Technical state of online shops in the Moravian-Silesian Region: 195 shops and 5 surprising numbers

In the article Online shops from the Moravian-Silesian Region I assessed 19 shops: appearance, findability and the product page. Here the question is different and the sample larger: what is the technical state of shops in the region? On the evening of 3 November and the night into 4 November 2026 an automated check of 195 online shops based in the Moravian-Silesian Region ran. I do not publish names or domains, and I hide numbers for small groups so that no individual shop can be identified from the tables.

Half of the shops link in their terms and conditions to a European online dispute resolution platform that no longer exists. And almost no shop blocks AI search engines.

What I measured and how

• Sample: 195 shops (of 201 audited, 6 excluded: unavailable, discontinued, or the address led to another site). Sources: open data from the Czech Register of Economic Subjects (Czech Statistical Office, as of 31 Oct 2026) and finding shops by town via Heureka, Firmy.cz and regional sources. The sample is not a random selection of all shops in the region.
• Collection: public pages only, GET requests only, no login or cart, at most 30 requests per site per run. The same on each shop: homepage, one category, one product detail, robots.txt, sitemap, llms.txt, a non-existent address, terms and conditions, pagination and category sorting.
• Confirmation: a problem counts only if all available measurements showed it (the base audit and two repeat runs). Where measurements diverged, the shop is not counted in that row. A random 10% of shops (20) was re-checked by other agents using a different method: agreement on HTTPS 100% (20/20), on the Product schema 100% (16/16).
• Speed: Lighthouse, mobile profile with the default simulated throttling, homepage only, two runs. This is a lab measurement, not data from real visitors (CrUX), which I did not have.

Numbers have the form "X% (n/z)", where z is the number of shops for which the item could be measured. The denominator therefore differs between rows.

Finding 1: the discontinued ODR platform in the terms

The European online dispute resolution platform was discontinued by Regulation (EU) 2024/3228, which repeals Regulation (EU) No 524/2013 with effect from 20 July 2025. The link to the platform remained in the terms and conditions of 49.7% of shops (90/181). The repealed Czech Act No. 101/2000 Coll. on personal data protection, which was replaced by Act No. 110/2019 Coll., is cited by 32.0% (58/181). Measured on the terms page the site links to, for 181 shops where the script found it.

This is outdated information for the customer, not a legal assessment of the whole terms. Have the fix reviewed by a lawyer. The practical check is quick: open your terms and search for "ec.europa.eu/consumers/odr" and "101/2000".

Finding 2: Shoptet and "page 999"

For a non-existent category pagination page (for example "page 999") Shoptet returns code 200, without noindex and without canonical, for 98.3% of measured Shoptet shops (59/60). So it is most likely the default template behaviour. A search engine may then crawl empty pagination pages. A non-existent address mostly returns 404 (overall a "soft 404", meaning another code instead of 404, occurred at 9.3% of shops, 18/193): at 0.0% of Shoptet shops (0/71), but at 24.2% (16/66) in the group "custom solution or undetermined platform".

On Shoptet the Product schema was never missing, 0.0% (0/69). In the group "custom solution or undetermined platform" it is missing for 37.5% (18/48). The platform is determined from signatures in the page code, so the second group cannot be read as custom development only. The groups have 71 and 68 shops, so treat the comparison as indicative.

Finding 3: structured data and indexing

What each item means and how to fix it is in the article SEO mistakes of online shops.

Finding 4: AI bots and llms.txt

robots.txt blocks at least one AI search bot at 1.0% of shops (2/195), OAI-SearchBot (ChatGPT search) at 0.0% (0/195). Training AI bots are blocked by 5.6% (11/195); that is the owner's choice and is not counted in the score. A llms.txt file is present at 11.3% (22/195).

It is a technical signal, not a guarantee. What decides whether AI recommends you is something else, more in the article AI crawlers and 30 Czech online shops. A one-off panel of 54 queries (36 runs of a language model with web search and 18 queries in Google AI Mode) also showed at least one shop from the sample in 22.2% of answers (12/54); for queries asking for "from Ostrava or the Moravian-Silesian Region" in 30.6% (11/36), for national ones in 5.6% (1/18). It is a single run on a single day.

Finding 5: mobile speed in the lab

LCP above 4 s in both runs occurred at 96.1% (174/181) of shops. LCP of 2.5 s or less in the better of two runs occurred at 1.0% (2/191), and the median LCP in the better run was 9.7 s (n = 191). It is a simulated slow mobile from a single computer that was running other tasks at the same time. It does not necessarily match the experience of real visitors; I had no access to CrUX data. How to improve speed is described in the article How to speed up a website.

