{
  "data": {
    "slug": "757f17b0",
    "url": "https://www.turistikalokobb.sk/",
    "domain": "turistikalokobb.sk",
    "overall_score": 54,
    "scores_json": {
      "seo": {
        "score": 54,
        "checks": [
          {
            "name": "Meta Title",
            "value": "30 chars — \"KST Lokomot�va Bansk� Bystrica\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "name": "Meta Description",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Without a meta description, Google auto-generates one — often poorly. Custom descriptions can boost CTR by 5.8% (Backlinko study)."
          },
          {
            "name": "H1 Heading",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "The H1 is the primary content signal for search engines. Pages without H1 rank significantly lower for target keywords."
          },
          {
            "name": "Content Structure (H2 Headings)",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Pages without heading structure have 30% lower time-on-page and miss long-tail ranking opportunities."
          },
          {
            "name": "Open Graph Tags",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Without OG tags, social platforms show ugly auto-generated previews. Proper OG tags increase social engagement by 2-3x."
          },
          {
            "name": "Twitter/X Cards",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs."
          },
          {
            "name": "Canonical URL",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a <link rel='canonical'> tag pointing to the preferred URL. For a single-page site this is a one-line addition in <head>.",
            "whyMatters": "Canonical tags prevent search engines from treating URL variants (with/without trailing slash, tracking params) as duplicate pages."
          },
          {
            "name": "Structured Data (JSON-LD)",
            "value": "SPA detected — see note below",
            "status": "info",
            "fixLink": {
              "url": "https://zulien.sk",
              "label": "Add with Schema module →"
            },
            "evidence": {
              "source": "schema"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Pages with structured data get rich snippets in Google — star ratings, prices, availability — increasing CTR by 20-30%."
          },
          {
            "name": "robots.txt",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create a robots.txt file at your domain root. Include a Sitemap directive pointing to your XML sitemap.",
            "whyMatters": "robots.txt guides search engine crawling. Without it, crawlers may waste budget on irrelevant pages (admin, cart, checkout)."
          },
          {
            "name": "XML Sitemap",
            "status": "fail",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Generate an XML sitemap at /sitemap.xml listing all important pages. Exclude noindex pages, filters, and duplicate URLs. Reference it in robots.txt.",
            "whyMatters": "Sitemaps help Google discover and index pages 3-5x faster, especially for large stores with deep category structures."
          },
          {
            "name": "HTML Language Attribute",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add lang attribute to your <html> tag, e.g., <html lang='en'> or <html lang='de'>.",
            "whyMatters": "The lang attribute helps search engines serve your content to the right language audience and improves accessibility."
          },
          {
            "name": "Image Alt Attributes",
            "value": "No images found · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Images drive 22% of all Google searches. Missing images means missing ranking opportunities."
          },
          {
            "name": "Text-to-HTML Ratio",
            "value": "5% — low content density (4 words) · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Low text-to-HTML ratio signals thin content to Google. Pages with more useful text rank higher and convert better."
          },
          {
            "name": "Favicon",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Add a favicon: <link rel='icon' href='/favicon.ico'>. Include multiple sizes for different devices (16x16, 32x32, 180x180).",
            "whyMatters": "Favicons appear in browser tabs, bookmarks, and Google search results. Missing favicons look unprofessional and reduce brand recognition."
          },
          {
            "name": "Semantic HTML Structure",
            "value": "0/6 semantic elements — poor structure · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Without semantic structure, search engines treat your page as an undifferentiated blob of content. Semantic HTML is essential for featured snippets, voice search, and AI-powered search."
          },
          {
            "name": "Content Depth",
            "value": "Only 4 words — very thin content · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Pages with <100 words are nearly invisible to search engines. Google can't determine relevance without sufficient text content. This is a critical ranking barrier."
          },
          {
            "name": "Internal Linking",
            "value": "No internal links found · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "A page with zero internal links is isolated from your site's link graph. Google may treat it as low-priority or not index it at all."
          },
          {
            "name": "Accessibility Fundamentals",
            "value": "No accessibility signals found · SPA detected — see note below",
            "status": "info",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Accessibility Audit →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "The European Accessibility Act (EAA) makes web accessibility legally mandatory for EU e-commerce from June 28, 2025. Non-compliance risks fines of €100K+ and market access restrictions."
          }
        ]
      },
      "gdpr": {
        "score": 69,
        "checks": [
          {
            "name": "Cookie Consent Banner (CMP)",
            "value": "SPA detected — see note below",
            "status": "info",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get GDPR Compliance →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "Since 2024, EU regulators actively enforce cookie consent. CNIL fined Google €150M and Amazon €35M for non-compliant cookie banners. Fines can reach 4% of global annual revenue."
