If a HTTPS service should be hard to discover, an easy way is to hide it behind a subdirectory. Something like https://subdomain.domain.example/hard_to_find_sec

If a HTTPS service should be hard to discover, an easy way is to hide it behind a subdirectory. Something like https://subdomain.domain.example/hard_to_find_secret_string https://subdomain.domain.example/hard_to_find_secret_string. Another option are wildcard certificates. This obviously can't be the only protection. But if an attacker doesn't know about a service, or misses it during discovery, they can't attack it.