Just use a secret path, subdomain will always leak via DNS. You can also disable access logs on anything else than the secret path and cut the noise drastically.