          },
          {
            "name": "Tracking Scripts & Consent",
            "value": "No tracking scripts detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "EDPB Opinion 5/2019"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "name": "Privacy Policy Page",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13",
                "Art. 14"
              ],
              "skLaw": [
                "§ 19",
                "§ 20"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 14 — Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby 2. Okrem informácií uvedených v odseku 1 prevádzkovateľ poskytne dotknutej osobe tieto ďalšie informácie potrebné na zabezpečenie spravodliv",
                  "citation": "čl. 14 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby",
                  "excerpt": "§ 20 Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby (5) d) ak osobné údaje musia zostať dôverné na základe povinnosti mlčanlivosti podľa osobitného predpisu. 15 )",
                  "citation": "§20 ods. 5 písm. d) zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "A missing privacy policy is the #1 most cited GDPR violation. Every EU data protection authority considers this a basic requirement — and fines start at €5,000 for small businesses."
          },
          {
            "name": "Cookie Policy",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13(1)(c)-(e)"
              ],
              "skLaw": [
                "§ 19"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement."
          },
          {
            "name": "Legal Contact / Imprint Page",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "In DACH countries, a missing Impressum can result in €50K+ fines and competitor cease-and-desist letters. For all EU stores, identifying the data controller is a GDPR Article 13 requirement."
          },
          {
            "name": "Terms & Conditions Page",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "EU Consumer Rights Directive requires clear terms before purchase. Missing T&C means customers can claim they weren't informed, giving them extended cancellation rights."
          },
          {
            "name": "Data Encryption (No Mixed Content)",
            "value": "All resources loaded over HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "name": "Right to Erasure (Data Deletion)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.",
            "legalRefs": {
              "gdpr": [
                "Art. 17"
              ],
              "skLaw": [
                "§ 23"
              ],
              "verified": [
                {
                  "title": "Právo na vymazanie (právo „na zabudnutie“)",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 17 — Právo na vymazanie (právo „na zabudnutie“) 1. Dotknutá osoba má tiež právo dosiahnuť u prevádzkovateľa bez zbytočného odkladu vymazanie osobných údajov, ktoré sa jej týkajú, a prevádzkovateľ je povinný bez zbytočného odkladu vy",
                  "citation": "čl. 17 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Právo na výmaz osobných údajov",
                  "excerpt": "§ 23 Právo na výmaz osobných údajov (1) Dotknutá osoba má právo na to, aby prevádzkovateľ bez zbytočného odkladu vymazal osobné údaje, ktoré sa jej týkajú.",
                  "citation": "§23 ods. 1 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process. Italian DPA fined companies €20M+ for obstructing erasure requests."
          },
          {
            "name": "Data Protection Officer Contact",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add DPO contact details (or privacy contact if DPO not required) to your privacy policy and footer. Include: name/title, email (e.g., dpo@yourdomain.com), and postal address.",
            "whyMatters": "GDPR Article 37 requires a DPO for organizations processing personal data at scale. Even if not mandatory, having a designated privacy contact builds trust and is expected by regulators."
          },
          {
            "name": "Withdrawal of Consent Mechanism",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Provide a clear way to withdraw consent: an 'unsubscribe' link in emails, a 'cookie settings' button in the footer, and a 'revoke consent' section in your privacy policy.",
            "legalRefs": {
              "gdpr": [
                "Art. 7(3)"
              ],
              "skLaw": [
                "§ 14(4)"
              ],
              "verified": [
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR Article 7(3): 'It shall be as easy to withdraw as to give consent.' If users can subscribe in one click, unsubscribing must be equally simple. Missing this is a common regulatory finding."
          }
        ]
      },
      "nis2": {
        "score": -1,
        "checks": [
          {
            "name": "NIS2 Compliance",
            "value": "Scope undetermined — IČO/company enrichment unavailable for this domain.",
            "status": "info",
            "howToFix": "",
            "whyMatters": ""
          }
        ]
      },
      "mobile": {
        "score": 35,
        "checks": [
          {
            "name": "Viewport Configuration",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add <meta name='viewport' content='width=device-width, initial-scale=1'> to your <head>. This is the absolute minimum for mobile compatibility.",
            "whyMatters": "Without the viewport tag, mobile browsers render at 980px width and zoom out — making text unreadable and buttons untappable. Google uses mobile-first indexing, so this directly kills rankings."
