000 words — strong knowledge graph signal",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.canonical.warning-different",
              "params": {
                "url": "https://www.luigisbox.sk/"
              }
            },
            "name": "Canonical Tag for AI Deduplication",
            "value": "Canonical points to different URL: https://www.luigisbox.sk/",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Verify this canonical is intentional. AI models cluster near-duplicate URLs and choose one representative page. If canonical points to a different URL, AI will only index that target URL, not this page.",
            "whyMatters": "AI search engines (ChatGPT, Perplexity, Bing Copilot) use canonicals to deduplicate content. A wrong canonical means AI may cite the wrong page version or ignore this page entirely."
          },
          {
            "i18n": {
              "key": "air.kg-readiness.pass",
              "params": {
                "count": 3
              }
            },
            "name": "Knowledge Graph Readiness",
            "value": "3/4 entity signals — strong Knowledge Graph presence",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.readability.warning-high-technical",
              "params": {
                "grade": 19
              }
            },
            "name": "Content Readability for AI",
            "value": "Grade 19 — too complex for broad AI citation (technical threshold: 14)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.",
            "whyMatters": "Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often."
          },
          {
            "i18n": {
              "key": "air.alt-text.fail",
              "params": {
                "pct": 24,
                "poor": 207,
                "missing": 1
              }
            },
            "name": "Image Alt Text Quality for AI",
            "value": "Only 24% quality alt text — 1 missing, 207 poor",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.",
            "whyMatters": "Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally."
          },
          {
            "i18n": {
              "key": "air.expert-quotes.warning-none"
            },
            "name": "Expert Quotations & Citations",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).",
            "whyMatters": "Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions."
          },
          {
            "i18n": {
              "key": "air.ai-txt.warning"
            },
            "name": "ai.txt (AI Permissions)",
            "value": "Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "ai.txt is an emerging fine-grained AI-permissions proposal not yet honored by the major engines. The robots.txt AI-bot rules are the signal that actually gates crawler access."
          },
          {
            "i18n": {
              "key": "air.webmcp.warning"
            },
            "name": "WebMCP Agentic Readiness",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.",
            "whyMatters": "WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard."
          },
          {
            "i18n": {
              "key": "air.boilerplate.pass",
              "params": {
                "ratio": 62
              }
            },
            "name": "Content-to-Boilerplate Ratio",
            "value": "62% of text in <main>/<article> — clean content signal",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.aggregate-rating.pass"
            },
            "name": "AggregateRating Schema",
            "value": "Review aggregate rating schema present",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "air.reviews-aggregate.pass",
              "params": {
                "detail": "1 source: AggregateRating schema — ★ 4.8 · 435 reviews"
              }
            },
            "name": "Customer Reviews — Aggregate",
            "value": "1 source: AggregateRating schema — ★ 4.8 · 435 reviews",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "whyMatters": "Multi-source reviews with published counts compound trust: AI assistants (ChatGPT/Perplexity) and Google SGE cite shops with verifiable AggregateRating schema first; SK/CZ buyers cross-check Heureka against Trustpilot before purchase."
          }
        ]
      },
      "phaseTimings": {
        "tail": 6114,
        "total": 28734,
        "phase1": 22010,
        "preflight": 266,
        "phase1.dns": 82,
        "phase1.html": 465,
        "phase1.files": 22008,
        "phase1.zbozi": 4003,
        "phase1.headers": 127,
        "phase1.heureka": 4003,
        "phase1.aiAgents": 180,
        "phase1.merchant": 4003
      },
      "accessibility": {
        "score": 66,
        "checks": [
          {
            "i18n": {
              "key": "a11y.lang.pass",
              "params": {
                "lang": "sk-SK"
              }
            },
            "name": "Page Language",
            "value": "<html lang=\"sk-SK\"> is set",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.alt.warning",
              "params": {
                "total": 425,
                "missing": 1
              }
            },
            "name": "Image Alt Text",
            "value": "1 of 425 images missing alt text",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add alt text to the remaining images (alt=\"\" for decorative ones).",
            "legalRefs": {
              "gdpr": [],
              "czLaw": [
                "§ 4 zák. 424/2023"
              ],
              "skLaw": [
                "§ 4 zák. 351/2022"
              ],
              "verified": [
                {
                  "act": "351/2022",
                  "excerpt": "§ 4 — (1) Ak odseky 2 až 4 neustanovujú inak, poskytovaná služba musí spĺňať ustanovené požiadavky na prístupnosť služby pre osoby so zdravotným postihnutím; ak ide o výrobky použité na poskytnutie služby, požiadavky na prístupnosť výrobkov",
                  "citation": "§4 zákona č. 351/2022 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "424/2023",
                  "title": "Požadavky na přístupnost a volný pohyb",
                  "excerpt": "§ 4 Požadavky na přístupnost a volný pohyb (1) Požadavky na přístupnost výrobků podle § 2 odst. 1 stanoví příloha č. 1 oddíly I a II. (2) Požadavky na přístupnost služeb podle § 2 odst. 2 stanoví příloha č. 1 oddíly III a IV.",
                  "citation": "§4 zákona č. 424/2023 Sb.",
                  "jurisdiction": "cz"
                }
              ]
            },
            "whyMatters": "Every image missing alt text is content a screen-reader user cannot access (WCAG 1.1.1 / EN 301 549 § 9.1.1.1)."
