We often mock "security through obscurity", but it is not
without value, especially in today's web environment. Most
attacks today are statistical in nature: a virus attempts to
infect 10,000 computers by blasting out random attacks. If it
infects even two more computers out of those 10,000, it has
achieved its goal. Those viruses are aggressive in volume, not
precision. They don't all do a port scan, analyze the responses
to determine OS version, they don't do a vulnerability
assessment, then launch a precise attack the way a human would.
Instead, they try to exploit a common weakness - a buffer
overrun exploit in PHP, or SQL injection vulnerability in a
Wordpress plugin. Anything the system administrator does to
alter their defaults: changing the base URL from "index.html" to
"index.htm", or changing the database names in MySQL, might keep
a particular automated attack from harming his system. It
doesn't remove the vulnerability, it merely changes it so that
an attack relying on the defaults will not succee