Apache secure
/etc/apache2/conf-available/security.conf
ServerTokens Prod ServerSignature Off
/etc/apache2/sites-enabled/default-ssl.conf UseCanonicalName On or RewriteRule ^/?$ https://full.host.com/roundcube/ [R=302,L] instead of RewriteRule ^/?$ https://%{HTTP_HOST}/roundcube/ [R=302,L]
- HSTS
- a2enmod headers
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"