          },
          {
            "name": "Mobile Performance Score",
            "value": "No mobile performance data available",
            "status": "pending",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Neither Lighthouse nor Chrome UX Report data is available. The site may have very low traffic or block all analysis tools."
          },
          {
            "name": "Responsive Design Techniques",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Implement responsive CSS with @media queries for key breakpoints: 480px (small mobile), 768px (tablet), 1024px (laptop). Use Flexbox and CSS Grid for fluid layouts.",
            "whyMatters": "Non-responsive sites are automatically penalized by Google in mobile search results. Since mobile-first indexing, this is a critical ranking factor."
          },
          {
            "name": "Theme Color",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.",
            "whyMatters": "Theme-color creates a polished, branded mobile experience. It makes your site look native and professional — small detail, big perception impact."
          },
          {
            "name": "Mobile Navigation (Semantic)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Wrap your navigation in a <nav> element. This helps mobile screen readers offer 'skip to navigation' and improves voice navigation (e.g., 'Siri, show me the menu').",
            "whyMatters": "Semantic <nav> elements are essential for mobile accessibility. Screen readers use them to let users jump directly to navigation — critical on small screens where content is long."
          }
        ]
      },
      "company": null,
      "modules": [],
      "security": {
        "score": 52,
        "checks": [
          {
            "name": "SSL/TLS Certificate",
            "value": "Valid HTTPS connection established",
            "status": "pass",
            "evidence": {
              "source": "SSL"
            }
          },
          {
            "name": "DNSSEC",
            "value": "Zone is DNSSEC-signed (DNSKEY published)",
            "status": "pass",
            "evidence": {
              "source": "DNS"
            },
            "whyMatters": "DNSSEC protects against DNS cache poisoning and on-path attackers redirecting your domain. Required by some sector regulators for NIS2 essential/important entities."
          },
          {
            "name": "CAA DNS Record",
            "value": "No CAA records — any CA can issue certificates for this domain",
            "status": "warning",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue \"letsencrypt.org\"`. For multiple CAs add additional `0 issue \"...\"` records. Add `0 iodef \"mailto:security@yourdomain.tld\"` for misissuance reports.",
            "whyMatters": "CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017)."
          },
          {
            "name": "HTTP → HTTPS Redirect",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Configure a 301 redirect from http:// to https:// for all pages. In Apache: RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]",
            "whyMatters": "Without a redirect, users can access the insecure HTTP version. Google also treats http and https as separate URLs, splitting your SEO signals."
          },
          {
            "name": "HSTS (Strict-Transport-Security)",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.",
            "whyMatters": "Without HSTS, attackers can intercept the first HTTP request and downgrade the connection. This is the #1 way to steal session cookies on public WiFi."
          },
          {
            "name": "Content-Security-Policy (CSP)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Security Hardening →"
            },
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.",
            "whyMatters": "CSP is the most powerful defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection, the #1 web attack vector."
          },
          {
            "name": "Clickjacking Protection",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.",
            "whyMatters": "Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it."
          },
          {
            "name": "X-Content-Type-Options",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: X-Content-Type-Options: nosniff",
            "whyMatters": "Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it."
          },
          {
            "name": "Referrer-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.",
            "whyMatters": "Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths."
          },
          {
            "name": "Permissions-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.",
            "whyMatters": "Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge."
          },
          {
            "name": "Cookie Security Flags",
            "value": "No cookies set on initial response",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "name": "Technology Disclosure",
            "value": "Server: openresty (no version)",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "name": "security.txt (RFC 9116)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.",
            "whyMatters": "security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all. Required by ISO 27001 and SOC 2."
          },
          {
            "name": "Server Version Disclosure",
            "value": "openresty — version hidden",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "name": "CDN / WAF Protection",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.",
            "whyMatters": "Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts. Cloudflare blocks 150+ billion daily threats."
          }
        ]
      },
      "tech_stack": [
        {
          "name": "openresty",
          "category": "server"
        }
      ],
      "performance": {
        "score": -1,
        "checks": [
          {
            "name": "Performance",
            "value": "Measuring — Google PageSpeed running in background…",
            "status": "pending",
            "howToFix": "",
            "whyMatters": ""
          }
        ]
      },
      "ai_readiness": {
        "score": 42,
        "checks": [
          {
            "name": "AI Bot Access Policy",
            "value": "No AI bot restrictions (allowed by default)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "name": "llms.txt (AI Site Descriptor)",
            "status": "fail",
            "fixLink": {
              "url": "https://llmstxt.org",
              "label": "Learn about llms.txt →"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /llms.txt in Markdown format:\n# Your Store Name\n> One-line summary of your business and key offerings.\n\nDetailed description paragraph.\n\n## Products\n- [Product Category](URL): Description\n\n## About\n- [About Us](URL): Company history and values\n\nSee llmstxt.org for the full specification.",
            "whyMatters": "llms.txt is the emerging standard for AI-readable site descriptions — like robots.txt was for search engines. Early adopters (Yoast, Cloudflare, Stripe) are already using it. Without it, AI assistants have no guided overview of your store."
