Op is doing hidden subdomain pattern. Wildcard dns and wildcard ssl.

This way subdomain acts as a password and application essentially inaccessible for bot crawls.

Works very well