          },
          {
            "i18n": {
              "key": "a11y.forms.fail",
              "params": {
                "total": 7,
                "unlabeled": 7
              }
            },
            "name": "Form Labels",
            "value": "7 of 7 form inputs have no associated label",
            "status": "fail",
            "weight": 2,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.",
            "legalRefs": {
              "gdpr": [],
              "czLaw": [
                "§ 4 zák. 424/2023"
              ],
              "skLaw": [
                "§ 4 zák. 351/2022"
              ],
              "verified": [
                {
                  "act": "351/2022",
                  "excerpt": "§ 4 — (1) Ak odseky 2 až 4 neustanovujú inak, poskytovaná služba musí spĺňať ustanovené požiadavky na prístupnosť služby pre osoby so zdravotným postihnutím; ak ide o výrobky použité na poskytnutie služby, požiadavky na prístupnosť výrobkov",
                  "citation": "§4 zákona č. 351/2022 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "424/2023",
                  "title": "Požadavky na přístupnost a volný pohyb",
                  "excerpt": "§ 4 Požadavky na přístupnost a volný pohyb (1) Požadavky na přístupnost výrobků podle § 2 odst. 1 stanoví příloha č. 1 oddíly I a II. (2) Požadavky na přístupnost služeb podle § 2 odst. 2 stanoví příloha č. 1 oddíly III a IV.",
                  "citation": "§4 zákona č. 424/2023 Sb.",
                  "jurisdiction": "cz"
                }
              ]
            },
            "whyMatters": "Unlabelled fields leave screen-reader users guessing what to type — search, newsletter and checkout forms become unusable. EN 301 549 § 9.1.3.1 / 9.4.1.2 (WCAG 1.3.1 / 4.1.2)."
          },
          {
            "i18n": {
              "key": "a11y.headings.pass"
            },
            "name": "Heading Structure",
            "value": "Single <h1> with a consistent heading outline",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.links.pass"
            },
            "name": "Link Text",
            "value": "Links use descriptive text",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "confidence": "low"
          },
          {
            "i18n": {
              "key": "a11y.landmarks.pass"
            },
            "name": "Landmark Regions",
            "value": "Semantic landmarks present (<main>, <nav>/<header>)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.zoom.pass"
            },
            "name": "Zoom & Scaling",
            "value": "Pinch-zoom is not disabled",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.skiplink.missing"
            },
            "name": "Skip Link",
            "value": "No skip-to-content link detected",
            "status": "warning",
            "weight": 1,
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a visually-hidden \"Skip to content\" link as the first focusable element, targeting <main id=\"main\">.",
            "legalRefs": {
              "gdpr": [],
              "czLaw": [
                "§ 4 zák. 424/2023"
              ],
              "skLaw": [
                "§ 4 zák. 351/2022"
              ],
              "verified": [
                {
                  "act": "351/2022",
                  "excerpt": "§ 4 — (1) Ak odseky 2 až 4 neustanovujú inak, poskytovaná služba musí spĺňať ustanovené požiadavky na prístupnosť služby pre osoby so zdravotným postihnutím; ak ide o výrobky použité na poskytnutie služby, požiadavky na prístupnosť výrobkov",
                  "citation": "§4 zákona č. 351/2022 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "424/2023",
                  "title": "Požadavky na přístupnost a volný pohyb",
                  "excerpt": "§ 4 Požadavky na přístupnost a volný pohyb (1) Požadavky na přístupnost výrobků podle § 2 odst. 1 stanoví příloha č. 1 oddíly I a II. (2) Požadavky na přístupnost služeb podle § 2 odst. 2 stanoví příloha č. 1 oddíly III a IV.",
                  "citation": "§4 zákona č. 424/2023 Sb.",
                  "jurisdiction": "cz"
                }
              ]
            },
            "confidence": "low",
            "whyMatters": "Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1)."