          },
          {
            "name": "llms-full.txt (Complete AI Content)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /llms-full.txt containing your complete site documentation in a single Markdown file — product catalog summaries, FAQs, policies, brand story. This gives AI models maximum context about your store.",
            "whyMatters": "llms-full.txt provides AI models with your entire site content in one parseable file. It's the difference between an AI having a brief overview vs. deep knowledge of your products and services."
          },
          {
            "name": "Content Accessibility for AI",
            "value": "Only 4 words visible in HTML — content may be JS-dependent · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "AI crawlers see only raw HTML. The LLMClicks audit tool found that JS-dependent pages score 70% lower in AI readiness. Server-rendered content is the #1 prerequisite for AI visibility."
          },
          {
            "name": "Structured Data Foundation",
            "value": "SPA detected — see note below",
            "status": "info",
            "fixLink": {
              "url": "https://zulien.sk",
              "label": "Add structured data →"
            },
            "evidence": {
              "source": "schema"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Without structured data, your store is invisible to AI commerce. Google AI Overviews, ChatGPT Shopping, Perplexity, and Bing Copilot all rely on schema markup to understand and recommend products."
          },
          {
            "name": "Organization Schema + Entity Linking",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel."
          },
          {
            "name": "FAQ Schema (Direct AI Answers)",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "FAQ schema provides 30% higher AI citation rates (LLMClicks research). ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. It's the fastest way to get your content cited by AI."
          },
          {
            "name": "Content Depth for AI",
            "value": "Only 4 words — too thin for AI citation · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Pages under 200 words are nearly invisible to AI search. Average AI-cited page has 800+ words. Without substance, AI has nothing to quote, summarize, or recommend."
          },
          {
            "name": "Answer-First Content Format",
            "value": "No meaningful opening content for AI to extract · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Without a clear opening paragraph, AI assistants can't generate a useful summary of your page. They'll skip to competitor pages that provide immediate, quotable content."
          },
          {
            "name": "Heading Hierarchy for AI",
            "value": "0 H1, 0 H2, 0 H3 — poor structure · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are more accurately parsed by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content."
          },
          {
            "name": "Semantic HTML Structure",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Without semantic HTML, AI must guess content boundaries. This leads to navigation text mixed into product descriptions, footer content cited as main content, and overall poor AI understanding of your pages."
          },
          {
            "name": "Structured Content (Lists & Tables)",
            "value": "No structured content elements found · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Unstructured paragraph-only content is harder for AI to parse and cite. Pages with lists and tables get cited 30-40% more in AI-generated answers because AI can extract specific facts more reliably."
          },
          {
            "name": "Content Freshness Signals",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "No freshness signals = AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages."
          },
          {
            "name": "Entity Clarity & Brand Signals",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors. This is a fundamental AI visibility requirement."
          },
          {
            "name": "Author Expertise Signals (E-E-A-T)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.",
            "whyMatters": "AI models weight author expertise heavily. Pages from identified experts get cited 3x more than anonymous content. This is especially important for product guides, reviews, and advice content."
          },
          {
            "name": "Extractable Answer Blocks",
            "value": "Too few content paragraphs for AI to extract · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "AI assistants extract individual paragraphs as citations. Without clear, self-contained content blocks, your page can't be quoted in AI-generated answers."
          },
          {
            "name": "Statistics & Data Presence",
            "value": "No statistical data found in content",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.",
            "whyMatters": "Content without data is 41% less likely to be cited by AI. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics."
          },
          {
            "name": "Q&A Format Headings",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries."
          },
          {
            "name": "Canonical Tag for AI Deduplication",
            "value": "SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Without a canonical tag, AI models may index multiple versions of the same page (with/without trailing slash, with parameters, etc.), diluting your AI visibility across duplicate URLs."
          },
          {
            "name": "Knowledge Graph Readiness",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.",
            "whyMatters": "Without Knowledge Graph signals, AI treats your brand as unverified. You won't get a Google Knowledge Panel, and AI assistants can't confidently attribute information to your brand."
