diff --git a/app/controllers/api/v1/sites_controller.rb b/app/controllers/api/v1/sites_controller.rb
index 05abc38a..995a6ab6 100644
--- a/app/controllers/api/v1/sites_controller.rb
+++ b/app/controllers/api/v1/sites_controller.rb
@@ -4,27 +4,44 @@ module Api
   module V1
     # API para sitios
     class SitesController < BaseController
-      http_basic_authenticate_with name: ENV['HTTP_BASIC_USER'],
-                                   password: ENV['HTTP_BASIC_PASSWORD']
+      SUBDOMAIN = ".#{Site.domain}"
+      PARTS = Site.domain.split('.').count
+
+      if Rails.env.production?
+        http_basic_authenticate_with name: ENV['HTTP_BASIC_USER'],
+                                    password: ENV['HTTP_BASIC_PASSWORD']
+      end
 
       # Lista de nombres de dominios a emitir certificados
       def index
-        render json: alternative_names + api_names + www_names
+        render json: alternative_names.concat(api_names).concat(www_names)
       end
 
       private
 
+      # @param query [ActiveRecord::Relation]
+      # @return [Array<String>]
+      def hostname_of(query)
+        query.pluck(Arel.sql("values->>'hostname'")).compact.uniq
+      end
+
       def canonicalize(name)
         name.end_with?('.') ? name[0..-2] : "#{name}.#{Site.domain}"
       end
 
+      # Es un subdominio directo del dominio principal
+      #
+      # @param name [String]
+      # @return [Bool]
       def subdomain?(name)
-        name.end_with? ".#{Site.domain}"
+        name.end_with?(SUBDOMAIN) && name.split('.').count == (PARTS + 1)
       end
 
       # Dominios alternativos
+      #
+      # @return [Array<String>]
       def alternative_names
-        (DeployAlternativeDomain.all.map(&:hostname) + DeployLocalizedDomain.all.map(&:hostname)).map do |name|
+        hostname_of(DeployAlternativeDomain.all).concat(hostname_of(DeployLocalizedDomain)).map do |name|
           canonicalize name
         end.reject do |name|
           subdomain? name
@@ -34,11 +51,13 @@ module Api
       # Obtener todos los sitios con API habilitada, es decir formulario
       # de contacto y/o colaboración anónima.
       #
-      # TODO: Optimizar
+      # @return [Array<String>]
       def api_names
         Site.where(contact: true)
             .or(Site.where(colaboracion_anonima: true))
-            .select("'api.' || name as name").map(&:name).map do |name|
+            .pluck(:name).map do |name|
+              "api.#{name}"
+            end.map do |name|
               canonicalize name
             end.reject do |name|
               subdomain? name
@@ -47,8 +66,8 @@ module Api
 
       # Todos los dominios con WWW habilitado
       def www_names
-        Site.where(id: DeployWww.all.pluck(:site_id)).select("'www.' || name as name").map(&:name).map do |name|
-          canonicalize name
+        Site.where(id: DeployWww.all.pluck(:site_id)).pluck(:name).map do |name|
+          canonicalize "www.#{name}"
         end
       end
     end