Plan a Secure Self-Managed Roundcube Installation

Roundcube is a browser-based IMAP client. Installing it does not create mailboxes or install a complete receiving/sending mail service. This guide concerns a self-managed Roundcube deployment, including older Webuzo/Bread Basket installations. For access to an existing hosted Webmail service, use the separate Webmail login guide instead of installing another copy.

Check the supported deployment boundary

Confirm who maintains the webmail application, web server, PHP runtime, database, IMAP service and authenticated SMTP endpoint. A panel-managed installation should follow its supported package/update process. Do not run blanket Exim/Dovecot restarts or a second one-click server installation merely because a login fails.

Choose a maintained Roundcube release and read the installation instructions shipped with that release. Current upstream development documentation differs from older releases: it specifies a public_html web document root for 1.7 and later, while older 1.6 installations have different layout/installer paths. Do not copy a master-branch path blindly into an older package.

Install without exposing configuration or credentials

1. Preserve existing configuration, database and recovery material before replacing an installation. Use a separate test location and no customer credentials during initial setup.
2. Obtain verified release artifacts or the panel’s maintained installer. Check the matching PHP/extensions, database and file-permission requirements.
3. Configure the intended HTTPS virtual host and release-appropriate document root. Protect configuration, logs, temporary files, backups and database credentials against direct web access.
4. Provide a dedicated appropriately privileged application database identity where required. Do not reuse an unrelated site’s database administrator credentials.
5. Set the real IMAP and SMTP hosts, their supported TLS modes and authentication. IMAP commonly uses 993 for implicit TLS; Roundcube is not a POP3 client. Do not select an unencrypted “NONE” mode to suppress a certificate error.
6. Run the release-specific setup/check process in a restricted setup context. Disable/remove installer access as instructed once finished, and confirm it cannot be reopened publicly.

Verify the web and mail paths separately

Check direct access to sensitive paths and a representative protected configuration resource; a disabled directory listing alone does not prove files cannot be downloaded. Keep browser/server errors private and monitor application updates and security advisories.

With an authorized synthetic account, verify login, listing, message reading, composing, SMTP submission, sent-folder placement and attachments. Inspect actual errors and certificate names. A database connection test or installer success is not proof that mail is encrypted or delivered. Restrict configurable mail endpoints according to the intended deployment rather than exposing an arbitrary-host credential proxy.

Keep an application/database backup and an independently verified mailbox recovery plan. Roundcube’s local database can hold preferences and contacts; the IMAP server holds mail. Neither installing Roundcube nor clearing its database safely restores the other.

References: Roundcube installation/version notes and current upstream installation reference. Use the documentation bundled with the deployed release as the operational authority.

Reviewed October 15, 2026. Documentation review only; no Roundcube deployment, installer exposure check, database or production mail service was executed.