          },
          {
            "name": "Expert Quotations & Citations",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).",
            "whyMatters": "Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions."
          },
          {
            "name": "ai.txt (AI Permissions)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /ai.txt or /.well-known/ai.txt to declare granular AI permissions per content type: which AI actions (summarization, training, extraction) are allowed for which content sections.",
            "whyMatters": "ai.txt is an emerging standard (proposed May 2025) for fine-grained AI permissions beyond robots.txt. Early adoption signals AI-forward thinking and gives you control over how AI uses your content."
          },
          {
            "name": "WebMCP Agentic Readiness",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.",
            "whyMatters": "WebMCP is called 'the new Schema.org moment' — it's how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard."
          },
          {
            "name": "Content-to-Boilerplate Ratio",
            "value": "No <main> or <article> elements — AI can't isolate content from boilerplate · SPA detected — see note below",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "JS-renderovaná stránka (SPA) — obsah sa načítava cez JavaScript a nie je viditeľný nášmu skeneru. Overte manuálne.\n\nJS-rendered site detected (SPA) — content is loaded client-side and not visible to our raw-HTML scanner. Verify manually or re-run with a headless browser.",
            "whyMatters": "Without semantic containers, AI crawlers must guess where content starts and navigation ends. This leads to poor content extraction and fewer citations."
          },
          {
            "name": "Social Proof (Testimonials / Case Studies)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add at least one form of social proof: 1) Client testimonials as <blockquote> with attribution, 2) Case study / portfolio section with past work, 3) 'Trusted by' client logo strip. For B2B, this is the #1 credibility lever.",
            "whyMatters": "Without visible social proof, B2B prospects can't verify your track record before reaching out. Missing testimonials/case studies is the #1 reason consultancy sites lose qualified leads at the contact stage."
          }
        ]
      },
      "phaseTimings": {
        "total": 1229,
        "phase1": 315,
        "enrichment": 537,
        "sourceMaps": 0,
        "catalogDump": 0
      },
      "vulnerability": {
        "score": 71,
        "checks": [
          {
            "name": "CMS Version Disclosure",
            "value": "No generator tag — CMS identity hidden",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "name": "Sensitive Files Exposed",
            "value": ".env, .git, composer.json — all properly blocked",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "name": "Install Script Exposed",
            "value": "No /install/ or /setup/ paths accessible",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "name": "Directory Listing",
            "value": "Disabled — file structure hidden",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "name": "Admin Panel at Default URL",
            "value": "Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "name": "Debug Mode / Error Exposure",
            "value": "No debug indicators found in page output",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "name": "SPF Record (Email Security)",
            "status": "fail",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Add an SPF TXT record to your DNS: v=spf1 include:_spf.google.com ~all (adjust for your email provider). This tells receiving servers which IPs can send email for your domain.",
            "whyMatters": "Without SPF, anyone can send emails that appear to come from your domain. Since 2024, Google and Yahoo reject email from domains without SPF. Your transactional emails may land in spam."
          },
          {
            "name": "DMARC Policy (Email Auth)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Email Security Setup →"
            },
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.",
            "whyMatters": "Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems."
          },
          {
            "name": "DKIM Signing (Email Auth)",
            "value": "DKIM configured (selectors: mail)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "name": "Cross-Origin Isolation",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.",
            "whyMatters": "Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers."
          },
          {
            "name": "Database/Admin Tool Variant Exposed",
            "value": "phpmyadmin/ publicly accessible — full database/file access!",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Emergency Security Fix →"
            },
            "evidence": {
              "sample": "phpmyadmin/",
              "source": "file-probe"
            },
            "howToFix": "Delete these files/tools from the web root immediately (adminer*.php, backup.php, dev.php, test.php, db_sync.php, phpmyadmin/). Never leave DB tools in production; if you need DB access, tunnel over SSH. Block leftover *.php helpers via .htaccess.",
            "whyMatters": "Adminer/phpMyAdmin and home-grown backup/dev scripts give read-write database access or arbitrary file operations to anyone who finds the URL — the entry point in numerous e-shop breaches. Bots scan for exactly these filenames."
          }
        ]
      },
      "opendata_security": null
    },
    "created_at": "2026-07-01T13:43:41.532331+00:00",
    "status": "complete",
    "platform_detected": null,
    "company_ico": null,
    "company_name": null,
    "company_country": null,
    "company_nace": null,
    "company_size": null,
    "nis2_scope": null,
    "nis2_sector": null,
    "company_risk_score": null,
    "company_risk_level": null
  }
}