{
  "data": {
    "slug": "79ff5e87",
    "url": "https://zlatokov.sk",
    "domain": "zlatokov.sk",
    "overall_score": 64,
    "scores_json": {
      "seo": {
        "score": 73,
        "checks": [
          {
            "i18n": {
              "key": "seo.meta-title.pass",
              "params": {
                "chars": 57,
                "title": "Zlaté šperky s dušou: Ručne vyrobené príbehy od roku 19…"
              }
            },
            "name": "Meta Title",
            "value": "57 chars — \"Zlaté šperky s dušou: Ručne vyrobené príbehy od roku 19…\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.meta-desc.warning-long",
              "params": {
                "chars": 227
              }
            },
            "name": "Meta Description",
            "value": "227 chars (optimal: 120-160)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Trim your meta description to 120-160 characters. Place the most important information and CTA in the first 120 chars.",
            "whyMatters": "Google truncates descriptions over 160 chars. Mobile shows even less (~120 chars)."
          },
          {
            "i18n": {
              "key": "seo.h1.fail"
            },
            "name": "H1 Heading",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add exactly one H1 tag containing your primary keyword. It should be the most prominent heading on the page.",
            "whyMatters": "The H1 is a primary content signal for search engines. Pages without an H1 rank lower for target keywords."
          },
          {
            "i18n": {
              "key": "seo.h2.pass",
              "params": {
                "count": 9
              }
            },
            "name": "Content Structure (H2 Headings)",
            "value": "9 H2 subheadings found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.og.fail"
            },
            "name": "Open Graph Tags",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add og:title, og:description, og:image (1200×630px), and og:type meta tags to every page.",
            "whyMatters": "Without OG tags, social platforms show auto-generated previews. Proper OG tags produce clean, clickable link cards."
          },
          {
            "i18n": {
              "key": "seo.twitter.warning"
            },
            "name": "Twitter/X Cards",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add <meta name='twitter:card' content='summary_large_image'>, twitter:title, and twitter:image tags.",
            "whyMatters": "Twitter Cards make your links stand out in X/Twitter feeds. Without them, shared links appear as plain text URLs."
          },
          {
            "i18n": {
              "key": "seo.canonical.pass",
              "params": {
                "url": "https://zlatokov.sk"
              }
            },
            "name": "Canonical URL",
            "value": "https://zlatokov.sk",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.jsonld.pass",
              "params": {
                "count": 1,
                "types": "Store, ImageObject"
              }
            },
            "name": "Structured Data (JSON-LD)",
            "value": "1 block(s): Store, ImageObject",
            "status": "pass",
            "evidence": {
              "source": "schema"
            }
          },
          {
            "i18n": {
              "key": "seo.jsonld-valid.pass",
              "params": {
                "count": 1
              }
            },
            "name": "JSON-LD Validity",
            "value": "1 block(s) parse cleanly",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.robots.pass"
            },
            "name": "robots.txt",
            "value": "Present",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.sitemap.pass-count-min",
              "params": {
                "count": 897
              }
            },
            "name": "XML Sitemap",
            "value": "Found with at least 897 URLs (only the start was read)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.html-lang.pass",
              "params": {
                "lang": "sk"
              }
            },
            "name": "HTML Language Attribute",
            "value": "lang=\"sk\"",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.hreflang.pass",
              "params": {
                "count": 2,
                "langs": "sk-SK, x-default"
              }
            },
            "name": "Hreflang Tags (Multilingual)",
            "value": "2 language(s): sk-SK, x-default",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.img-alt.warning",
              "params": {
                "rate": 67,
                "total": 63,
                "missing": 21
              }
            },
            "name": "Image Alt Attributes",
            "value": "Only 67% of 63 images have alt text",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "21 images are missing alt attributes. Add descriptive, keyword-rich alt text to every image.",
            "whyMatters": "Missing alt text means no visibility in Google Image Search, which is a real traffic source for e-commerce."
          },
          {
            "i18n": {
              "key": "seo.meta-robots.pass",
              "params": {
                "value": "index, follow"
              }
            },
            "name": "Meta Robots Tag",
            "value": "index, follow",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.text-ratio.info",
              "params": {
                "ratio": 1,
                "words": 744
              }
            },
            "name": "Text-to-HTML Ratio",
            "value": "1% ratio but 744 words — content is substantial; the low ratio is markup/inline-JS bloat, not thin content",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your text content is sufficient. To raise the ratio, move inline <script>/<style> to external files and trim template bloat — this is a performance/cleanliness win, not a content gap.",
            "whyMatters": "Text-to-HTML ratio is only a thin-content signal when actual word count is also low. With 500+ words, search engines have plenty to rank on."
          },
          {
            "i18n": {
              "key": "seo.favicon.pass"
            },
            "name": "Favicon",
            "value": "Favicon detected",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "seo.img-format.warning-partial",
              "params": {
                "rate": 48,
                "legacy": 0
              }
            },
            "name": "Image Format Optimization",
            "value": "Only 48% next-gen formats — 0 legacy images remain",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Convert remaining JPEG/PNG images to WebP (30-50% smaller) or AVIF (50-70% smaller). Use the <picture> element for browser fallback.",
            "whyMatters": "WebP/AVIF images are 30-70% smaller than JPEG/PNG at the same quality. This directly improves page speed, LCP, and mobile experience."
          },
          {
            "i18n": {
              "key": "seo.semantic.warning",
              "params": {
                "count": 3,
                "missing": "<article>, <main>, <aside>"
              }
            },
            "name": "Semantic HTML Structure",
            "value": "Only 3/6 semantic elements — missing: <article>, <main>, <aside>",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Use semantic HTML5 elements: <header>, <nav>, <main>, <article>, <aside>, <footer>. These help search engines understand page structure and improve accessibility.",
            "whyMatters": "Semantic HTML gives search engines clear signals about content structure. Pages with proper semantic markup earn more featured snippets and knowledge panel appearances."
          },
          {
            "i18n": {
              "key": "seo.sitemap-in-robots.warning"
            },
            "name": "Sitemap in robots.txt",
            "value": "robots.txt exists but doesn't reference your sitemap",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add 'Sitemap: https://yourdomain.com/sitemap.xml' to your robots.txt file. This helps search engines discover your sitemap faster.",
            "whyMatters": "While Google can find sitemaps via Search Console, referencing it in robots.txt ensures all search engines (Bing, Yandex, Baidu) can discover it automatically."
          },
          {
            "i18n": {
              "key": "seo.content-depth.pass",
              "params": {
                "words": 744
              }
            },
            "name": "Content Depth",
            "value": "744 words — sufficient content",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.deep-heading.pass",
              "params": {
                "h2": 9,
                "h3": 19
              }
            },
            "name": "Deep Heading Hierarchy",
            "value": "H2: 9, H3: 19 — well-structured content",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.internal-links.pass",
              "params": {
                "count": 43
              }
            },
            "name": "Internal Linking",
            "value": "43 internal links — strong site navigation",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "seo.a11y.warning",
              "params": {
                "missing": "ARIA labels, skip navigation link",
                "signals": 2
              }
            },
            "name": "Accessibility Fundamentals",
            "value": "2/4 a11y signals — missing: ARIA labels, skip navigation link",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add: ARIA landmark roles (role='navigation', role='main'), aria-label on interactive elements, a 'Skip to content' link, and lang attribute on <html>.",
            "whyMatters": "The European Accessibility Act (EAA) takes effect June 2025 for e-commerce. Non-compliant sites face fines. Accessibility also improves SEO, as Google treats it as a ranking signal."
          },
          {
            "i18n": {
              "key": "seo.product-schema.warning",
              "params": {
                "missing": "aggregateRating, review, gtin"
              }
            },
            "name": "Product Schema Richness",
            "value": "Missing recommended: aggregateRating, review, gtin",
            "status": "warning",
            "evidence": {
              "source": "schema",
              "probedUrl": "https://zlatokov.sk/produkty/zlaty-prsten-flowers-i"
            },
            "howToFix": "Add aggregateRating, review, gtin to your Product schema. These fields enable rich snippets with star ratings, price, availability, and brand in search results.",
            "confidence": "medium",
            "whyMatters": "Complete product schema enables rich snippets that lift organic click-through. Products with reviews/ratings in search results see meaningfully higher CTR."
          },
          {
            "i18n": {
              "key": "seo.img-dimensions.warning",
              "params": {
                "rate": 35
              }
            },
            "name": "Image Dimension Attributes",
            "value": "Only 35% of images have width/height attributes",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add width and height attributes to all <img> tags. This prevents layout shifts (CLS) and helps browsers allocate space before images load.",
            "whyMatters": "Missing image dimensions are a leading cause of Cumulative Layout Shift. Google uses CLS as a Core Web Vital ranking factor."
          },
          {
            "i18n": {
              "key": "seo.sitemap-freshness.pass",
              "params": {
                "days": 0
              }
            },
            "name": "Sitemap Freshness",
            "value": "Newest <lastmod> 0 day(s) ago",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          }
        ]
      },
      "gdpr": {
        "score": 75,
        "checks": [
          {
            "i18n": {
              "key": "gdpr.cmp.info",
              "params": {
                "gtmNote": " A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML."
              }
            },
            "name": "Cookie Consent Banner (CMP)",
            "value": "No CMP in server HTML, but GTM is present — consent banner may be injected at runtime (not verifiable server-side)",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic",
              "measured": "1 GTM container(s) detected"
            },
            "howToFix": "Confirm a consent management platform actually loads and blocks non-essential cookies until opt-in. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "confidence": "low",
            "whyMatters": "EU regulators enforce cookie consent (CNIL fined Google €150M). If the CMP is GTM-injected this scan can't confirm it — verify manually."
          },
          {
            "i18n": {
              "key": "gdpr.tracking.info",
              "params": {
                "count": 1,
                "gtmNote": " A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.",
                "trackers": "Google Analytics/GTM"
              }
            },
            "name": "Tracking Scripts & Consent",
            "value": "1 tracker(s) detected (Google Analytics/GTM); no CMP visible in server HTML but GTM is present",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic",
              "measured": "1 GTM container(s) detected"
            },
            "howToFix": "Confirm these trackers are gated behind consent (GTM consent mode / CMP script blocking) before they fire. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "EDPB Opinion 5/2019"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "confidence": "low",
            "whyMatters": "Loading tracking before consent is a direct GDPR/ePrivacy violation, but GTM-managed consent gating isn't visible server-side — verify in the browser."
          },
          {
            "i18n": {
              "key": "gdpr.consent-mode.info",
              "params": {
                "gtmNote": " A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML."