Extension: accessibility, cookies, email, Shoptet and company websites

After publishing the base measurement I measured six more things on the same sample (accessibility, cookies, email, Shoptet, feeds and company websites). The measurements ran on 3 and 4 November 2026 as automated outside-in tests, on public pages only. The denominators (z) are smaller than 195 because not everything could be measured every time. The same rule as above applies: counts of 1 to 4 and bases below 5 are not reported.

Finding 6: homepage accessibility (automated test)

On each homepage I ran the axe-core 4.11 automated accessibility test against the WCAG 2.1 level A and AA rules, twice, and counted only rules found in both runs. 192 shops were measured.

• At least one rule violation was found by the automated test on the homepage at 97% of shops (186/192).
• A critical violation (the highest severity the tool distinguishes) at 49% (94/192). The median is 3 violated rules per page.
• On the product page: violations at 96% (144/150), critical at 68% (102/150).

What it is: WCAG are the international web accessibility rules. Low contrast means, for example, that grey text on a light background is harder to read for some people. A button or link "without a name" is, for example, a cart icon that a screen reader reads out only as "button".

Why it matters: a blind, low-vision or mouse-impaired customer then cannot complete an order. It also makes things less comfortable for everyone else, for example on a phone in sunlight.

How to check it yourself (free): open the homepage in Chrome, press F12, go to the Lighthouse tab, tick only Accessibility and run the test. The WAVE tool or the axe DevTools extension work similarly. Then try going through the site with the keyboard only (Tab, Enter): can you see where you are?

What the law covers: Czech Act No. 424/2023 Coll. on accessibility requirements for certain products and services has been in effect since 28 June 2025 (section 29) and applies, among other things, to e-commerce services provided to consumers (section 2(2)(d)). It does not apply to services provided by a microenterprise (section 2(3)(a)). A microenterprise is, under section 3(1)(p), a person under Annex I of Commission Regulation (EU) No 651/2014, roughly a firm with fewer than 10 employees and annual turnover or balance sheet total of up to EUR 2 million, where partner and linked enterprises may be counted. Supervision of services is generally held by the Czech Trade Inspection Authority (section 19(2)). Many small online shops are therefore not covered by the Act at all. An automated test also cannot determine whether the obligation applies to a particular shop, and the result is not a legal assessment. Who the Act applies to is described in detail in the article Must an online shop be accessible?.

Limit: an automated test finds only part of the problems. The maker of axe-core states an average of 57% of the volume of issues (Deque, 2021), and W3C WAI warns that tools cannot verify everything and human judgement is needed (W3C WAI). Not finding an error does not mean the site is accessible.

Finding 7: marketing measurement before cookie consent

I opened the homepage in a clean browser (Chromium, new profile), did not click anything for 10 seconds and recorded all requests and cookies. Two independent measurements; a finding counts only if both showed it. 193 shops were measured.

• The automated test found marketing measurement (data sent to a marketing tool or a marketing cookie) before any choice in the banner at 34% of shops (65/193).
• Analytics before a choice (mainly Google Analytics 4 with the _ga cookie) at 36% (69/193). Marketing or analytics together at 49% (95/193).
• A banner was visible on load at 80% (155/193). Wording like "by continuing to browse you agree", that is, consent without an active choice, appeared at 15% (28/193).

Six further tools each appeared on fewer than 5 shops, so I do not report them.

What I did not count as a finding: Google Analytics requests carrying a consent-denied signal (Consent Mode) without cookies were sent by 58% (111/193) of shops, Sklik with the parameter consent=0 by 44% (84/193). Merely loading a library without sending data is not counted either (for example Meta at 12%, 24/193). That is the correct setup, not an error.

What it is and why it matters: an advertising tool's pixel or cookie tracks the visitor before they have decided. Under section 89(3) of Act No. 127/2005 Coll. on electronic communications, storing data in a user's device or gaining access to it requires prior demonstrable consent, except for technical storage needed to transmit a message or for an expressly requested information society service. In its Guidelines 2/2023 (version 2.0, adopted 7 October 2024) the EDPB applies the same regime to tracking through URLs and pixels, including where no cookie is stored. Whether a particular tool requires consent depends on its configuration and purpose. The automated test found only what was sent, not the legal status.