          },
          {
            "i18n": {
              "key": "a11y.legal-basis"
            },
            "name": "EAA Legal Basis",
            "value": "In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.",
            "status": "info",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "howToFix": "",
            "isUpsell": true,
            "legalRefs": {
              "gdpr": [],
              "czLaw": [
                "§ 4 zák. 424/2023"
              ],
              "skLaw": [
                "§ 4 zák. 351/2022",
                "§ 5 zák. 351/2022"
              ],
              "verified": [
                {
                  "act": "351/2022",
                  "excerpt": "§ 4 — (1) Ak odseky 2 až 4 neustanovujú inak, poskytovaná služba musí spĺňať ustanovené požiadavky na prístupnosť služby pre osoby so zdravotným postihnutím; ak ide o výrobky použité na poskytnutie služby, požiadavky na prístupnosť výrobkov",
                  "citation": "§4 zákona č. 351/2022 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "351/2022",
                  "excerpt": "§ 5 — (1) Ak ustanovené požiadavky na prístupnosť služby pre osoby so zdravotným postihnutím nezahŕňajú jednu alebo viac funkcií vyplývajúcich z poskytovania služby, tieto funkcie musia byť prístupné na základe dodržiavania ustanovených kri",
                  "citation": "§5 zákona č. 351/2022 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "act": "424/2023",
                  "title": "Požadavky na přístupnost a volný pohyb",
                  "excerpt": "§ 4 Požadavky na přístupnost a volný pohyb (1) Požadavky na přístupnost výrobků podle § 2 odst. 1 stanoví příloha č. 1 oddíly I a II. (2) Požadavky na přístupnost služeb podle § 2 odst. 2 stanoví příloha č. 1 oddíly III a IV.",
                  "citation": "§4 zákona č. 424/2023 Sb.",
                  "jurisdiction": "cz"
                }
              ]
            },
            "whyMatters": ""
          }
        ]
      },
      "vulnerability": {
        "score": 57,
        "checks": [
          {
            "i18n": {
              "key": "vuln.cms-version.pass"
            },
            "name": "CMS Version Disclosure",
            "value": "No generator tag — CMS identity hidden",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.sensitive-files.pass"
            },
            "name": "Sensitive Files Exposed",
            "value": ".env, .git, composer.json — all properly blocked",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.install-script.pass"
            },
            "name": "Install Script Exposed",
            "value": "No /install/ or /setup/ paths accessible",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.directory-listing.unverified",
              "params": {
                "paths": "/wp-includes/, /wp-content/uploads/"
              }
            },
            "name": "Directory Listing",
            "value": "Could not verify — /wp-includes/, /wp-content/uploads/ did not answer",
            "status": "warning",
            "evidence": {
              "source": "file-probe",
              "probedUrl": "/wp-includes/",
              "httpStatus": 0
            },
            "howToFix": "Open the listed paths in a browser: an 'Index of /…' page means listing is on — disable it with 'Options -Indexes' (Apache) or 'autoindex off;' (Nginx). A 403 or 404 is fine.",
            "confidence": "low",
            "whyMatters": "These paths exist on every WordPress install. No answer within our time limit is not proof that listing is off, so this is not reported as a pass."
          },
          {
            "i18n": {
              "key": "vuln.admin-url.pass"
            },
            "name": "Admin Panel at Default URL",
            "value": "Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.debug-mode.pass"
            },
            "name": "Debug Mode / Error Exposure",
            "value": "No debug indicators found in page output",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.cors.warning"
            },
            "name": "CORS Configuration",
            "value": "Access-Control-Allow-Origin: * (allows any domain)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Replace the wildcard CORS header with specific allowed origins. Avoid Access-Control-Allow-Origin: * on pages with authentication or sensitive data.",
            "whyMatters": "A wildcard CORS policy allows any website to make requests to your API/pages. Combined with Access-Control-Allow-Credentials, this enables cross-origin data theft."
          },
          {
            "i18n": {
              "key": "vuln.csrf.fail",
              "params": {
                "count": 2
              }
            },
            "name": "Form CSRF Protection",
            "value": "2 form(s) without CSRF tokens",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.",
            "confidence": "low",
            "whyMatters": "CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session."