              }
            },
            "name": "Google Consent Mode v2",
            "value": "No Consent Mode signals in server HTML, but GTM is present — Consent Mode is commonly configured inside GTM",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic",
              "measured": "1 GTM container(s) detected"
            },
            "howToFix": "Confirm Google Consent Mode v2 default state (ad_storage/analytics_storage denied) is set in your GTM container. A Google Tag Manager container is present, and CMPs/consent are very often loaded through GTM at runtime — which our server-side HTML scan can't see. Verify in the browser (Cookiebot/OneTrust/Usercentrics + Consent Mode fire on load) or expose the loader in the initial HTML.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7"
              ],
              "skLaw": [
                "§ 14"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "confidence": "low",
            "whyMatters": "Google requires Consent Mode v2 for EU traffic since March 2024, but GTM-side configuration is invisible to a server-side HTML scan — verify manually."
          },
          {
            "i18n": {
              "key": "gdpr.privacy-policy.pass",
              "params": {
                "url": "/ochrana-osobnych-udajov"
              }
            },
            "name": "Privacy Policy Page",
            "value": "/ochrana-osobnych-udajov",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13",
                "Art. 14"
              ],
              "skLaw": [
                "§ 19",
                "§ 20"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 14 — Informácie, ktoré sa majú poskytnúť, ak osobné údaje neboli získané od dotknutej osoby 2. Okrem informácií uvedených v odseku 1 prevádzkovateľ poskytne dotknutej osobe tieto ďalšie informácie potrebné na zabezpečenie spravodliv",
                  "citation": "čl. 14 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby",
                  "excerpt": "§ 20 Poskytované informácie, ak osobné údaje nie sú získané od dotknutej osoby (5) d) ak osobné údaje musia zostať dôverné na základe povinnosti mlčanlivosti podľa osobitného predpisu. 15 )",
                  "citation": "§20 ods. 5 písm. d) zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.cookie-policy.warning"
            },
            "name": "Cookie Policy",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Create a separate cookie policy page listing every cookie by: name, provider, purpose, category (necessary/analytics/marketing), and expiration. Most CMPs auto-generate this.",
            "legalRefs": {
              "gdpr": [
                "Art. 12",
                "Art. 13(1)(c)-(e)"
              ],
              "skLaw": [
                "§ 19"
              ],
              "verified": [
                {
                  "title": "Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 12 — Transparentnosť informácií, oznámenia a postupy výkonu práv dotknutej osoby 3. Prevádzkovateľ poskytne dotknutej osobe informácie o opatreniach, ktoré sa prijali na základe žiadosti podľa článkov 15 až 22, bez zbytočného odklad",
                  "citation": "čl. 12 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 13 — Informácie, ktoré sa majú poskytovať pri získavaní osobných údajov od dotknutej osoby 2. Okrem informácií, ktoré sa uvádzajú v odseku 1, prevádzkovateľ poskytne dotknutej osobe pri získavaní osobných údajov tieto ďalšie informá",
                  "citation": "čl. 13 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby",
                  "excerpt": "§ 19 Poskytované informácie, ak osobné údaje sú získané od dotknutej osoby (4) Odseky 1 až 3 sa neuplatňujú v rozsahu, v akom boli informácie dotknutej osobe poskytnuté pred spracúvaním osobných údajov.",
                  "citation": "§19 ods. 4 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "The ePrivacy Directive requires transparent cookie disclosure. Vague statements like 'we use cookies for functionality' don't meet the specificity requirement."
          },
          {
            "i18n": {
              "key": "gdpr.imprint.pass",
              "params": {
                "url": "/o-nas"
              }
            },
            "name": "Legal Contact / Imprint Page",
            "value": "/o-nas",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.terms.pass",
              "params": {
                "url": "/vseobecne-obchodne-podmienky"
              }
            },
            "name": "Terms & Conditions Page",
            "value": "/vseobecne-obchodne-podmienky",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.mixed-content.pass"
            },
            "name": "Data Encryption (No Mixed Content)",
            "value": "All resources loaded over HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.third-party.pass",
              "params": {
                "count": 1
              }
            },
            "name": "Third-party Data Sharing",
            "value": "1 third-party domain(s)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.intl-transfers.warning",
              "params": {
                "count": 1,
                "trackers": "Google Analytics/GTM"
              }
            },
            "name": "International Data Transfers",
            "value": "1 US-based tracker(s) without consent: Google Analytics/GTM",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "US-based trackers transfer personal data outside the EU. Under GDPR, this requires: 1) User consent via CMP, 2) Standard Contractual Clauses (SCCs) with each provider, 3) Data Transfer Impact Assessment.",
            "whyMatters": "The EU-US Data Privacy Framework covers some transfers, but loading US trackers without consent remains a violation. Austrian and French DPAs have ruled Google Analytics non-compliant without proper safeguards."
          },
          {
            "i18n": {
              "key": "gdpr.erasure.warning"
            },
            "name": "Right to Erasure (Data Deletion)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Provide a clear mechanism for users to request data deletion — either a dedicated page, a form, or explicit instructions in your privacy policy. Include a 'Delete my account' option in user settings.",
            "legalRefs": {
              "gdpr": [
                "Art. 17"
              ],
              "skLaw": [
                "§ 23"
              ],
              "verified": [
                {
                  "title": "Právo na vymazanie (právo „na zabudnutie“)",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 17 — Právo na vymazanie (právo „na zabudnutie“) 1. Dotknutá osoba má tiež právo dosiahnuť u prevádzkovateľa bez zbytočného odkladu vymazanie osobných údajov, ktoré sa jej týkajú, a prevádzkovateľ je povinný bez zbytočného odkladu vy",
                  "citation": "čl. 17 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Právo na výmaz osobných údajov",
                  "excerpt": "§ 23 Právo na výmaz osobných údajov (1) Dotknutá osoba má právo na to, aby prevádzkovateľ bez zbytočného odkladu vymazal osobné údaje, ktoré sa jej týkajú.",
                  "citation": "§23 ods. 1 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR Article 17 gives users the 'right to be forgotten.' EU regulators expect a clear, accessible process, and obstructing erasure requests is a documented enforcement finding."
          },
          {
            "i18n": {
              "key": "gdpr.newsletter.warning"
            },
            "name": "Newsletter Consent",
            "value": "Newsletter signup found without visible consent checkbox",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add an unchecked consent checkbox to your newsletter form: 'I agree to receive marketing emails and have read the Privacy Policy [link].' Pre-checked boxes are not valid consent under GDPR.",
            "legalRefs": {
              "gdpr": [
                "Art. 6(1)(a)",
                "Art. 7",
                "ePrivacy Art. 13"
              ],
              "skLaw": [
                "§ 14",
                "§ 109 zák. 452/2021"
              ],
              "verified": [
                {
                  "title": "Zákonnosť spracúvania",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 6 — Zákonnosť spracúvania 1. Spracúvanie je zákonné iba vtedy a iba v tom rozsahu, keď je splnená aspoň jedna z týchto podmienok: Písmeno f) prvého pododseku sa nevzťahuje na spracúvanie vykonávané orgánmi verejnej moci pri výkone i",
                  "citation": "čl. 6 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                },
                {
                  "title": "—",
                  "excerpt": "§ 109 — (8) Každý, kto ukladá alebo získava prístup k informáciám uloženým v koncovom zariadení užívateľa, je na to oprávnený iba ak užívateľ udelil preukázateľný súhlas spĺňajúci náležitosti podľa osobitného predpisu. 126 ) Povinnosť získa",
                  "citation": "§109 ods. 8 zákona č. 452/2021 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            },
            "whyMatters": "GDPR requires 'freely given, specific, informed' consent for marketing emails. A newsletter form without explicit opt-in violates Article 7, and pre-checked boxes are not valid consent."
          },
          {
            "i18n": {
              "key": "gdpr.dpo.pass"
            },
            "name": "Data Protection Officer Contact",
            "value": "DPO / data protection contact found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "gdpr.withdrawal.pass"
            },
            "name": "Withdrawal of Consent Mechanism",
            "value": "Consent withdrawal / opt-out mechanism found",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Art. 7(3)"
              ],
              "skLaw": [
                "§ 14(4)"
              ],
              "verified": [
                {
                  "title": "Podmienky vyjadrenia súhlasu",
                  "source": "Zdroj: EUR-Lex (eur-lex.europa.eu), © Európska únia, 1998–2026. Autentické je iba znenie publikované v elektronickom Úradnom vestníku Európskej únie.",
                  "excerpt": "Article 7 — Podmienky vyjadrenia súhlasu 1. Ak je spracúvanie založené na súhlase, prevádzkovateľ musí vedieť preukázať, že dotknutá osoba vyjadrila súhlas so spracúvaním svojich osobných údajov. 2. Ak dá dotknutá osoba súhlas v rámci písom",
                  "citation": "čl. 7 nariadenia (EÚ) 2016/679",
                  "jurisdiction": "eu"
                },
                {
                  "title": "Podmienky poskytnutia súhlasu so spracúvaním osobných údajov",
                  "excerpt": "§ 14 Podmienky poskytnutia súhlasu so spracúvaním osobných údajov (1) Ak je spracúvanie osobných údajov založené na súhlase dotknutej osoby, prevádzkovateľ je povinný kedykoľvek vedieť preukázať, že dotknutá osoba poskytla súhlas so spracúv",
                  "citation": "§14 zákona č. 18/2018 Z.z.",
                  "jurisdiction": "sk"
                }
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.age-verification.warning"
            },
            "name": "Age Verification",
            "value": "Age-restricted content detected without age gate",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Implement age verification for alcohol, tobacco, gambling, or adult content. Use a date-of-birth check or age confirmation modal before accessing the site.",
            "whyMatters": "EU member states require age verification for age-restricted products. German JuSchG (Youth Protection Act) and similar laws mandate age gates. Missing them risks regulatory action and marketplace delisting."
          },
          {
            "i18n": {
              "key": "gdpr.omnibus.pass"
            },
            "name": "Omnibus Price Disclosure (30-day low)",
            "value": "Discount with a 30-day reference price detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Smernica (EÚ) 2019/2161 (Omnibus)",
                "Smernica 98/6/ES čl. 6a"
              ],
              "czLaw": [
                "zák. 634/1992 Sb. § 12a"
              ],
              "skLaw": [
                "zák. 108/2024 Z.z."
              ]
            },
            "confidence": "low"
          },
          {
            "i18n": {
              "key": "gdpr.dispute-resolution.fail"
            },
            "name": "Consumer Dispute Resolution Links",
            "value": "No EU ODR platform or supervisory-authority link found",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add the EU ODR platform link (https://ec.europa.eu/consumers/odr) and your national authority (SK: Slovenská obchodná inšpekcia / soi.sk, CZ: Česká obchodní inspekce / coi.cz) to the footer and Terms & Conditions.",
            "legalRefs": {
              "gdpr": [
                "Nariadenie (EÚ) 524/2013 (ODR)",
                "Smernica 2013/11/EÚ (ADR)"
              ],
              "czLaw": [
                "zák. 634/1992 Sb. § 14"
              ],
              "skLaw": [
                "zák. 391/2015 Z.z."
