I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via sites like dnsdumpster.

Even if we add it in Robots.txt the subdomain url is still available for anyone who knows the website URL.

  • 1
    Hi. Why do you need to hide subdomains?
    – A. Hersean
    Apr 16, 2019 at 11:37
  • I want to share what to share subdomain with my clients but not expose those demos to the world. Apr 16, 2019 at 11:39
  • can using a subdirectory in the WordPress site to keep the demo sites be protected from being publically exposed? For example, using example.com/clientdemo instead of clientdemo.example.com Apr 16, 2019 at 11:41
  • 3
    Subdomains are not what you are looking for. You want to authenticate and authorize your clients, to be sure only your clients can access your demos. If the subdomain names are private, you should use subdirectories instead.
    – A. Hersean
    Apr 16, 2019 at 11:48
  • 2
    @AnantBhandarkar if the subdomain is public, then it is public. You are trying to use the wrong tool for the job.
    – schroeder
    Apr 16, 2019 at 16:20

1 Answer 1


You are using the wrong tool for the Job!

Subdomains are not private. They can't be made private either. The reason why they can't be is because of DNS, or Domain Name System. Without going into too much detail, DNS is a database of all domains and subdomains, and values associated to them. A very simple example:

User: "DNS Resolver, which IP does security.stackexchange.com have?"
DNS: "Hello User, I have the following addresses for security.stackexchange.com:"


User: "Thank you!"

What if you wanted to make sure that a subdomain would remain secret? Well, you couldn't, because the DNS database would still need to know about it. How else would anyone connect?

How to design it instead

What you actually want to do is secure a subdomain so that only specific people have access to it. One way to do it is a traditional password-based login, which gives you a session and authenticates and authorizes you to access the protected content.

Another, perhaps more elegant way, would be to use Client Certificates. You can generate a Certificate Authority and sign as many Client Certificates as you need. These Certificates would only be valid as long as you want them to be (e.g. 2 weeks, 1 month, 1 year, etc.) and can be revoked whenever necessary.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .