Imagine an automated scanner and attack tool. First it fingerprints your server, then it attacks with only payloads it thinks may work. If you trick it into thi

Imagine an automated scanner and attack tool. First it fingerprints your server, then it attacks with only payloads it thinks may work. If you trick it into thinking you run WordPress, for example, then it will attack you with WordPress payloads that won't affect you, even if it happens to know one that does. Attackers have limited resources, so slowing them down with slowloris, or tricking them to use the wrong attacks provides protection. Dedicated attackers may notice the WordPress trick or may just run every payload against you, but automated scanners that are trying to be efficient will not. Hopefully a WAF can detect that much more noisy attack and deny-list their IP address(es), and other more traditional defences kick in.