              ]
            },
            "whyMatters": "EU Regulation 524/2013 makes the ODR link mandatory for every online trader; national law requires naming the supervisory authority. ŠOI/ČOI inspect for exactly this, and its absence is a common consumer-law breach."
          },
          {
            "i18n": {
              "key": "gdpr.withdrawal-complaints.pass"
            },
            "name": "Withdrawal & Complaints Policy",
            "value": "Withdrawal right + complaints procedure referenced",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "legalRefs": {
              "gdpr": [
                "Smernica 2011/83/EÚ čl. 6(1)(h),(9)"
              ],
              "czLaw": [
                "zák. 89/2012 Sb. § 1829"
              ],
              "skLaw": [
                "zák. 108/2024 Z.z."
              ]
            }
          },
          {
            "i18n": {
              "key": "gdpr.withdrawal-function.info"
            },
            "name": "Online Withdrawal Function",
            "value": "No explicit online withdrawal button in the server HTML — it may live in the logged-in account/order area, which this scan can't reach. Verify it's present.",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a clearly labelled withdrawal function to your online interface (SK label: 'odstúpiť od zmluvy tu'), easy to find and continuously available during the 14-day withdrawal window — e.g. in the customer account / order detail plus a footer link. A logged-in customer must be able to submit a withdrawal declaration without re-identifying.",
            "confidence": "low",
            "whyMatters": "Directive (EU) 2023/2673 (amending 2011/83/EU), transposed in SK as § 20a zák. 108/2024, requires online traders to provide an easy-to-use withdrawal function — a clearly labelled button, continuously available during the withdrawal period — effective 19 June 2026 for all distance contracts with a right of withdrawal. Orientation only — verify placement manually."
          },
          {
            "i18n": {
              "key": "gdpr.gpsr-manufacturer.warning"
            },
            "name": "GPSR Manufacturer Info",
            "value": "No manufacturer/importer identification found on the sampled product page",
            "status": "warning",
            "evidence": {
              "sample": "",
              "source": "HTML-heuristic",
              "probedUrl": "https://zlatokov.sk/produkty/zlaty-prsten-flowers-i"
            },
            "howToFix": "On every product page state the manufacturer's name, postal address and an electronic contact (email or web form). For goods made outside the EU, also name the EU importer. Structured `manufacturer` in Product schema satisfies this cleanly and is machine-readable.",
            "confidence": "low",
            "whyMatters": "GPSR (Regulation (EU) 2023/988) has been enforceable since 13 December 2024 and requires the responsible economic operator to be identifiable on the offer. IMPORTANT: this is a text heuristic over ONE sampled product page — it is an orientation signal, not a legal assessment. Verify against your own catalogue before acting."
          }
        ]
      },
      "nis2": {
        "score": -1,
        "checks": [
          {
            "i18n": {
              "key": "nis2.scope.none"
            },
            "name": "NIS2 Compliance",
            "value": "Not in scope — your business is below NIS2 thresholds (Annex I/II sector + 50+ employees / €10M+ turnover).",
            "status": "info",
            "howToFix": "",
            "whyMatters": ""
          }
        ]
      },
      "mobile": {
        "score": 60,
        "checks": [
          {
            "i18n": {
              "key": "mob.viewport.warning"
            },
            "name": "Viewport Configuration",
            "value": "Present, but maximum-scale=1 disables pinch-to-zoom",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Remove 'maximum-scale=1' and 'user-scalable=no' from your viewport meta tag. Use: <meta name='viewport' content='width=device-width, initial-scale=1'>",
            "whyMatters": "Preventing pinch-to-zoom is an accessibility violation (WCAG 1.4.4). Users with vision impairments need zoom."
          },
          {
            "i18n": {
              "key": "mob.perf.warning",
              "params": {
                "score": 57
              }
            },
            "name": "Mobile Performance Score",
            "value": "57/100 (target: 90+)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Optimize for mobile: compress images to WebP, defer non-critical JS, reduce CSS file size. Mobile CPUs are several times slower than desktop — what's fast on desktop is slow on mobile.",
            "whyMatters": "Most e-commerce traffic is mobile. Google ranks based on mobile performance, not desktop."
          },
          {
            "i18n": {
              "key": "mob.taptarget.warning",
              "params": {
                "detail": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)"
              }
            },
            "name": "Touch Target Size",
            "value": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "Some tappable targets are too small or too close together (Lighthouse tap-targets audit)"
            },
            "howToFix": "Ensure ALL interactive elements (buttons, links, form fields) are at least 48×48px with 8px minimum spacing between them. Pay special attention to: navigation menus, filter buttons, product variant selectors, and footer links.",
            "whyMatters": "Small tap targets cause mis-taps on mobile. In e-commerce, a mis-tap on 'Remove from cart' instead of 'Checkout' directly loses revenue."
          },
          {
            "i18n": {
              "key": "mob.fontsize.warning",
              "params": {
                "detail": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)"
              }
            },
            "name": "Font Size Readability",
            "value": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "Some text renders below the 12px legibility threshold (Lighthouse font-size audit)"
            },
            "howToFix": "Google's font-size audit flags text under 12px. Find the small text (often footer fine-print, captions, or cookie notices) and raise it; aim for a 16px+ body base with relative units (rem/em) so all text scales legibly on mobile.",
            "whyMatters": "Text below the legibility threshold forces mobile users to pinch-zoom. This measures the actual rendered page (Lighthouse), so it catches sub-12px nodes even when the base font looks fine."
          },
          {
            "i18n": {
              "key": "mob.contentwidth.pass"
            },
            "name": "Content Fits Viewport",
            "value": "No horizontal scrolling needed",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.responsive.pass",
              "params": {
                "techniques": "Flexbox, CSS Grid, Media queries"
              }
            },
            "name": "Responsive Design Techniques",
            "value": "Flexbox, CSS Grid, Media queries detected",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.pwa.warning"
            },
            "name": "PWA Features",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Consider adding Progressive Web App features: 1) Create manifest.json with app name, icons, and theme color, 2) Register a service worker for offline caching. This makes your store installable on mobile.",
            "whyMatters": "PWAs combine the best of web and native apps. For e-commerce, PWAs enable push notifications, offline browsing, and home screen access."
          },
          {
            "i18n": {
              "key": "mob.themecolor.warning"
            },
            "name": "Theme Color",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add <meta name='theme-color' content='#your-brand-color'> to match your brand. Browsers use this to color the address bar, task switcher, and PWA chrome.",
            "whyMatters": "Theme-color creates a polished, branded mobile experience. It makes your site look native and professional."
          },
          {
            "i18n": {
              "key": "mob.nav.pass"
            },
            "name": "Mobile Navigation (Semantic)",
            "value": "<nav> element present — proper navigation landmark",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.inlinecss.warning",
              "params": {
                "kb": 345
              }
            },
            "name": "Inline CSS Size",
            "value": "345 KB of inline CSS",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Extract inline styles to external CSS files. Inline CSS larger than 50 KB increases HTML payload and cannot be cached separately. Keep only critical above-the-fold CSS inline.",
            "whyMatters": "Large inline CSS blocks increase initial HTML download and parsing time — especially painful on mobile with limited CPU and slower connections."
          },
          {
            "i18n": {
              "key": "mob.srcset.warning",
              "params": {
                "count": 63
              }
            },
            "name": "Responsive Images (srcset)",
            "value": "63 images without responsive sizing",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add srcset and sizes attributes to <img> tags to serve appropriately sized images for each screen. Mobile devices shouldn't download 1920px desktop images.",
            "whyMatters": "Without srcset, mobile users download full-size desktop images, wasting bandwidth. Responsive images are the single biggest mobile performance win for image-heavy sites."
          },
          {
            "i18n": {
              "key": "mob.inputtypes.pass",
              "params": {
                "optimized": "1 email"
              }
            },
            "name": "Form Input Types",
            "value": "Optimized: 1 email",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.payments.pass",
              "params": {
                "list": "Tatra Pay, QR platba / Pay by square",
                "count": 2
              }
            },
            "name": "Payment Methods Detected",
            "value": "2 method(s): Tatra Pay, QR platba / Pay by square",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "mob.express.info"
            },
            "name": "Express Checkout (Apple Pay + Google Pay)",
            "value": "Apple Pay / Google Pay nedetekované na homepage — express checkout sa zvyčajne zobrazí až v košíku/checkoute",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Ak express checkout nemáš, pridaj Apple Pay + Google Pay cez Stripe/Adyen/Mollie. Biometric auth = -1 click checkout = vyšší conversion.",
            "whyMatters": "Mobile conversion pri express checkout je vyšší oproti klasickej karte. V SK/CZ rastúci trend. (Sken vidí iba homepage, takže toto je hint, nie verdikt.)"
          },
          {
            "i18n": {
              "key": "mob.skczpay.warning",
              "params": {
                "list": "Tatra Pay, QR platba / Pay by square",
                "count": 2,
                "extra": "PayU"
              }
            },
            "name": "SK/CZ Local Payment Methods",
            "value": "Iba 2 SK/CZ metód (Tatra Pay, QR platba / Pay by square)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Pridaj ďalšie SK/CZ local methods: ComGate, GoPay, Barion, Besteron, PayU. SK zákazníci preferujú bankové tlačidlá a QR platbu pred kartou.",
            "whyMatters": "Veľká časť SK online platieb ide cez lokálne banky alebo QR platbu. Iba karta znamená vysoký cart abandonment na SK trhu."
          },
          {
            "i18n": {
              "key": "mob.wcaglabels.fail",
              "params": {
                "rate": 0,
                "total": 3,
                "missing": 3,
                "withLabel": 0
              }
            },
            "name": "Form Input Labels (WCAG 3.3.2)",
            "value": "Iba 0/3 inputs má label (0%)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "3 input elementov nemá label. Každý input musí mať priradený <label for=\"id\">Text</label> alebo aria-label. Placeholder NIE je label (WCAG 3.3.2). Ak je checkout/registrácia formulár — toto znižuje konverziu a porušuje EN 301 549 (EAA 2026).",
            "whyMatters": "EAA 2026 (European Accessibility Act) vstupuje do platnosti 28.6.2025. E-shopy nad 10 zamestnancov alebo €2M obrat musia byť WCAG 2.1 AA kompatibilné — chýbajúce labely sú jedna z najčastejších žalovateľných chýb."
