Web application hosting guidance
Producers are required to develop sites and databases that are compliant with Progressive Web Application (PWA) standards and best practices. A checklist of these standards can be found at https://developers.google.com/web/progressive-web-apps/checklist. Specifications for sites and databases to be hosted by PBS can be found below
- Environment requirements e.g. Dev, QA, Staging etc.
- Containerized applications preferred i.e. Docker
- Preferred CMS - CraftCMS; WordPress is supported
- Standard non-PHP env is NGINX + uWSGI
- Set cache control headers
- Estimated initial/current storage needs
- Estimated rate of storage growth
- DB requirements? – MySQL or Postgress SQL preferred
- CI/CD - Jenkins pipeline YAML; Bitbucket/GitHub webhook for DEV environment;
- ApacheBench + lighthouse performance testing
CMS content should be managed via Git plugin where possible e.g.
Otherwise utilize a migration plugin e.g.
Export files must be delivered via AWS S3
XML Sitemap + Robots.txt
Estimated lifespan of site/app before 1st refresh
Estimated change/deployment frequency
3rd party development or support agreement
Source code repository – Git(Hub) preferred. PBS can provide Bitbucket access
SSH via private key
Secrets must NOT be stored in repo/code
List of initial dependencies, specify version
Source code must NOT contain any high risk vulnerabilities listed in NVD
Support for Amazon EC2 Dedicated Hosting
In an effort to provide PBS producers greater flexibility to innovate as well as greater freedom to tackle emerging issues, PBS is providing selected producers with dedicated compute and storage resources. These resources provide content producers with greater technological freedom to innovate and experiment with new technologies. They also introduce isolation between producer sites, dramatically reducing the impact of adverse events.
With this additional freedom and flexibility the producer now has nearly complete control over their environment and the means to address most issues autonomously. Provided resources are for the exclusive use of the producer to which access is granted.
Technical support for Dedicated resources are limited to the following:
- Operational environment. PBS provides an operational computing environment to third party developers and producers for PBS sponsored websites and applications. This operational computing environment is based on the LAMP (linux + apache + mysql + php/python/perl) technology stack. PBS provides Level 1 technical support necessary to insure that the services are "available" for use and as designed.
- PBS-sanctioned widgets, modules and applications. PBS has developed a suite of applications, widgets, modules, and scripts that may (and in some cases must) be used by third party developers. PBS provides Level 1 technical support regarding the use of these components.
- PBS network services. PBS provides network access (e.g. AWS S3 and SSH) to development and staging, computing resources where third party applications may reside.
PBS does not, however, provide technical support for issues regarding the use, development, application, tuning, or customization of development and scripting languages, application frameworks, or applications developed by third parties and/or the open source community. PBS relies upon its third party developers to be self-sufficient in these areas.
PBS views web application security as a joint responsibility. In order to ensure the highest level of Confidentiality, Integrity and Availability (CIA) the following measures will be enforced wherever possible:
- Applications or dependencies containing known HIGH vulnerabilities will NOT be deployed and IF discovered post deployment may be taken offline based on severity
- AWS and/or SSH keys will be rotated periodically access may be revoked if suspicious activity is detected
- Sites will be monitored by AWS Guardduty for suspicious activity
Content Management Systems
All Content Management System plans must be reviewed and approved by your Program Manager at the start of your project.
* Drupal is NOT supported due to repeated security and performance issues with high-traffic sites.
Sites may not assume that their IP addresses will not change. That is, if the IP address changes, the site must still function properly.
Sites should not assume that their domain names are fixed. That is, if the domain name needs to change, the site should still function.
Repeatable AWS-hosted sites
Site should be “repeatable” on Amazon. For legacy sites on server infrastructure PBS should be able to back up the producers application directory and database, create a new machine, and the site should come up without any human intervention. All customizations must be automated using the boot.sh file which is run once upon server provisioning. Apart from container images, sites should be immutable via IAC (Terraform of CloudFormation) and auto scale without user disruption
Content Distribution Network (CDN)
All third party developers and producers are expected to utilize the PBS Content Delivery Network which is currently hosted by AWS CloudFront.
Full use of the CDN is a launch requirement for the following media types:
- All media files, including but not limited to Flash, video, GIF, JPEG, etc.
- All CSS files greater than 10k.
All database intensive sites must implement object based and/or page level server side caching as necessary in order to maintain high performance.
- Use of memcached or redis is highly recommended for all “dynamic” pages that rely upon an internal database or third party services for real time data.
- PBS highly recommends the use of memcached or redis for all server-side object and page level caching.
Performance and Load Testing
In order to maintain the highest level of user experience, PBS requires that all applications and sites developed by third party developers for hosting on PBS's AWS hosting service undergo (and pass) performance and load testing.
Performing this testing is the sole responsibility of the third party producer or developer. The purpose of this load testing is to demonstrate that the application has been engineered to handle the high levels of traffic that the site may see experience at launch.
- Sites and applications must demonstrate that they are capable of achieving 50 requests per second from 10 simulated users.
- Test results are a production readiness deliverable. Upon completion of load testing, producers will be required to submit a copy of the load testing results to PBS for review.
- The maximum allowable latency for the loading of any single page is 5 seconds.
In order to reach the most users, sites should be developed using HTML specification 4.0 and cascading style sheet specification CSS1. Other HTML specifications may be used as long as the principals of Progressive Enhancement/Graceful Degradation are applied so that there is always a compelling and usable experience available for the site user. Compliance with The World Wide Web Consortium (W3C) guidelines and recommendations is required. HTML standards must be compliant for the doc-type it is declaring. If it is not, PBS reserves the right to not publish or to limit the site audience.
Supported Web Browsers
Sites must be developed to support PBS-approved Web browsers across platforms. Although it is not assumed that all users will have the identical experiences when using different browsers, it is vital that every user be able to experience the same content and as much visual richness and interactivity as possible.
PBS currently supports the following desktop browsers:
Chrome **, Internet Explorer 9+, Firefox **, Safari **, Opera **
** Latest, or most widely used version http://gs.statcounter.com/
Mobile devices running: Apple iOS, Android 2.3, & Android 4 **
Google Analytics Tagging
Any national producer website on the pbs,org domain should have Google Tag Manager (GTM) across all webpages. Please view all information about implementation and further details about custom event tracking here: https://docs.pbs.org/display/AN/Implementation+of+Google+Tag+Manager+for+PBS.org+Sites
Registration and Authentication
Any project wishing to provide registration or authentication services to its viewers must utilize PBS Account.
Plug-in Introductory Text
When a plug-in is required to view site content, the teaser must be accompanied by introduction text that:
- Explains what the feature is
- Lists the file size of the feature
- Provides a link to the plug-in download page.
Use of any cookies is subject to the oversight of the PBS technical staff and cookies that extend beyond a user session must be developed in partnership with PBS technical staff.
Airdate Code on PBS.org
To request airdates code for a national program website, please contact your program manager or submit a ticket via the digital support portal.