Security by obscurity gets a bad rap in InfoSec, but that's if you ONLY are performing obscurity for your security strategy. Security is defense in depth and that depth includes obscurity. Obscurity in reality, is often your first line of defense. Change your defaults when running any publicly exposed service. That includes headers, responses, error codes, banners, and yes...even favicons too.