          },
          {
            "i18n": {
              "key": "mob.wcagheading.warning",
              "params": {
                "skips": "h2→h4"
              }
            },
            "name": "Heading Hierarchy (WCAG 1.3.1)",
            "value": "Preskočené úrovne: h2→h4",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Dodržuj poradie nadpisov h1 → h2 → h3 → h4 bez preskočenia. Screen readers používajú hierarchiu nadpisov na navigáciu. Ak potrebuješ menšie písmo ale rovnakú úroveň, použi CSS triedu, nie nižší heading tag.",
            "whyMatters": "Preskočené heading levely (napr. h1 priamo na h3) zlomia navigáciu pre screen reader používateľov a signalizujú Googlu zlú štruktúru dokumentu. Aj SEO je negatívne ovplyvnené."
          },
          {
            "i18n": {
              "key": "mob.wcaglinks.pass"
            },
            "name": "Link Text Quality (WCAG 2.4.4)",
            "value": "Všetky odkazy majú popisný text",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          }
        ]
      },
      "company": {
        "nis2": {
          "annex": null,
          "sector": null,
          "category": "none",
          "in_scope": false,
          "priority_tier": null,
          "priority_score": null
        },
        "financials": {
          "year": 2025,
          "equity": 6052370,
          "profit": 296688,
          "turnover": 5287066
        },
        "percentile": {
          "metrics": {
            "equity": 40,
            "turnover": 31,
            "net_profit": 39,
            "credit_limit": 40,
            "credit_score": 87,
            "total_assets": 40,
            "debt_to_equity": 23,
            "employee_count": 100
          },
          "nace_section": "G",
          "peer_group_size": 115756
        },
        "in_insolvency": false,
        "credit_grade_full": "A+"
      },
      "modules": [],
      "security": {
        "score": 50,
        "checks": [
          {
            "i18n": {
              "key": "sec.ssl.pass"
            },
            "name": "SSL/TLS Certificate",
            "value": "Valid HTTPS connection established",
            "status": "pass",
            "evidence": {
              "source": "SSL"
            }
          },
          {
            "i18n": {
              "key": "sec.dnssec.warning"
            },
            "name": "DNSSEC",
            "value": "No DNSKEY records — zone is unsigned",
            "status": "warning",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "DNSSEC setup help →"
            },
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Enable DNSSEC at your DNS host (most modern registrars offer 1-click activation: Cloudflare, Route 53, Google Cloud DNS, web.sk, websupport.sk). Verify via dnsviz.net afterwards.",
            "whyMatters": "Without DNSSEC, attackers controlling intermediate resolvers can forge responses for your domain — sending users to phishing sites with valid HTTPS that match your name. EU national CSIRTs (SK-CERT, NÚKIB) recommend DNSSEC for all in-scope entities."
          },
          {
            "i18n": {
              "key": "sec.caa.warning"
            },
            "name": "CAA DNS Record",
            "value": "No CAA records — any CA can issue certificates for this domain",
            "status": "warning",
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Publish CAA TXT records pinning your CA. For Let's Encrypt: `0 issue \"letsencrypt.org\"`. For multiple CAs add additional `0 issue \"...\"` records. Add `0 iodef \"mailto:security@yourdomain.tld\"` for misissuance reports.",
            "whyMatters": "CAA records limit which Certificate Authorities can issue certificates for your domain. Without CAA, a compromised or rogue CA can issue valid certs that browsers will trust — a documented breach pattern (DigiNotar 2011, Symantec 2017)."
          },
          {
            "i18n": {
              "key": "sec.https-redirect.pass"
            },
            "name": "HTTP → HTTPS Redirect",
            "value": "HTTP properly redirects to HTTPS",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.hsts.fail"
            },
            "name": "HSTS (Strict-Transport-Security)",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — then submit to hstspreload.org.",
            "whyMatters": "Without HSTS, attackers can intercept the first HTTP request and downgrade the connection to steal session cookies on public WiFi."
          },
          {
            "i18n": {
              "key": "sec.csp.fail"
            },
            "name": "Content-Security-Policy (CSP)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Security Hardening →"
            },
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Implement a CSP header. Start with: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: — then gradually tighten.",
            "whyMatters": "CSP is a strong defense against XSS attacks. Without it, any injected script runs with full privileges. CSP blocks inline script injection."
          },
          {
            "i18n": {
              "key": "sec.clickjacking.fail"
            },
            "name": "Clickjacking Protection",
            "status": "fail",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add X-Frame-Options: DENY (or SAMEORIGIN if iframes are needed). Better: use CSP frame-ancestors 'self'.",
            "whyMatters": "Clickjacking overlays your site in a hidden iframe. Attackers trick users into clicking buttons (like 'Confirm Purchase') without knowing it."
          },
          {
            "i18n": {
              "key": "sec.x-content-type.warning"
            },
            "name": "X-Content-Type-Options",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: X-Content-Type-Options: nosniff",
            "whyMatters": "Without nosniff, browsers may execute uploaded files as scripts. An attacker could upload a .jpg that's actually JavaScript and trick the browser into running it."
          },
          {
            "i18n": {
              "key": "sec.referrer-policy.warning"
            },
            "name": "Referrer-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add header: Referrer-Policy: strict-origin-when-cross-origin — this is the best balance between functionality and privacy.",
            "whyMatters": "Without a referrer policy, browsers send the full URL to third parties. This can leak sensitive data like session tokens in URLs or internal page paths."
          },
          {
            "i18n": {
              "key": "sec.permissions-policy.warning"
            },
            "name": "Permissions-Policy",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() — disable APIs your site doesn't need.",
            "whyMatters": "Without Permissions-Policy, any third-party script (ads, analytics, chat widgets) can access camera, microphone, and geolocation without your knowledge."
          },
          {
            "i18n": {
              "key": "sec.cookie-flags.warning",
              "params": {
                "count": 1,
                "missing": "1 missing Secure, 1 missing HttpOnly, 1 missing SameSite"
              }
            },
            "name": "Cookie Security Flags",
            "value": "1 cookie(s): 1 missing Secure, 1 missing HttpOnly, 1 missing SameSite",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Set all cookies with: Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF protection). Session cookies MUST have all three.",
            "whyMatters": "Missing Secure flag = cookies sent over HTTP (stealable on WiFi). Missing HttpOnly = cookies readable by XSS. Missing SameSite = vulnerable to CSRF attacks."
          },
          {
            "i18n": {
              "key": "sec.tech-disclosure.warning",
              "params": {
                "detail": "X-Powered-By: Nuxt"
              }
            },
            "name": "Technology Disclosure",
            "value": "X-Powered-By: Nuxt",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Hide server version: set ServerTokens Prod (Apache) or server_tokens off (Nginx). Remove X-Powered-By header completely.",
            "whyMatters": "Exposing exact server/PHP versions lets attackers search CVE databases for specific exploits. This is the first step in most automated attacks."
          },
          {
            "i18n": {
              "key": "sec.sri.pass-exempt"
            },
            "name": "Subresource Integrity (SRI)",
            "value": "All cross-origin scripts are auto-updating provider scripts where SRI does not apply",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "sec.security-txt.warning"
            },
            "name": "security.txt (RFC 9116)",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Create /.well-known/security.txt with Contact, Expires, and Preferred-Languages fields. See securitytxt.org for the generator.",
            "whyMatters": "security.txt lets ethical hackers report vulnerabilities responsibly. Without it, they may disclose publicly or not report at all."
          },
          {
            "i18n": {
              "key": "sec.server-version.pass",
              "params": {
                "name": "Caddy"
              }
            },
            "name": "Server Version Disclosure",
            "value": "Caddy — version hidden",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "sec.cdn.warning"
            },
            "name": "CDN / WAF Protection",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add a CDN/WAF like Cloudflare (free tier), Sucuri, or Fastly. They provide DDoS protection, bot filtering, and SSL management.",
            "whyMatters": "Without a CDN/WAF, your origin server is directly exposed to DDoS attacks, bot traffic, and brute-force attempts."
          },
          {
            "i18n": {
              "key": "sec.cookie-prefix.warning",
              "params": {
                "count": 1
              }
            },
            "name": "Cookie Prefix Security",
            "value": "1 session cookie(s) without __Secure- or __Host- prefix",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Use __Host- prefix for session cookies: __Host-session=abc; Secure; Path=/; HttpOnly. The prefix enforces Secure flag and prevents cookie injection attacks.",
            "confidence": "low",
            "whyMatters": "Cookie prefixes are an extra defense layer — browsers enforce that __Host- cookies are Secure, from the exact domain, and have Path=/. This prevents subdomain cookie injection."
          }
        ]
      },
      "tech_stack": [
        {
          "name": "Bootstrap",
          "version": "5.3.7",
          "category": "css-framework",
          "outdated": false
        },
        {
          "name": "Font Awesome",
          "category": "js-library"
        },
        {
          "name": "Swiper",
          "category": "js-library"
        },
        {
          "name": "Toastr",
          "category": "js-library"
        },
        {
          "name": "Vite",
          "category": "js-library"
        },
        {
          "name": "Caddy",
          "category": "server"
        }
      ],
      "performance": {
        "score": 81,
        "checks": [
          {
            "i18n": {
              "key": "perf.ttfb.pass",
              "params": {
                "ms": 40
              }
            },
            "name": "Server Response Time (TTFB)",
            "value": "40ms",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.fcp.pass",
              "params": {
                "s": "1.32"
              }
            },
            "name": "First Contentful Paint (FCP)",
            "value": "1.32s",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.lcp.pass",
              "params": {
                "s": "2.48"
              }
            },
            "name": "Largest Contentful Paint (LCP)",
            "value": "2.48s — Core Web Vital ✓",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.tbt.pass",
              "params": {
                "ms": 19
              }
            },
            "name": "Total Blocking Time (TBT)",
            "value": "19ms",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.cls.pass",
              "params": {
                "cls": "0.004"
              }
            },
            "name": "Cumulative Layout Shift (CLS)",
            "value": "0.004 — Core Web Vital ✓",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.speed-index.pass",
              "params": {
                "s": "1.47"
              }
            },
            "name": "Speed Index",
            "value": "1.47s",
            "status": "pass",
            "evidence": {
              "source": "PSI-lab"
            }
          },
          {
            "i18n": {
              "key": "perf.page-weight.fail",
              "params": {
                "mb": "5.2",
                "requests": 145
              }
            },
            "name": "Total Page Weight",
            "value": "5.2 MB, 145 requests — too heavy!",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Performance Optimization →"
            },
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Critical: your page is over 3 MB. 1) Convert all images to WebP/AVIF, 2) Lazy load everything below the fold, 3) Remove unused plugins, 4) Combine and minify CSS/JS, 5) Enable brotli compression.",
            "whyMatters": "Pages over 3 MB take 12+ seconds on 3G. The average e-commerce page is around 2 MB — you're well above that. Even small latency increases measurably reduce sales."
