Apache secure

/etc/apache2/conf-available/security.conf

ServerTokens Prod
ServerSignature Off

/etc/apache2/sites-enabled/default-ssl.conf

UseCanonicalName On

or

RewriteRule ^/?$ https://full.host.com/roundcube/ [R=302,L] instead of RewriteRule ^/?$ https://%{HTTP_HOST}/roundcube/ [R=302,L]

# HSTS
# a2enmod headers
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"