We often mock "security through obscurity", but it is not without value, especially in today's web environment.
Most attacks today are statistical in nature: a virus attempts to infect 10,000 computers by blasting out random attacks. If it infects even two more computers out of those 10,000, it has achieved its goal.
Those viruses are aggressive in volume, not precision. They don't all do a port scan, analyze the responses to determine OS version, they don't do a vulnerability assessment, then launch a precise attack the way a human would. Instead, they try to exploit a common weakness - a buffer overrun exploit in PHP, or SQL injection vulnerability in a Wordpress plugin. Anything the system administrator does to alter their defaults: changing the base URL from "index.html" to "index.htm", or changing the database names in MySQL, might keep a particular automated attack from harming his system. It doesn't remove the vulnerability, it merely changes it so that an attack relying on the defaults will not succeed.
Will this keep out a determined attacker? Of course not. But it will reduce the number of low-level threats that can still surprise anyone if they exploit a 0day vulnerability. And those low-level threats can quickly escalate to be every bit as damaging as an Advanced Persistent Threat.
That's why obscurity, which I define here as to be "any implementation settings changed from the default", still improves your overall security picture. It may only reduce a few particular attacks, or delay them by a few days, but those days can be enough to get a real patch installed. In practice, preventing a threat from becoming a successful attack is the true job of security, regardless of whether it was based on bad theory.