          },
          {
            "i18n": {
              "key": "perf.js-budget.warning",
              "params": {
                "kb": 674
              }
            },
            "name": "JavaScript Budget",
            "value": "674 KB — over the 600 KB budget, but below the 1270 KB median of the award-winning shops we benchmarked",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab",
              "measured": "674 KB JavaScript"
            },
            "howToFix": "Split the bundle so a product page doesn't load checkout and account code. Defer third-party scripts until interaction. Drop unused plugin bundles — on most shops these outweigh your own code.",
            "confidence": "high",
            "whyMatters": "Measured on a first load with no interaction, so scripts gated behind cookie consent don't count against you here. The 600 KB bar is best practice, not the cohort average: the shops we benchmarked have a median of 1 270 KB, and the best of them (a category winner that won on mobile) ships 410 KB."
          },
          {
            "i18n": {
              "key": "perf.request-budget.fail",
              "params": {
                "count": 145
              }
            },
            "name": "Request Budget",
            "value": "145 requests — well past both the 80 budget and the cohort median of 140",
            "status": "fail",
            "evidence": {
              "source": "PSI-lab",
              "measured": "145 requests"
            },
            "howToFix": "Start with what loads before first paint: bundle the CSS/JS, sprite the icons, lazy-load every below-fold image, and remove duplicate tag-manager containers loading the same vendor twice.",
            "confidence": "high",
            "whyMatters": "Past ~140 requests the browser spends its time on connection and queueing overhead rather than rendering. The best shop in our benchmark renders with 37."
          },
          {
            "i18n": {
              "key": "perf.third-party-budget.info"
            },
            "name": "Third-party Services",
            "value": "Not measured — PageSpeed did not return the third-party audit for this URL",
            "status": "info",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Re-run the scan, or check the third-party summary directly at PageSpeed Insights.",
            "whyMatters": "We report this as unmeasured rather than as zero third parties, because those are very different findings."
          },
          {
            "i18n": {
              "key": "perf.render-blocking.info"
            },
            "name": "Render-blocking Resources",
            "value": "Not measured — PageSpeed did not return the render-blocking audit for this URL",
            "status": "info",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Re-run the scan, or test directly at PageSpeed Insights. This metric needs a successful Lighthouse lab run."
          },
          {
            "i18n": {
              "key": "perf.unused-code.fail",
              "params": {
                "kb": 373
              }
            },
            "name": "Unused Code (CSS + JS)",
            "value": "373 KB wasted on unused code!",
            "status": "fail",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "You're loading 373 KB of code that isn't used on this page. 1) Audit plugins and remove unused ones, 2) Use code-splitting for page-specific JS, 3) Run PurgeCSS on your stylesheets.",
            "whyMatters": "Over 200 KB of unused code significantly slows parsing and execution. This is one of the easiest performance wins — removing dead code requires no trade-offs."
          },
          {
            "i18n": {
              "key": "perf.text-compression.pass"
            },
            "name": "Text Compression (gzip/brotli)",
            "value": "All text resources properly compressed",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "perf.resource-hints.pass",
              "params": {
                "preload": 9,
                "preconnect": 0
              }
            },
            "name": "Resource Hints (Preload/Preconnect)",
            "value": "9 preload, 0 preconnect hint(s)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.lazy-load.warning",
              "params": {
                "total": 63
              }
            },
            "name": "Lazy Loading",
            "value": "63 images without lazy loading",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add loading='lazy' to all images below the fold. Keep the hero/LCP image eager-loaded. Native lazy loading is supported by all modern browsers.",
            "whyMatters": "Without lazy loading, ALL images download on page load — even those never scrolled to. On a product page with 20 images, lazy loading can save most of the initial download."
          },
          {
            "i18n": {
              "key": "perf.cache-control.info"
            },
            "name": "Cache-Control Strategy",
            "value": "Not measured — no Cache-Control on the HTML document; static-asset caching was not sampled",
            "status": "info",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Ensure static assets (CSS/JS/images) are served with 'Cache-Control: max-age=31536000, immutable' and versioned filenames. HTML can stay 'max-age=0, must-revalidate'.",
            "whyMatters": "Asset caching can eliminate a large share of requests for repeat visitors. We only see the HTML response here, so this is a hint, not a verdict."
          },
          {
            "i18n": {
              "key": "perf.http3.pass"
            },
            "name": "HTTP/3 (QUIC) Support",
            "value": "HTTP/3 enabled via Alt-Svc header",
            "status": "pass",
            "evidence": {
              "source": "HTTP-header"
            }
          },
          {
            "i18n": {
              "key": "perf.script-strategy.pass",
              "params": {
                "rate": 100,
                "async": 1,
                "defer": 0,
                "module": 1
              }
            },
            "name": "Script Loading Strategy",
            "value": "100% of scripts use async/defer/module (1 async, 0 defer, 1 module)",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.css-count.warning",
              "params": {
                "count": 7
              }
            },
            "name": "CSS File Count",
            "value": "7 CSS files loaded — HTTP/2+/3 multiplexing reduces the per-file connection cost",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Consolidate CSS files by bundling them into 1-3 files. Each CSS file is a separate HTTP request that blocks rendering until downloaded.",
            "whyMatters": "Each render-blocking CSS file adds network latency. Consolidating CSS from 8 to 2 files can save 200-400ms on first load."
          },
          {
            "i18n": {
              "key": "perf.font-preload.pass",
              "params": {
                "count": 6
              }
            },
            "name": "Font Preloading",
            "value": "6 font(s) preloaded — faster text rendering",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "perf.critical-css.warning",
              "params": {
                "count": 7
              }
            },
            "name": "Critical CSS Strategy",
            "value": "7 CSS files without critical CSS extraction",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Extract critical above-the-fold CSS and inline it in <head>. Load remaining CSS asynchronously: <link rel='preload' href='styles.css' as='style' onload='this.rel=\"stylesheet\"'>.",
            "whyMatters": "Render-blocking CSS delays first paint. Inlining critical CSS eliminates the render-blocking round trip — the biggest FCP improvement for CSS-heavy sites."
          },
          {
            "i18n": {
              "key": "perf.inline-js.warning",
              "params": {
                "kb": 568
              }
            },
            "name": "Inline JavaScript Size",
            "value": "568 KB of inline JavaScript",
            "status": "warning",
            "evidence": {
              "source": "PSI-lab"
            },
            "howToFix": "Move large inline scripts to external files. Inline JS over 100 KB inflates HTML, prevents caching, and blocks the parser. External files can be cached, compressed, and deferred.",
            "whyMatters": "Large inline scripts cannot be cached separately — they're re-downloaded with every page load. Moving them to external files with defer enables HTTP caching and parallel downloads."
          }
        ]
      },
      "ai_readiness": {
        "score": 51,
        "checks": [
          {
            "i18n": {
              "key": "air.bot-access.pass",
              "params": {
                "detail": "No AI bot restrictions (allowed by default)"
              }
            },
            "name": "AI Bot Access Policy",
            "value": "No AI bot restrictions (allowed by default)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "air.llms-txt.fail"
            },
            "name": "llms.txt (AI Site Descriptor)",
            "value": "Not present — not required for AI visibility",
            "status": "info",
            "fixLink": {
              "url": "https://llmstxt.org",
              "label": "About llms.txt →"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Optional: /llms.txt (a Markdown site descriptor per llmstxt.org) is future-proofing, mainly consumed by coding/IDE agents. It does NOT affect whether ChatGPT/Perplexity/Gemini cite your store. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead.",
            "whyMatters": "No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md."
          },
          {
            "i18n": {
              "key": "air.llms-full.warning"
            },
            "name": "llms-full.txt (Complete AI Content)",
            "value": "Not present — not required for AI visibility",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "No answer engine consumes llms.txt for AI-search citation today (2026) — adoption is ~8.7% and Google declined to support it. It's optional future-proofing, mainly read by coding/IDE agents. Prioritize AI-crawler access, server-rendered content, statistics and cited sources instead. See /ai-readiness-methodology.md."
          },
          {
            "i18n": {
              "key": "air.content-access.pass",
              "params": {
                "ratio": "0.5",
                "words": 744
              }
            },
            "name": "Content Accessibility for AI",
            "value": "744 words in raw HTML (0.5% text ratio) — readable by AI crawlers without executing JS",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.schema-foundation.warning-single",
              "params": {
                "note": "",
                "type": "BusinessEntity"
              }
            },
            "name": "Structured Data Foundation",
            "value": "Only 1 distinct schema type (BusinessEntity) — insufficient for AI visibility",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "One schema type is not enough. Add at minimum: Organization (identity), Product (commerce), BreadcrumbList (navigation), WebSite+SearchAction (discoverability), FAQPage (Q&A answering).",
            "whyMatters": "Single-schema sites get minimal AI coverage. AI models need multiple data signals to confidently recommend your store."
          },
          {
            "i18n": {
              "key": "air.product-schema.warning",
              "params": {
                "pct": 79,
                "missing": "aggregateRating, priceValidUntil, gtin/mpn"
              }
            },
            "name": "Product Schema Completeness",
            "value": "79% complete — missing: aggregateRating, priceValidUntil, gtin/mpn (sampled product page: https://zlatokov.sk/produkty/zlaty-prsten-flowers-i)",
            "status": "warning",
            "evidence": {
              "source": "schema",
              "probedUrl": "https://zlatokov.sk/produkty/zlaty-prsten-flowers-i"
            },
            "howToFix": "Add missing Product schema fields: aggregateRating, priceValidUntil, gtin/mpn. Each field improves how AI presents your products. Especially add aggregateRating, since products with ratings show more prominently in AI shopping results.",
            "confidence": "medium",
            "whyMatters": "Incomplete Product schema means AI shows partial product info. Google Shopping and AI assistants skip products missing price, availability, or images — your competitors with complete schemas win."
          },
          {
            "i18n": {
              "key": "air.org-schema.fail"
            },
            "name": "Organization Schema + Entity Linking",
            "status": "fail",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add Organization (or LocalBusiness for physical stores) schema with: name, logo, url, description, contactPoint, address, and sameAs linking to all your official profiles (LinkedIn, Facebook, Wikipedia if available).",
            "whyMatters": "Organization schema is the foundation of your AI identity. Without it, AI assistants can't confidently attribute information to your brand, verify your legitimacy, or show your Knowledge Panel."