How to check it yourself (free): open your site in an incognito window, press F12 and switch to Network. Reload the page and do not click the banner. Type for example "facebook", "google" or "collect" into the filter: if requests are going out, the tool measures before consent. In the Application / Cookies tab you will see which cookies are already stored. Fix the setup in your consent manager or by firing tags in Google Tag Manager only after consent.

Limit: one browser, one Czech IP, 10 seconds on the homepage. Measurement that starts only after the page is scrolled does not show up. The body of some requests (sendBeacon) is not captured by the recording; I did not count such cases.

Finding 8: email and DMARC

From the public DNS of the shop's domain I read the SPF, DKIM and DMARC records through two independent servers (Cloudflare and Google) and counted only agreement. 190 domains that receive mail or have SPF are included.

What it is: SPF says which servers may send mail for your domain, DKIM signs it, and DMARC decides what happens to emails that fail the checks (nothing, spam folder, reject). p=none only monitors and enforces nothing. A DKIM that was not found does not mean it is missing; the selector may differ from the ones I tried.

Why it matters: without DMARC anyone can more easily send a fraudulent email "from your domain", and your order confirmations may end up in spam. This is not about a law. Since 1 February 2024 Gmail has required SPF, DKIM and DMARC from bulk senders (over 5,000 messages a day), and other large providers have similar rules. Technically these are the standards RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 9989 (DMARC, May 2026, obsoletes RFC 7489).

How to check it yourself (free): on the command line enter nslookup -type=TXT _dmarc.yourdomain.com (DMARC) and nslookup -type=TXT yourdomain.com (SPF, look for a line starting with v=spf1). A web tool such as MXToolbox is more convenient. Start with p=none and report sending, and once you see legitimate mail passing, move to quarantine.

Limit: I measured the shop's domain, not the actual sending domain of order confirmations, which I cannot see from outside. I did not measure deliverability; these numbers cannot tell how many emails end up in spam.

Finding 9: Shoptet, page 2 of a category with the same meta description

For Shoptet shops I observed category pagination. Every value comes from the first and second download of the page, and I counted only shops where both measurements agreed. I compared 71 Shoptet shops from the region with a national sample outside the region (193 shops, 13 regions, found by search, not random). The selection frames differ, so differences between columns are not an estimate of the difference between regions.

What it is: the second page of a category is indexable and repeats the first page in its meta description (the text under the link in search results). Why it matters: a search engine then sees dozens of pages with the same description and has a harder time telling which to show. GTIN/EAN (barcode) and brand in the product data help shopping comparison services and search engines match a product unambiguously. This describes observations of websites; it does not say how the platform is configured, or how a search engine treated these pages.

How to check it yourself: open page 2 of a category, press Ctrl+U and search for name="description". Compare it with page 1. Whether Google indexes the page is shown by Search Console (URL Inspection).

Finding 10: feeds and prices on the website

The original plan, comparing price and availability on Heureka with the website, did not work: Heureka's search returned a verification page to our measurement and Zboží.cz disallows search in robots.txt. I did not bypass the blocks. Instead I compared the shop's public XML feed (only at standard paths allowed in robots.txt) with the product page.

I found a public feed at 22 of 99 shops tried, and 59 products at 20 shops were compared. The price differed between the feed and the website (confirmed by a second measurement more than 20 minutes later) only occasionally; the exact count is not reported because the base is small. The other prices matched within CZK 1. I did not assess availability: the feed states it only as days to delivery, and shops interpret that differently. The sample is small and not representative.

Why it matters: a customer who arrives from a comparison site with one price and finds another on the website usually leaves. How to check it: download your own XML feed and compare the price of five products with the website. If they differ, check when the feed is generated.

Finding 11: company websites compared with online shops

For comparison I ran the same measurements on company websites in 6 industries. From the RES register (Czech Statistical Office) I selected 240 companies based in the region, preferably medium-sized ones (50 to 249 employees), 40 per industry. I found a website for 189 companies and measured 178 distinct websites twice. Each website is counted once. The overall score from 0 to 100 (technology 20, on-page SEO 15, structured data and AI 15, speed 15, accessibility 10, cookies 10, email 10, local signals 5) is my own indicative metric, not a standard.

• The median score is 59 out of 100.
• DMARC is missing at 53% (94/177), SPF at 19% (33/177).
• Marketing before consent at 12% (22/176), analytics at 32% (56/176).
• No structured data about the company (Organization or LocalBusiness) at 67% (120/178).
• Mobile LCP above 4 s in both lab runs at 84% (147/175), indicative.
• The automated accessibility test found a serious violation on the homepage at 94% (165/176). Whether Act No. 424/2023 Coll. applies to a particular company I did not verify, and it concerns mainly e-commerce services.
• Link to a Google business profile 14% (25/178), missing meta description 28% (50/178).