          },
          {
            "i18n": {
              "key": "vuln.inline-js.warning",
              "params": {
                "kb": 57
              }
            },
            "name": "Inline JavaScript Exposure",
            "value": "57 KB of inline JavaScript",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).",
            "confidence": "low",
            "whyMatters": "Large amounts of inline JavaScript prevent proper CSP implementation and increase the risk of XSS. External scripts can be protected with SRI hashes."
          },
          {
            "i18n": {
              "key": "vuln.magecart.fail",
              "params": {
                "patterns": "new Function() with decoding"
              }
            },
            "name": "Suspicious Inline Script Patterns",
            "value": "Detected: new Function() with decoding",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Malware Scan →"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Review all inline scripts for obfuscated code. Magecart attackers inject payment skimmers disguised as analytics or GTM scripts. Compare your current HTML with a known-good version. Consider using CSP with strict nonces.",
            "whyMatters": "These patterns (Base64 decode, eval with encoding, dynamic script injection) are hallmarks of Magecart payment skimmers. Skimmers are commonly disguised as Google Tag Manager on e-commerce sites."
          },
          {
            "i18n": {
              "key": "vuln.spf.fail-missing"
            },
            "name": "SPF Record (Email Security)",
            "status": "fail",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Add an SPF TXT record to your DNS: v=spf1 include:_spf.google.com ~all (adjust for your email provider). This tells receiving servers which IPs can send email for your domain.",
            "whyMatters": "Without SPF, anyone can send emails that appear to come from your domain. Since 2024, Google and Yahoo reject email from domains without SPF. Your transactional emails may land in spam."
          },
          {
            "i18n": {
              "key": "vuln.dmarc.fail-missing"
            },
            "name": "DMARC Policy (Email Auth)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Email Security Setup →"
            },
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.",
            "whyMatters": "Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems."
          },
          {
            "i18n": {
              "key": "vuln.dkim.warning"
            },
            "name": "DKIM Signing (Email Auth)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Configure DKIM signing through your email provider (Google Workspace, Microsoft 365, Mailchimp, SendGrid). Publish the DKIM public key as a TXT record at <selector>._domainkey.yourdomain.com.",
            "whyMatters": "DKIM cryptographically signs outgoing email to prove it comes from your domain. Without DKIM, email providers downgrade trust score — transactional emails land in spam. Gmail and Yahoo require DKIM since 2024 for bulk senders."
          },
          {
            "i18n": {
              "key": "vuln.cross-origin.warning"
            },
            "name": "Cross-Origin Isolation",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.",
            "whyMatters": "Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers."
          },
          {
            "i18n": {
              "key": "vuln.mixed-content.warning",
              "params": {
                "urls": "http://app.luigisbox.com",
                "count": 1
              }
            },
            "name": "Mixed Content Resources",
            "value": "1 HTTP resource(s) on HTTPS page",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Replace HTTP URLs with HTTPS: http://app.luigisbox.com",
            "whyMatters": "Mixed content allows man-in-the-middle attacks on specific resources. Browsers increasingly block mixed content, breaking images and scripts on your site."
          },
          {
            "i18n": {
              "key": "vuln.payment-page.fail",
              "params": {
                "issues": "No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection"
              }
            },
            "name": "Payment Page Security",
            "value": "Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get PCI Compliance Audit →"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.",
            "whyMatters": "Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance."
          }
        ]
      },
      "executive_summary": {
        "en": "Your site is reasonably optimized but has critical security gaps. Enable HSTS protection in WordPress settings immediately to secure data transmission. Your SEO and GDPR compliance are solid strengths.",
        "sk": "Váš web je slušne optimalizovaný, ale má významné bezpečnostné medzery. Hneď aktivujte HSTS ochranu v nastaveniach WordPressu, aby ste zabezpečili šifrovanie komunikácie. Pozitívne je vaša vynikajúca SEO a GDPR compliance."
      },
      "opendata_security": null,
      "platform_evidence": [
        "strong: api.w.org link"
      ],
      "maintenance_bypass": false,
      "scanner_token_sent": false
    },
    "created_at": "2026-10-08T16:59:45.955904+00:00",
    "status": "complete",
    "platform_detected": "WordPress",
    "company_ico": null,
    "company_name": null,
    "company_country": null,
    "company_nace": null,
    "company_size": null,
    "nis2_scope": null,
    "nis2_sector": null,
    "company_risk_score": null,
    "company_risk_level": null
  }
}