          },
          {
            "i18n": {
              "key": "air.faq-schema.warning"
            },
            "name": "FAQ Schema (Direct AI Answers)",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add FAQPage schema to every product page and category page. Include 3-5 Q&As per page covering: product specifications, shipping, returns, usage instructions. Format: question (full sentence) + answer (75-150 words).",
            "whyMatters": "ChatGPT, Perplexity, and Google AI Overviews pull FAQ answers verbatim. FAQ schema is one of the fastest ways to get your content cited by AI."
          },
          {
            "i18n": {
              "key": "air.breadcrumb.warning"
            },
            "name": "Breadcrumb Schema",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add BreadcrumbList schema reflecting your category hierarchy: Home → Category → Subcategory → Product. Each item needs name and URL.",
            "whyMatters": "AI assistants use breadcrumbs to understand product categorization and site structure. Without it, AI can't contextualize where products fit in your catalog — e.g., 'Running Shoes' under 'Sports > Footwear > Running'."
          },
          {
            "i18n": {
              "key": "air.sitesearch.warning"
            },
            "name": "Site Search Schema (SearchAction)",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add WebSite schema with potentialAction: SearchAction. Define your search URL template so AI assistants and Google can search your store programmatically.",
            "whyMatters": "SearchAction enables Google's sitelinks search box and allows AI shopping assistants to search your catalog directly. It's how AI agents find specific products in your store."
          },
          {
            "i18n": {
              "key": "air.content-depth.pass",
              "params": {
                "words": 744
              }
            },
            "name": "Content Depth for AI",
            "value": "744 words — rich content for AI analysis and citation",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.answer-first.warning"
            },
            "name": "Answer-First Content Format",
            "value": "Content doesn't start with a strong summary paragraph",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Place your most important information in the first 100 words of the page. Use the BLUF method (Bottom Line Up Front): start with what the product IS and why it matters, then elaborate.",
            "whyMatters": "AI assistants extract content from the first 100 words to generate summaries. Most AI systems read top-down, so answer-first pages get cited more often."
          },
          {
            "i18n": {
              "key": "air.headings.fail",
              "params": {
                "h1": 0,
                "h2": 9,
                "h3": 19
              }
            },
            "name": "Heading Hierarchy for AI",
            "value": "0 H1, 9 H2, 19 H3 — poor structure",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Use exactly 1 H1 (page title), then organize content with H2 sections and H3 subsections. Each heading should describe the content that follows. Never skip heading levels (H1→H3 without H2).",
            "whyMatters": "AI extracts information based on heading structure. Pages with proper H1→H2→H3 hierarchy are parsed more accurately by ChatGPT, Perplexity, and Google AI Overviews. Without it, AI may misinterpret your content."
          },
          {
            "i18n": {
              "key": "air.semantic-html.warning",
              "params": {
                "count": 3,
                "missing": "<article>, <main>, <aside>"
              }
            },
            "name": "Semantic HTML Structure",
            "value": "3/6 elements — missing: <article>, <main>, <aside>",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add: <article>, <main>, <aside>. Semantic HTML tells AI what's content (<article>), navigation (<nav>), sidebar (<aside>), etc. — without relying on CSS classes or visual layout.",
            "whyMatters": "AI crawlers don't see your CSS. They rely on semantic HTML to distinguish main content from navigation, ads, and boilerplate."
          },
          {
            "i18n": {
              "key": "air.structured-content.warning-partial",
              "params": {
                "what": "15 lists",
                "missing": "comparison tables"
              }
            },
            "name": "Structured Content (Lists & Tables)",
            "value": "15 lists found — consider adding comparison tables",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add comparison tables to your content. Use <ul>/<ol> for feature lists, specifications, and benefits. Use <table> for product comparisons, pricing tiers, and specifications. AI extracts structured content much faster than paragraphs.",
            "whyMatters": "AI models are biased toward extracting data from HTML lists and tables. Perplexity and ChatGPT pull bullet points and table data with higher accuracy than paragraph text."
          },
          {
            "i18n": {
              "key": "air.freshness.fail"
            },
            "name": "Content Freshness Signals",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add dateModified and datePublished to your JSON-LD schema, and display a visible 'Last updated' date on the page. Update content quarterly at minimum. AI heavily favors fresh, maintained content.",
            "whyMatters": "With no freshness signals, AI assumes your content is stale. ChatGPT and Perplexity both weight recency in their citation algorithms. Competitors who show recent updates will be cited instead of your static pages."
          },
          {
            "i18n": {
              "key": "air.entity-clarity.fail"
            },
            "name": "Entity Clarity & Brand Signals",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Your brand has weak entity signals. Add: 1) Complete OG meta tags, 2) Organization schema with sameAs linking to all official profiles, 3) Consistent NAP (Name, Address, Phone) across the web.",
            "whyMatters": "AI assistants must be confident about entity identity before making recommendations. Without clear brand signals, AI defaults to better-known competitors."
          },
          {
            "i18n": {
              "key": "air.eeat.warning-noarticle"
            },
            "name": "Author Expertise Signals (E-E-A-T)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "For content pages (blog, guides, about): add Article/BlogPosting schema with author property linking to Person schema. Include the author's jobTitle, credentials, and social profiles.",
            "whyMatters": "AI models weight author expertise heavily. Pages from identified experts get cited more than anonymous content. This is especially important for product guides, reviews, and advice content."
          },
          {
            "i18n": {
              "key": "air.review-schema.info",
              "params": {
                "pageType": "homepage"
              }
            },
            "name": "Reviews & Ratings Schema",
            "value": "No review schema on this homepage — review/rating schema typically lives on product pages",
            "status": "info",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Scan a product URL to audit review schema. On product pages add AggregateRating (ratingValue, reviewCount, bestRating) and individual Review schemas.",
            "whyMatters": "Review schema is product-page-specific, so its absence here is expected, not a defect."
          },
          {
            "i18n": {
              "key": "air.ai-plugin.warning"
            },
            "name": "AI Plugin Manifest",
            "value": "Not present — not required (the ChatGPT-plugins manifest was retired in 2024)",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "ai-plugin.json belonged to the retired ChatGPT-plugins system. Modern agent integration uses MCP / tool APIs — see the WebMCP / Agent-Commerce Readiness signals instead."
          },
          {
            "i18n": {
              "key": "air.product-feed.warning"
            },
            "name": "Product Feed (AI Commerce)",
            "status": "warning",
            "fixLink": {
              "url": "https://audit.mergado.com/",
              "label": "Free feed audit — Mergado"
            },
            "evidence": {
              "sample": "probed /feed/products.xml, /google-shopping.xml, /export/google-shopping.xml — none returned a product feed",
              "source": "file-probe"
            },
            "howToFix": "Create a Google Merchant Center / product feed (XML or CSV). Expose it at a consistent URL and reference it in your sitemap. AI shopping assistants and comparison engines use product feeds for catalog discovery. Tip: validate your Heureka / Zboží / Glami / Merchant feeds for free with Mergado's audit.",
            "whyMatters": "Product feeds power Google Shopping, Bing Shopping, and increasingly AI commerce. Without a structured product feed, AI agents can't efficiently index your full catalog for product recommendations."
          },
          {
            "i18n": {
              "key": "air.gtin-coverage.info-nofeed"
            },
            "name": "GTIN/EAN Coverage",
            "value": "No product feed was sampled — GTIN/EAN coverage could not be verified",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Publish a Google Merchant or Heureka product feed with GTIN/EAN populated, then re-scan to measure coverage.",
            "whyMatters": "GTIN is how an AI shopping agent matches your product to the same product in other shops. Without a feed we cannot measure it — this is not a finding against you."
          },
          {
            "i18n": {
              "key": "air.heureka-feed.warning-missing"
            },
            "name": "Heureka XML Feed",
            "status": "warning",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Setup Heureka Feed — Inger"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Vygeneruj Heureka XML feed na /feed/heureka.xml (alebo /export/heureka.xml). PrestaShop má modul Heureka.cz, WooCommerce má pluginy. Štruktúra: <SHOP><SHOPITEM>...</SHOPITEM></SHOP> s ITEM_ID/PRODUCTNAME/URL/PRICE_VAT/CATEGORYTEXT (povinné) + EAN/PARAM/DELIVERY_DATE (highly recommended pre ranking).",
            "whyMatters": "Heureka.sk a Heureka.cz sú dominantné cenové porovnávače na SK/CZ trhu. Bez XML feedu nie ste viditeľní na hlavnom trhovisku. Žiaden generický audit tool toto nekontroluje."
          },
          {
            "i18n": {
              "key": "air.speakable.warning"
            },
            "name": "Speakable Content (Voice AI)",
            "value": "Not present — optional; SpeakableSpecification has limited assistant adoption",
            "status": "info",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.extractable.warning-short",
              "params": {
                "avg": 15,
                "count": 11
              }
            },
            "name": "Extractable Answer Blocks",
            "value": "11 paragraphs, avg 15 words — too short for citation",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Optimal paragraphs for AI citation are 40-80 words. Break long paragraphs into focused, self-contained answer blocks. Each should make one clear point that AI can extract and quote.",
            "whyMatters": "AI extracts individual paragraphs as answer snippets — dense walls of text get skipped. Focused 40-80 word paragraphs are the most citable."
          },
          {
            "i18n": {
              "key": "air.statistics.warning-none"
            },
            "name": "Statistics & Data Presence",
            "value": "No statistical data found in content",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add numbers: pricing comparisons, performance metrics, customer statistics, industry benchmarks. Specific data (e.g., '99.9% uptime', '4.8/5 rating from 2,400 reviews') is what AI quotes most.",
            "whyMatters": "Content without data is harder to cite. Perplexity and ChatGPT specifically seek pages with quantified claims and verifiable statistics."
          },
          {
            "i18n": {
              "key": "air.section-length.warning",
              "params": {
                "avg": 59,
                "ratio": 22
              }
            },
            "name": "Section Length Optimization",
            "value": "Avg section: 59 words — only 22% in 80-200 word optimal range",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Restructure content into sections of 120-180 words between H2/H3 headings. Each section should cover one topic completely. Split sections over 300 words, expand sections under 80 words.",
            "whyMatters": "For Google AI Overviews, 100-150 words per section is the sweet spot — long sections get skipped and very short ones lack substance."
          },
          {
            "i18n": {
              "key": "air.qa-headings.warning-none"
            },
            "name": "Q&A Format Headings",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add H2/H3 headings phrased as questions your customers ask: 'How much does shipping cost?', 'What sizes are available?', 'How do I return an item?' Follow each with a direct, concise answer.",
            "whyMatters": "Q&A content format matches how people query AI assistants. Without question-format headings, your content is harder for AI to map to user queries."
