For the purposes of the EDX project, we are evaluating all public-facing domains which meet the following criteria:
- Domain managed by GSA and accessible from the public internet (no VPN)
- All public-facing production websites and GSA-operated digital services (inclusive of those whose only public page consists of a login screen) that are managed by the General Services Administration (GSA).
Domains for exclusion are those that:
- Domains used for strictly for API's.
- While an API is a digital service that lives at a domain address, the principles applied to a website do not mesh well with API standards and practices.
- Domains used solely for email distribution
- Domains that perform a 30x redirect and do not serve content
- Domains used as static hosts for image, video, or data content which gets consumed by other sites and does not have its own index or home page.
The exclusion list is not to say that the data is not valuable, it should be tracked so that we know what is present and do not have to re-examine a previously found property.
For record keeping purposes, domains will be tracked as the 'bare' domain (no www prefix)