The differences between industries are small and, at 22 to 34 sites per industry, not statistically supported. Scores of sites with incomplete measurement coverage (full weight coverage applies to 170 of 178 sites, the lowest is 65%) are not fully comparable. What company profiles on Google and Mapy.com look like is described in the article Company profiles in Ostrava and the region.

What to do about it

If you need help, I handle it as part of SEO for online shops or Shoptet support. How to check whether an agency looks after your shop is in the article Is your agency looking after your online shop?.

Limits of the measurement

• Non-random sample from selected sources, one evening and night, from a single IP address. A server may respond to our IP differently than to real bots.
• One category and one product per shop. Errors on other templates may be missing.
• Schema injected by JavaScript after load is not seen by the script. A check in a real browser found no difference for 16 of 16 comparable shops from the control sample.
• Lighthouse is a lab measurement, not CrUX.
• The AI panel is a single run on a single day; a language model with web search is not the same as the ChatGPT interface.
• I do not assess goods, services or the legal state of the whole terms.
• Accessibility: an automated test finds only part of the problems (axe-core on average 57% of the volume), not finding an error does not mean an accessible site, and a finding does not mean the Act applies to that shop.
• Cookies: one browser, one Czech IP, 10 seconds on the homepage without clicking. Measurement that starts only after scrolling does not show up.
• Email: I measured the shop's domain, not the actual sending domain of orders. DKIM is searched only at common selectors. I did not measure deliverability.
• Shoptet and feeds: the selection frames of the region and the rest of Czechia differ and are not random. Only a minority of shops had a public feed; the sample is small and not representative.
• Company websites: the selection is not a random sample of all companies in the region, the score is my own indicative metric, and Lighthouse ran from one computer alongside other measurements.

Frequently asked questions

Do I have to link to the ODR platform in my terms?

No. The platform was discontinued with effect from 20 July 2025. Remove the link. Consult a lawyer about changing the terms.

Is my shop among those you measured?

I do not publish names or domains of shops. If you want a check of your shop, write to me.

Does "page 999 returns 200" mean it harms me?

A search engine may crawl empty pages. Whether it affects your case will be shown by Search Console. The fix is noindex, canonical or a 404 code depending on the platform.

Is lab LCP what customers see?

No. It is a simulation of a slow mobile. Real customer data is in Search Console in the Core Web Vitals report, if the site has enough traffic.

Should a shop have llms.txt?

It is an optional file. Whether it helps has not been proven; it is a signal I recorded in the measurement.

Does the accessibility act apply to me?

Act No. 424/2023 Coll. has been in effect since 28 June 2025 and applies, among other things, to e-commerce services for consumers. It does not apply to services provided by a microenterprise (fewer than 10 persons and annual turnover or balance sheet total up to EUR 2 million, taking partner and linked enterprises into account). Have a lawyer assess whether the obligation applies to you. An automated test cannot determine it.

How do I know if my cookie banner measures before consent?

Open your site in an incognito window, press F12, go to the Network tab and reload the page without clicking the banner. If requests go out to advertising tools (for example Meta, Google Ads, Sklik), the site measures before a choice. Have a lawyer assess whether it is a breach for a particular tool.

Sources and links

• Regulation (EU) 2024/3228, discontinuation of the ODR platform, EUR-Lex
• Act No. 110/2019 Coll. on personal data processing (Czech), section 67 (repeal of Act No. 101/2000 Coll.)
• Act No. 424/2023 Coll. on accessibility requirements for certain products and services (Czech), sections 2(2) and (3), 3(1)(p), 19, 29, verified 4 Nov 2026
• Act No. 127/2005 Coll. on electronic communications (Czech), section 89(3), wording in force from 1 Nov 2026, verified 4 Nov 2026
• EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0 adopted 7 Oct 2024, section 3.1 (URL and pixel tracking), verified 4 Nov 2026
• RFC 9989, DMARC, May 2026, obsoletes RFC 7489 and RFC 9091, verified 4 Nov 2026
• Must an online shop be accessible?
• Company profiles in Ostrava and the region
• Online shops from the Moravian-Silesian Region
• AI crawlers and 30 Czech online shops
• SEO mistakes of online shops

Measured on 3 and 4 Nov 2026 (extension the same days); the detailed method and limits are in the measurement summary held by the author. No shop names or domains.