          },
          {
            "i18n": {
              "key": "air.question-coverage.pass",
              "params": {
                "n": 4,
                "labels": "price, shipping, returns/refunds, payment"
              }
            },
            "name": "Common Question Coverage",
            "value": "Answers 4/5 key shopper questions: price, shipping, returns/refunds, payment",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.internal-links.pass",
              "params": {
                "rate": 58
              }
            },
            "name": "Internal Link Density",
            "value": "58 contextual internal links per 1,000 words — strong knowledge graph signal",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.canonical.pass"
            },
            "name": "Canonical Tag for AI Deduplication",
            "value": "Self-referencing canonical — clean signal for AI",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "air.return-policy.warning"
            },
            "name": "Return Policy Schema",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add MerchantReturnPolicy schema with: returnPolicyCategory (e.g., MerchantReturnFiniteReturnWindow), merchantReturnDays, returnMethod, returnFees. Link it from Product/Offer via hasMerchantReturnPolicy.",
            "whyMatters": "AI shopping agents (Google Shopping, ChatGPT, Bing Copilot) filter by return flexibility. Products with return policy schema get priority placement in AI product comparisons."
          },
          {
            "i18n": {
              "key": "air.delivery-promise.info"
            },
            "name": "Delivery Promise",
            "value": "No delivery timing was found in the text of the sampled product page",
            "status": "info",
            "evidence": {
              "sample": "",
              "source": "HTML-heuristic",
              "probedUrl": "https://zlatokov.sk/produkty/zlaty-prsten-flowers-i"
            },
            "howToFix": "Show expected delivery on the product page itself, not only in the shipping-terms page: a weekday or date plus the order cut-off time.",
            "confidence": "low",
            "whyMatters": "Customers decide at the product page. Timing that only lives in a terms page is not part of that decision. Note: this reads page text, so unusual phrasing can be missed — verify before acting."
          },
          {
            "i18n": {
              "key": "air.shipping-schema.warning"
            },
            "name": "Shipping Details Schema",
            "status": "warning",
            "evidence": {
              "source": "schema"
            },
            "howToFix": "Add OfferShippingDetails schema with: shippingRate, shippingDestination, deliveryTime (handlingTime + transitTime). AI agents deprioritize products without shipping info.",
            "whyMatters": "Fulfillment speed factors into AI product recommendations. Complete shipping schema means AI can show 'Free shipping, delivers in 2-3 days' — a strong conversion driver."
          },
          {
            "i18n": {
              "key": "air.kg-readiness.fail"
            },
            "name": "Knowledge Graph Readiness",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Build your Knowledge Graph entity: 1) Add @id to Organization JSON-LD, 2) Use identical brand name in title, schema, and OG, 3) Add sameAs to Wikipedia/Wikidata/LinkedIn, 4) Use multiple corroborating schema types.",
            "whyMatters": "Without Knowledge Graph signals, AI treats your brand as unverified. You won't get a Google Knowledge Panel, and AI assistants can't confidently attribute information to your brand."
          },
          {
            "i18n": {
              "key": "air.readability.warning-high-technical",
              "params": {
                "grade": 20
              }
            },
            "name": "Content Readability for AI",
            "value": "Grade 20 — too complex for broad AI citation (technical threshold: 14)",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Simplify sentences (target 15-20 words average), use common words, break complex ideas into shorter paragraphs. AI extracts content for general audiences — if it's too academic, AI skips it.",
            "whyMatters": "Content above grade 12 readability is harder for AI to extract as clear, concise answers. Pages using clear headers and approachable language are cited more often."
          },
          {
            "i18n": {
              "key": "air.alt-text.fail",
              "params": {
                "pct": 11,
                "poor": 21,
                "missing": 21
              }
            },
            "name": "Image Alt Text Quality for AI",
            "value": "Only 11% quality alt text — 21 missing, 21 poor",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Audit all images: add descriptive alt text (3-15 words) to every <img>. Include product names, features, materials, colors. This is critical for visual AI search and accessibility compliance.",
            "whyMatters": "Poor alt text means your product images are invisible to AI visual search (Google Lens, Bing Visual Search). This is also an accessibility requirement (WCAG 2.1 AA) — many regions enforce this legally."
          },
          {
            "i18n": {
              "key": "air.expert-quotes.warning-none"
            },
            "name": "Expert Quotations & Citations",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add 2-3 expert quotes or data citations per major page. Use <blockquote> for quotes and link to authoritative sources (.gov, .edu, Wikipedia, industry reports).",
            "whyMatters": "Content without citations or expert quotes appears unverified to AI. AI assistants prefer content backed by named sources, data references, and expert opinions."
          },
          {
            "i18n": {
              "key": "air.ai-txt.warning"
            },
            "name": "ai.txt (AI Permissions)",
            "value": "Not present — optional; AI-bot permissions are enforced via robots.txt, not ai.txt",
            "status": "info",
            "evidence": {
              "source": "file-probe"
            },
            "whyMatters": "ai.txt is an emerging fine-grained AI-permissions proposal not yet honored by the major engines. The robots.txt AI-bot rules are the signal that actually gates crawler access."
          },
          {
            "i18n": {
              "key": "air.webmcp.warning"
            },
            "name": "WebMCP Agentic Readiness",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "WebMCP (W3C Community Group standard, Chrome 146+) lets pages declare structured tools for AI agents. Add toolname and tooldescription attributes to <form> elements, or include a <script type='application/webmcp+json'> manifest.",
            "whyMatters": "WebMCP is how AI agents will interact with your store (search products, add to cart, check availability). Google and Microsoft are co-developing this standard."
          },
          {
            "i18n": {
              "key": "air.boilerplate.warning-nomain"
            },
            "name": "Content-to-Boilerplate Ratio",
            "value": "No <main> or <article> elements — AI can't isolate content from boilerplate",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add <main> around your primary content and <article> around self-contained content blocks. This creates clear boundaries for AI content extraction.",
            "whyMatters": "Without semantic containers, AI crawlers must guess where content starts and navigation ends. This leads to poor content extraction and fewer citations."
          },
          {
            "i18n": {
              "key": "air.trust-widget.warning"
            },
            "name": "Trust Widget",
            "value": "Žiaden trust widget (Heureka / Trustpilot / AggregateRating) nedetekovaný",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Pre SK/CZ shopy: inštaluj Heureka Ověřeno zákazníky widget (zadarmo pre overených predajcov — https://sluzby.heureka.sk). Alternatívne: Trustpilot, Google Reviews s AggregateRating schema. Trust widget na product + kategória + footer.",
            "whyMatters": "SK/CZ kupujúci majú vyššiu dôveru k Heureka Ověřeno ako k iným trust signálom. LLM-y (ChatGPT, Perplexity) a Google SGE citujú shopy s AggregateRating schema prednostne."
          },
          {
            "i18n": {
              "key": "agc.summary.partial",
              "params": {
                "parts": "Access 100 · Understand 33 · Discover 50 · Transact 50",
                "score": 58
              }
            },
            "name": "Agent-Commerce Readiness",
            "value": "58/100 — partly ready (Access 100 · Understand 33 · Discover 50 · Transact 50)",
            "status": "info",
            "whyMatters": "Whether an autonomous shopping agent (a ChatGPT operator, Perplexity, the assistants coming next) can do four things on your shop: get in, read and understand the products, discover the whole catalogue, and act (cart, terms). Almost nobody measures this, and for SK/CZ shops nobody does. The score folds AI-bot access, Product schema, product feeds (Merchant/Heureka/Zboží), WebMCP and purchase terms into one agent-first view. It feeds the public MCP connector now in preparation (\"scan this shop\")."
          },
          {
            "i18n": {
              "key": "agc.cap.access.info",
              "params": {
                "score": 100,
                "present": 2
              }
            },
            "name": "Agent: Access",
            "value": "100/100 (2 signals)",
            "status": "info"
          },
          {
            "i18n": {
              "key": "agc.cap.understand.info",
              "params": {
                "score": 33,
                "present": 3
              }
            },
            "name": "Agent: Understand",
            "value": "33/100 (3 signals)",
            "status": "info"
          },
          {
            "i18n": {
              "key": "agc.cap.discover.info",
              "params": {
                "score": 50,
                "present": 3
              }
            },
            "name": "Agent: Discover",
            "value": "50/100 (3 signals)",
            "status": "info"
          },
          {
            "i18n": {
              "key": "agc.cap.transact.info",
              "params": {
                "score": 50,
                "present": 3
              }
            },
            "name": "Agent: Transact",
            "value": "50/100 (3 signals)",
            "status": "info"
          }
        ]
      },
      "phaseTimings": {
        "tail": 3893,
        "total": 15555,
        "phase1": 10588,
        "preflight": 747,
        "phase1.dns": 343,
        "phase1.html": 3464,
        "phase1.files": 10585,
        "phase1.zbozi": 4002,
        "phase1.headers": 3906,
        "phase1.heureka": 4001,
        "phase1.merchant": 4002
      },
      "accessibility": {
        "score": 16,
        "checks": [
          {
            "i18n": {
              "key": "a11y.lang.pass",
              "params": {
                "lang": "sk"
              }
            },
            "name": "Page Language",
            "value": "<html lang=\"sk\"> is set",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "a11y.alt.fail",
              "params": {
                "total": 63,
                "missing": 21
              }
            },
            "name": "Image Alt Text",
            "value": "21 of 63 images have no alt attribute",
            "status": "fail",
            "weight": 2,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add descriptive alt text to every meaningful image; use alt=\"\" for purely decorative ones so screen readers skip them.",
            "whyMatters": "Images without alt text are invisible to blind users and to Google Images. EN 301 549 § 9.1.1.1 (WCAG 1.1.1) requires a text alternative for all non-text content."
          },
          {
            "i18n": {
              "key": "a11y.forms.fail",
              "params": {
                "total": 3,
                "unlabeled": 3
              }
            },
            "name": "Form Labels",
            "value": "3 of 3 form inputs have no associated label",
            "status": "fail",
            "weight": 2,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Associate every input with a <label for> (or aria-label / aria-labelledby). Placeholders are not labels.",
            "whyMatters": "Unlabelled fields leave screen-reader users guessing what to type — search, newsletter and checkout forms become unusable. EN 301 549 § 9.1.3.1 / 9.4.1.2 (WCAG 1.3.1 / 4.1.2)."
          },
          {
            "i18n": {
              "key": "a11y.headings.no-h1"
            },
            "name": "Heading Structure",
            "value": "The page has no <h1> heading",
            "status": "fail",
            "weight": 2,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add exactly one <h1> describing the page, then use <h2>/<h3> in order without skipping levels.",
            "whyMatters": "Screen-reader users navigate by headings; a missing or broken heading outline forces them to read linearly. EN 301 549 § 9.1.3.1 / 9.2.4.6 (WCAG 1.3.1 / 2.4.6)."
