Skip to main content

Security report for florbalkv.cz

Florbal Vary, z.s. · Other · Czech Republic

Medium risk. 13 critical or high findings in GDPR compliance, Security headers and 1 other check.

Security score

55/100

Risk levelMedium

Florbal Vary, z.s. is a small regional sports club based in Karlovy Vary, Czech Republic, specializing in floorball. The club focuses on youth development and community engagement, aiming to be a leading floorball club in western Czechia. Their website provides information about teams, training, events, and partnerships, reflecting a well-organized sports organization with a family-friendly environment. Technically, the website uses modern frontend technologies including Alpine.js, Bootstrap, and integrates Google Analytics and Facebook SDK for tracking. The site is mobile-optimized and offers good user experience with clear navigation and relevant content. Security posture is adequate with HTTPS enforced, but lacks advanced security headers and visible privacy or cookie policies, which are areas for improvement. The absence of WHOIS data reduces domain trustworthiness, though the website content and business information appear legitimate and professional. Overall, the site is functional and trustworthy but would benefit from enhanced privacy compliance and security transparency.

Scanned

NIS2 and GDPR posture

NIS2 posture
2/ 100 · Critical
GDPR posture
10/ 100 · Critical
Checks completed
7of 7

Indicative only: based on publicly visible signals, not a certification or legal assessment. NIS2 signals relate to Article 21 of Directive (EU) 2022/2555; GDPR signals to Articles 7, 12, 13 and 32 of Regulation (EU) 2016/679 and Article 5(3) of the ePrivacy Directive.

Priority findings

13 findings rated critical or high. Fix these first.

  1. GDPR compliance

    These are the privacy signals visitors and data protection authorities look for under GDPR.

    • Critical

      EU business without adequate privacy measures

      EU businesses are subject to strict GDPR requirements

      What to do: Implement comprehensive GDPR compliance including privacy policy, cookie consent, and data protection measures

    • High

      No Privacy Policy found

      GDPR requires a clear and accessible privacy policy

      What to do: Add a comprehensive privacy policy page and link to it prominently

  2. Security headers

    Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

    • High

      Missing Strict-Transport-Security header

      Forces HTTPS connections

      What to do: Add "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload"

      • CWE-319
      • OWASP A04:2025
      • ASVS V3.4.1
    • High

      Missing X-Frame-Options header

      Prevents clickjacking attacks

      What to do: Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN"

    • High

      Missing Content-Security-Policy header

      Controls resources the browser is allowed to load

      What to do: Implement a Content-Security-Policy appropriate for your application

      • ASVS V3.4.3
      • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

Need hands-on remediation? Email guard@offseq.com

Keep watching florbalkv.cz

This scan found 32 issues across 7 checks. Monitoring re-runs those checks daily, emails you when something material changes and records each fix, so you can show progress.

Daily monitoring

Recommended

€25per month

  • TLS certificates and expiry
  • DNS records
  • SPF, DKIM and DMARC
  • Security headers
  • GDPR and NIS2 posture
  • Exposed services
  • Third-party trackers
  • Risk score drift

Email alerts on material changes and an exportable JSON history of every change.

Billed monthly. Cancel anytime. The full timeline opens with your unlock code.

Full report

€39.90one-time

  • The complete analysis as a PDF you can cite
  • Email delivery with an unlock code
  • Lifetime access to this report

Prices incl. 21% VAT. Payments by EveryPay; sold by SEQ SIA, Latvia.

Results by check

Each check with its score, findings and the evidence it collected.

Technical appendix

Business context, site observations and technical notes gathered during the scan, and the standards behind each reference.

Business context

Business profile

The club operates in the sports and recreation sector, targeting youth and community members interested in floorball. It maintains partnerships with multiple local and national organizations, enhancing its market position and resource network. The business model is non-profit and community-oriented, focusing on sports training, events, and team management. The website content and partner ecosystem indicate active engagement and a stable presence in the regional sports market. Growth indicators include active social media presence and event promotion. Revenue streams likely include sponsorships, memberships, and event ticketing. Strategic observations suggest the club values transparency and community involvement but should improve digital compliance and domain registration clarity.

