Does an XBRL report need to be posted on a corporate website?

Yes.  As part of the SEC's ruling for interactive data disclosure, filers are required to post their financial statements in interactive data format on their corporate website the same day it was filed (or was required to be filed) to the SEC.  See Rule Release 33-9002, Part II.B.5 for more details.

The interactive data should be accessible through the website address the issuer normally uses to disseminate information to investors and should remain accessible for at least twelve months.

Simply linking to the interactive data posted on the SEC's website is not sufficient to meet this requirement. You can provide a link to your filing on the SEC's website to give users access to the filing in its entirety, but you must host the interactive data files as well as the other files required to be posted by other SEC rules on the corporate website. 

The XBRL files are exported from GoFiler Complete or GoXBRL (*.xsd, *.xml, *_cal.xml, *_pre.xml, *_lab.xml, *_def.xml) and must be the exact files submitted to the SEC.

The XBRL file set must be available in a downloadable form.  You do not need to have software or an add-on to display the rendered XBRL report, though you may choose to employ one.  The SEC has provided the source code for their rendering engine, which can be incorporated into a website for the purpose of providing the rendered XBRL report to investors. There are also a number of third party corporate IR support firms that can provide XBRL viewer services, should you elect to use an XBRL viewer.