          },
          {
            "i18n": {
              "key": "a11y.links.pass"
            },
            "name": "Link Text",
            "value": "Links use descriptive text",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "confidence": "low"
          },
          {
            "i18n": {
              "key": "a11y.landmarks.no-main"
            },
            "name": "Landmark Regions",
            "value": "No <main> landmark region found",
            "status": "fail",
            "weight": 1,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Wrap the primary content in <main> and use <nav>, <header>, <footer> for the page regions.",
            "whyMatters": "Landmarks let assistive-tech users jump straight to the main content and skip repeated navigation. EN 301 549 § 9.1.3.1 (WCAG 1.3.1)."
          },
          {
            "i18n": {
              "key": "a11y.zoom.blocked"
            },
            "name": "Zoom & Scaling",
            "value": "The viewport meta tag disables pinch-zoom (user-scalable=no / maximum-scale=1)",
            "status": "fail",
            "weight": 2,
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Remove user-scalable=no and maximum-scale from the viewport tag: <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">.",
            "whyMatters": "Blocking zoom stops low-vision users from enlarging text on mobile — a direct EN 301 549 § 9.1.4.4 (WCAG 1.4.4) failure and a common EAA audit finding."
          },
          {
            "i18n": {
              "key": "a11y.skiplink.missing"
            },
            "name": "Skip Link",
            "value": "No skip-to-content link detected",
            "status": "warning",
            "weight": 1,
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add a visually-hidden \"Skip to content\" link as the first focusable element, targeting <main id=\"main\">.",
            "confidence": "low",
            "whyMatters": "Keyboard and screen-reader users otherwise tab through the whole menu on every page. EN 301 549 § 9.2.4.1 (WCAG 2.4.1)."
          },
          {
            "i18n": {
              "key": "a11y.legal-basis"
            },
            "name": "EAA Legal Basis",
            "value": "In scope for the European Accessibility Act (in force 28.6.2025): SK zákon 351/2022 Z. z., CZ zákon 424/2023 Sb., Dir. (EU) 2019/882 — assessed against EN 301 549. Inger provides EAA remediation audits.",
            "status": "info",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Accessibility audit — Inger →"
            },
            "howToFix": "",
            "isUpsell": true,
            "whyMatters": ""
          }
        ]
      },
      "vulnerability": {
        "score": 73,
        "checks": [
          {
            "i18n": {
              "key": "vuln.cms-version.pass"
            },
            "name": "CMS Version Disclosure",
            "value": "No generator tag — CMS identity hidden",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.sensitive-files.pass"
            },
            "name": "Sensitive Files Exposed",
            "value": ".env, .git, composer.json — all properly blocked",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.install-script.pass"
            },
            "name": "Install Script Exposed",
            "value": "No /install/ or /setup/ paths accessible",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.directory-listing.pass"
            },
            "name": "Directory Listing",
            "value": "Disabled — file structure hidden",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.admin-url.pass"
            },
            "name": "Admin Panel at Default URL",
            "value": "Not found at common paths (/admin, /wp-admin, /administrator, /backoffice)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.debug-mode.pass"
            },
            "name": "Debug Mode / Error Exposure",
            "value": "No debug indicators found in page output",
            "status": "pass",
            "evidence": {
              "source": "HTML-heuristic"
            }
          },
          {
            "i18n": {
              "key": "vuln.csrf.fail",
              "params": {
                "count": 1
              }
            },
            "name": "Form CSRF Protection",
            "value": "1 form(s) without CSRF tokens",
            "status": "fail",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Add CSRF token validation to every form. Most CMS frameworks have built-in CSRF protection — make sure it's enabled on all forms, including search and newsletter signup.",
            "confidence": "low",
            "whyMatters": "CSRF is in the OWASP Top 10. Without tokens, attackers can craft pages that automatically submit forms on your site as the victim's browser session."
          },
          {
            "i18n": {
              "key": "vuln.x-powered-by.warning",
              "params": {
                "detail": "Nuxt",
                "header": "Nuxt"
              }
            },
            "name": "X-Powered-By Header",
            "value": "Nuxt",
            "status": "warning",
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "Remove the X-Powered-By header. PHP: add 'expose_php = Off' to php.ini. Express.js: app.disable('x-powered-by').",
            "whyMatters": "\"Nuxt\" reveals your server technology and version. Attackers use this to find matching CVEs."
          },
          {
            "i18n": {
              "key": "vuln.inline-js.warning",
              "params": {
                "kb": 568
              }
            },
            "name": "Inline JavaScript Exposure",
            "value": "568 KB of inline JavaScript",
            "status": "warning",
            "evidence": {
              "source": "HTML-heuristic"
            },
            "howToFix": "Move inline scripts to external files. Inline JavaScript expands the attack surface for XSS and makes CSP harder to implement (requires unsafe-inline).",
            "confidence": "low",
            "whyMatters": "Large amounts of inline JavaScript prevent proper CSP implementation and increase the risk of XSS. External scripts can be protected with SRI hashes."
          },
          {
            "i18n": {
              "key": "vuln.bootstrap.pass",
              "params": {
                "version": "5.3.7"
              }
            },
            "name": "Bootstrap Version",
            "value": "Bootstrap 5.3.7",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.spf.pass",
              "params": {
                "record": "v=spf1 include:zlatokov.onice.io ~all"
              }
            },
            "name": "SPF Record (Email Security)",
            "value": "SPF configured: v=spf1 include:zlatokov.onice.io ~all",
            "status": "pass",
            "evidence": {
              "source": "DNS"
            }
          },
          {
            "i18n": {
              "key": "vuln.dmarc.fail-missing"
            },
            "name": "DMARC Policy (Email Auth)",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get Email Security Setup →"
            },
            "evidence": {
              "source": "DNS"
            },
            "howToFix": "Add a DMARC TXT record at _dmarc.yourdomain.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com — start with quarantine, then move to reject.",
            "whyMatters": "Without DMARC, attackers can send perfectly spoofed emails as your brand. Since May 2025, Google, Yahoo, and Microsoft require DMARC for bulk senders. Missing DMARC = email deliverability problems."
          },
          {
            "i18n": {
              "key": "vuln.dkim.pass",
              "params": {
                "selectors": "google"
              }
            },
            "name": "DKIM Signing (Email Auth)",
            "value": "DKIM configured (selectors: google)",
            "status": "pass",
            "evidence": {
              "source": "file-probe"
            }
          },
          {
            "i18n": {
              "key": "vuln.cross-origin.warning"
            },
            "name": "Cross-Origin Isolation",
            "status": "warning",
            "evidence": {
              "source": "HTTP-header"
            },
            "howToFix": "Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers. These protect against Spectre-type side-channel attacks.",
            "whyMatters": "Without cross-origin isolation headers, your site is vulnerable to Spectre attacks that can leak sensitive data across browser tabs. These headers are required for SharedArrayBuffer and high-resolution timers."
          },
          {
            "i18n": {
              "key": "vuln.payment-page.fail",
              "params": {
                "issues": "No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection"
              }
            },
            "name": "Payment Page Security",
            "value": "Payment page missing: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection",
            "status": "fail",
            "fixLink": {
              "url": "https://www.inger.sk/#contact",
              "label": "Get PCI Compliance Audit →"
            },
            "evidence": {
              "source": "file-probe"
            },
            "howToFix": "CRITICAL: Your payment page is missing security headers: No HSTS, No CSP, No X-Content-Type-Options, No clickjacking protection. PCI DSS Requirement 6.5 mandates protection against common vulnerabilities on pages handling card data.",
            "whyMatters": "Payment pages without proper security headers violate PCI DSS and make card data theft significantly easier. Payment processors can impose monthly fines for non-compliance."
          }
        ]
      },
      "executive_summary": {
        "en": "Your site has fundamental security gaps and poor accessibility. Immediately add security headers (HSTS, CSP) to protect visitors. On the bright side, your GDPR compliance is solid.",
        "sk": "Váš web má základné bezpečnostné problémy a slabú prístupnosť. Okamžite pridajte bezpečnostné hlavičky (HSTS, CSP) na ochranu užívateľov. Pozitívom je dobrá GDPR kompatibilita."
      },
      "opendata_security": {
        "ico": "36318370",
        "name": "ZLATOKOV SK, a.s.",
        "counts": {
          "low": 2,
          "high": 1,
          "info": 0,
          "total": 6,
          "medium": 3
        },
        "summary": {
          "spf": true,
          "ssl": {
            "valid": true,
            "issuer": "Let's Encrypt",
            "daysUntilExpiry": 68
          },
          "dmarc": null,
          "dnssec": false,
          "cveHigh": 0,
          "cveCount": 0,
          "mxProvider": null,
          "cveCritical": 0,
          "ctDomainsCount": 6,
          "httpSecurityScore": 15
        },
        "website": "https://zlatokov.sk",
        "findings": [
          {
            "code": "LOW_SECURITY_SCORE",
            "title": "HTTP security score je nízke: 15/100",
            "detail": "Implementuj HSTS, CSP, X-Frame-Options a ďalšie security headers.",
            "category": "http",
            "severity": "high"
          },
          {
            "code": "NO_DMARC",
            "title": "Chýba DMARC záznam",
            "detail": null,
            "category": "dns",
            "severity": "medium"
          },
          {
            "code": "NO_HSTS",
            "title": "Chýba HSTS hlavička",
            "detail": "Strict-Transport-Security vynúti HTTPS pre klientov.",
            "category": "http",
            "severity": "medium"
          },
          {
            "code": "NO_CSP",
            "title": "Chýba Content-Security-Policy",
            "detail": "CSP znižuje XSS riziko.",
            "category": "http",
            "severity": "medium"
          },
          {
            "code": "NO_DNSSEC",
            "title": "Doména nemá DNSSEC",
            "detail": null,
            "category": "dns",
            "severity": "low"
          },
          {
            "code": "NO_X_FRAME_OPTIONS",
            "title": "Chýba X-Frame-Options (clickjacking risk)",
            "detail": null,
            "category": "http",
            "severity": "low"
          }
        ],
        "cyberScore": {
          "band": "B",
          "score": 73,
          "buckets": {
            "ct": 90,
            "cve": 100,
            "ssl": 100,
            "http": 15
          },
          "computedAt": "2026-08-10T14:41:28.973Z"
        },
        "overallScore": 39
      }
    },
    "created_at": "2026-08-10T20:01:16.327856+00:00",
    "status": "complete",
    "platform_detected": "Sellio",
    "company_ico": "36318370",
    "company_name": "ZLATOKOV SK, a.s.",
    "company_country": "SK",
    "company_nace": "4777",
    "company_size": "medium",
    "nis2_scope": "none",
    "nis2_sector": null,
    "company_risk_score": 10,
    "company_risk_level": "low"
  }
}