# Analytics script or SDK is present and loaded

- **Pattern:** `ab-001696` (`marketing-analytics.core-analytics.script-present`)
- **Severity:** high
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-001696
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-001696)

## Why it matters

Without an analytics SDK wired up, you cannot answer basic product questions: which acquisition channels convert, which pages drive signups, which features get used. You are shipping to production blind. Marketing spend gets allocated on gut feel, pricing experiments cannot be measured, and conversion regressions go undetected until revenue drops. Installing a package without wiring a measurement ID is worse than not installing it — it signals the job is done when zero data is flowing.

## Severity rationale

High because zero observability blocks every downstream growth, conversion, and retention decision the product depends on.

## Remediation

Pick one analytics provider and wire it end-to-end. For Vercel-hosted Next.js, the fastest path is `npm install @vercel/analytics` plus `<Analytics />` in `app/layout.tsx`. For product telemetry, use PostHog with `posthog-js` initialized in a `'use client'` provider. Store the measurement key in `NEXT_PUBLIC_GA_MEASUREMENT_ID` or equivalent and reference it from the initialization site.

## Detection

- **ID:** `script-present`
- **Severity:** `high`
- **What to look for:** Count every analytics-related dependency in `package.json` (gtag, posthog-js, mixpanel-browser, @segment/analytics-next, plausible-tracker, @vercel/analytics, fathom-client, amplitude-js, etc.). Also count inline `<script>` tags loading analytics vendors in layout files. Check for Google Tag Manager (GTM) container scripts. Check `.env.example` for analytics ID variable names.
- **Pass criteria:** At least 1 analytics library is present in `package.json` OR at least 1 analytics `<script>` tag is found in a layout/document file, AND an analytics ID or tracking ID is referenced via an environment variable (indicating it's actually configured, not just installed). Report even on pass: "Found N analytics dependencies and M script tags. Primary provider: [name]."
- **Fail criteria:** No analytics dependencies in `package.json`, no analytics script tags in layout files, or an analytics library is installed but no measurement ID/tracking ID environment variable is referenced anywhere in the codebase. A dependency listed in `package.json` with no corresponding initialization code does not count as pass — the SDK must also be wired up.
- **Skip (N/A) when:** The project is an API-only project with no user-facing pages (project_type is `api` and no HTML templates or layout files exist).
- **Detail on fail:** Describe what was found. Example: `"No analytics dependencies found in package.json and no analytics script tags in layout files"` or `"posthog-js is installed but no POSTHOG_KEY or equivalent env var is referenced in the codebase — analytics may not be configured"`
- **Cross-reference:** For deeper tracking verification on live sites, the Site Health Check audit validates analytics script presence via HTTP response inspection.
- **Remediation:** Your project needs an analytics tool to understand how users interact with it. Common choices:
  - **Google Analytics 4 (GA4):** Add `gtag.js` via a `<Script>` tag in your root layout, or use a library like `next-gtag`.
  - **PostHog:** `npm install posthog-js` — initialize in a provider component with your project API key.
  - **Plausible or Fathom:** Privacy-first options that don't require a consent banner in many jurisdictions. `npm install plausible-tracker` or `fathom-client`.
  - **Vercel Analytics:** If hosting on Vercel, `npm install @vercel/analytics` gives you zero-config pageview tracking.

  Regardless of provider, store your tracking ID in an environment variable (e.g., `NEXT_PUBLIC_GA_MEASUREMENT_ID`) and reference it in your `app/layout.tsx` initialization code.

Taxons: observability

HTML version: https://auditbuffet.com/patterns/ab-001696