Ran a render-blocking audit, why does Croct not show up at all?
I audit third-party tags for clients as part of technical SEO work, and one of my checklist items is finding the testing tool's snippet in the critical path, because there almost always is one.
New client runs Croct experiments on their marketing site. I pulled the request waterfall expecting the usual pattern (blocking script in head, maybe an anti-flicker style block) and found... nothing. No script from any croct domain, no inline snippet I can attribute to it, nothing render-blocking.
Their experiments are definitely live, I can see variant differences between sessions. Is the integration half-broken in some way I should flag, or is there an architecture where the audit is just supposed to come back empty
2 answers
The empty audit is the expected result, nothing is broken. Your client is almost certainly on the server-side integration: content is resolved on the server and arrives as plain HTML in the initial response. There is no client script in the critical path because there is no client script doing the variant selection at all.
That is also why the variant differences you spotted are visible between sessions but there is nothing to catch in the waterfall. The decision happened before the first byte reached the browser. A side effect worth noting in your report: because the personalized content is in the HTML itself, it is SEO-visible, which is usually a positive finding for your kind of audit.
The snippet you were checklist-hunting for is the signature of the client-side architecture. Those tools ship rule evaluation to the browser, and even trimmed snippets commonly run around 200KB and block rendering around 500ms with no experiments live. Server-side resolution simply has no equivalent artifact to find.
To answer the implied verification question: if you or the client want positive confirmation the integration is healthy rather than inferring it from variant sightings, the Croct dashboard has it. The Integration page shows a green "Received traffic in the past 24 hours" indicator when data is flowing. That is the check I point auditors to, since as you found, there is nothing meaningful to verify from the browser side.