Security posture

The website demonstrates a basic to moderate security maturity level. HTTPS is properly implemented, ensuring encrypted communication. However, the lack of security headers such as Content-Security-Policy, X-Frame-Options, and others reduces protection against common web attacks. No sensitive data exposure or vulnerable libraries were detected in the HTML content. The absence of a security.txt file or incident response contact emails indicates limited readiness for vulnerability reporting or incident handling. Privacy compliance is weak due to missing privacy and cookie policies. Overall, the security posture is adequate for a small sports club website but requires enhancements to meet higher standards and regulatory requirements.

Recommendations

  1. Implement and display a comprehensive privacy policy and cookie consent mechanism to improve GDPR compliance.
  2. Add security headers like Content-Security-Policy, X-Content-Type-Options, and X-Frame-Options to enhance web security.
  3. Publish a security.txt file and provide dedicated security or abuse contact emails to facilitate vulnerability disclosure and incident response.
  4. Verify and update WHOIS domain registration information to improve domain legitimacy and trust.
  5. Regularly audit third-party scripts and analytics tools to ensure they do not introduce vulnerabilities or privacy risks.

Contact details published on the site

Addresses
Legal name
Florbal Vary, z.s.
Registration number
26518571
Site observations

Automated reading of the public site. Ratings are indicative.

Business

Company
Florbal Vary, z.s.
Description
Jsme sportovní klub s rodinným prostředím, který vychovává všestranné a zdravé sportovce. Naším posláním je zprostředkovat florbal všem, bez ohledu na pohlaví, věk nebo výkonnost. Svým působením ovlivňujeme dění a výchovu obyvatel ve městě a v kraji. Chceme být nejlepším florbalovým klubem v západních Čechách ve všech oblastech a významným florbalovým klubem v prostředí Českého florbalu.
Key services
floorball training, team management, sports events, youth sports development
Content quality
good
Branding
consistent

Technology

Stack
Alpine.js, Bootstrap, jQuery, Swiper.js, Google Analytics, Facebook SDK
Frameworks
Bootstrap
Performance
moderate
Mobile
good
Accessibility
basic
SEO
good

Security

Observed score
75/100
Good practices seen
  • HTTPS enforced
  • No exposed sensitive data in HTML

Analytics and tracking

Services
Google Analytics, Google Tag Manager, Facebook Analytics
Tracking level
moderate
Privacy compliance
poor

Advertising

Tracking pixels
Facebook SDK
Transparency
basic

Site quality

Design
good
User experience
good
Content relevance
good
Navigation
good
Professionalism
good
Trustworthiness
high

Key observations

  1. Website is fully accessible with no blocking or WAF challenge
  2. No privacy, cookie, or terms of service policies detected on main site
  3. WHOIS data unavailable, which is a concern for domain legitimacy
  4. Website uses modern frontend technologies and analytics tools
  5. Business is a small regional sports club focused on floorball
  6. Contact info includes physical address and social media links but no direct emails or phone numbers found
  7. Multiple partner logos and external links to related sports organizations
  8. No security.txt or vulnerability disclosure information found
  9. No explicit or adult content detected
Technical notes

Notes

The website uses a modern and popular technology stack including Alpine.js for reactive UI components, Bootstrap for responsive design, jQuery for legacy support, and Swiper.js for interactive sliders. Google Analytics and Facebook SDK are integrated for user tracking and marketing analytics. The site loads external fonts and icons efficiently and is mobile-optimized with good navigation clarity. Performance is moderate, with room for optimization in loading times and accessibility features. No CMS was explicitly detected, suggesting a custom or proprietary platform. Hosting provider details are not evident from the content. Technical risks include reliance on multiple third-party scripts and missing security headers, which could be mitigated with best practices.
Standards and sources

Reference chips under each finding point to the standard, regulation or specification the finding relates to. They are taken from the official datasets below and mapped conservatively: a finding with no defensible link shows none. NIS2 and GDPR references mark where a finding is relevant evidence, not a compliance verdict. Implementing Regulation (EU) 2024/2690 binds digital infrastructure and digital service providers; for other entities it is the most detailed public reading of the Article 21 measures.

Retrieved 2026-10-24

Reviews of this site

Share your experience with florbalkv.cz. Every review is verified by email and published after moderation.

Overall rating
Select a rating
4000 characters remaining

We’ll email you to confirm your review and keep your details private.

Community rating

Loading reviews…

Feedback on this report

Rate this report, add an optional comment, and tell us if you want a security specialist to follow up.

Overall report quality
Select a rating
2000 characters remaining

We only use your feedback to improve Guard reports. Contact details are never shared.