Roundcube remains one of the most widely deployed open-source webmail clients, offering a clean, desktop-like user interface over standard IMAP and SMTP protocols. Whether hosting webmail for a few business accounts or managing a multi-tenant platform for thousands of users, maintaining an optimal Roundcube installation requires careful configuration of caching, security headers, and extension plugins.

Below are core administrative strategies to ensure your Roundcube deployment remains fast, secure, and easy to maintain.

PERFORMANCE OPTIMIZATION AND CACHING

Because Roundcube acts as an IMAP client, inefficient handling of mail server requests can result in high CPU utilization and slow page loads for end users.

Enable IMAP Caching: Configure imap_cache in config/config.inc.php using Redis or Memcached rather than local SQL databases. Caching mailbox folder lists and headers significantly reduces overhead on the backend IMAP server (such as Dovecot or Cyrus).

Optimize Database Queries: Periodically clean up session tables and cached messages by running Roundcube's internal maintenance scripts (bin/cleandb.sh).

Enable HTTP Compression: Ensure Gzip or Brotli compression is active on your web server (Nginx or Apache) for static assets like CSS, JavaScript, and skin icons.

HARDENING SECURITY AND AUTHENTICATION

As a public-facing web service, webmail is a frequent target for credential stuffing and brute-force attacks.

Enforce HTTPS and HSTS: Force SSL/TLS connections across all webmail sessions and set strict transport security headers in web server configurations.

Protect Session Tokens: Verify that request_token checks are enabled to prevent Cross-Site Request Forgery (CSRF). Keep session_lifetime set to a reasonable duration to log out inactive users automatically.

Implement Two-Factor Authentication (2FA): Install a community-verified 2FA plugin (such as twofactor_gauthenticator) to enforce TOTP login verification for administrative and sensitive accounts.

PLUGIN MANAGEMENT AND SKINS

Roundcube's plugin ecosystem extends core functionality without modifying core source code, making updates seamless.

Use Composer for Dependency Management: Manage plugin installations via Composer using composer.json in the Roundcube root directory to handle version compatibility automatically during core upgrades.

Responsive Skin Selection: Deploy modern responsive skins like Elastic to ensure full mobile device compatibility without requiring separate web interfaces.

I'm using DirectAdmin for my 1st time.  There I was able to install version 1.6.18.

I appear to get a lot of unable to connect type error messages, even though I'm actually connected.  Is that due to the server?

Also, I'm testing the default password plugin.  I added config,inc.php to that plugin after reading the read me file.  Every time that I test changing a password, I get a passwords don't match error.  What could I be doing wrong?  :--)

Quote from: JohnDoh on August 21, 2026, 02:49:12 AMcan you explain what you mean by glitchy? may be post a screenshot. could it be you are just in plain text mode? what version of roundcube are you running and what skin? are there any js errors in the browser console?

Also, I tried inserting screenshots, but they evidently didn't work.

Quote from: JohnDoh on August 21, 2026, 02:49:12 AMcan you explain what you mean by glitchy?

Glitchy, as in sometimes the options are fully displayed, and sometimes they are not. I am beginning to think that the variability has to do with whether I am choosing to display my tabs vertically or horizontally.

Quotemay be post a screenshot.

Quotecould it be you are just in plain text mode?

I have the settings adjusted to "always compose in html

Quotewhat version of roundcube are you running and what skin?

Version 1.6.18, elastic

Quoteare there any js errors in the browser console?

None that I have seen
[/quote]

can you explain what you mean by glitchy? may be post a screenshot. could it be you are just in plain text mode? what version of roundcube are you running and what skin? are there any js errors in the browser console?

official downloads are available from the website and GitHub

Greetings-

I did a quick search for my problem, but I did not find anything that seemed to match. Aplogies if this has been covered and I simply missed it.

Has anyone experienced a "glitchy" toolbar when responding to emails in Roundcube using the HTML composer? I am frequently unable to respond to emails with colored or bolded text when I am trying to highlight my responses.

I am using both the latest macOS release and Google Chrome.

Thanks for chiming in!

Hi all,

i recently updated to Ubuntu 26.04 resolute LTS:

root@bywater ~ # lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 26.04 LTS
Release:        26.04
Codename:       resolute

that contains roundcube 1.6.11:

root@bywater ~ # dpkg -l roundcube
┌── Desired=Unknown/Install/Remove/Purge/Hold
│┌─ Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
││┌ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
│││ Name           Version       Architecture Description
├┼┼─══════════════─═════════════─════════════─════════════════════════════════════════════════════════════════════
ii  roundcube      1.6.11+dfsg-1 all          skinnable AJAX based webmail solution for IMAP servers - metapackage

and also php8.5:

root@bywater ~ # dpkg -l php
┌── Desired=Unknown/Install/Remove/Purge/Hold
│┌─ Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
││┌ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
│││ Name           Version         Architecture Description
├┼┼─══════════════─═══════════════─════════════─═══════════════════════════════════════════════════════
ii  php            2:8.5+99ubuntu1 all          server-side, HTML-embedded scripting language (default)

With php8.5, roundcube 1.6.11 cannot start (known):
 roundcube-gc.service - Purge expired Roundcube sessions, caches and tempfiles
     Loaded: loaded (/usr/lib/systemd/system/roundcube-gc.service; static)
     Active: failed (Result: exit-code) since Thu 2026-08-20 12:35:00 CEST; 19min ago
 Invocation: 885d5ce3db344979b5105f057bcbbc99
TriggeredBy: ● roundcube-gc.timer
       Docs: https://github.com/roundcube/roundcubemail/wiki/Installation
    Process: 2247205 ExecStart=/usr/share/roundcube/bin/gc.sh (code=exited, status=255/EXCEPTION)
   Main PID: 2247205 (code=exited, status=255/EXCEPTION)
   Mem peak: 13.1M
        CPU: 78ms

Aug 20 12:35:00 bywater systemd[1]: Starting roundcube-gc.service - Purge expired Roundcube sessions, caches and tempfi>
Aug 20 12:35:00 bywater gc.sh[2247205]: PHP Fatal error:  Cannot redeclare function array_first() in /usr/share/roundcu>
Aug 20 12:35:00 bywater gc.sh[2247205]: Stack trace:
Aug 20 12:35:00 bywater gc.sh[2247205]: #0 /usr/share/roundcube/program/include/clisetup.php(25): require_once()
Aug 20 12:35:00 bywater gc.sh[2247205]: #1 /usr/share/roundcube/bin/gc.sh(22): require('...')
Aug 20 12:35:00 bywater gc.sh[2247205]: #2 {main}
Aug 20 12:35:00 bywater systemd[1]: roundcube-gc.service: Main process exited, code=exited, status=255/EXCEPTION
Aug 20 12:35:00 bywater systemd[1]: roundcube-gc.service: Failed with result 'exit-code'.
Aug 20 12:35:00 bywater systemd[1]: Failed to start roundcube-gc.service - Purge expired Roundcube sessions, caches and>
~

I cannot downgrade php to 8.4 because that will break a lot of services. So i have to upgrade roundcube to 1.7.x. Ubuntu does not provide a roundcube package other than 1.6.11, and it seems to plan  to continue so for the next release. So i need a source for a recent roundcube package to avoid an install from sources. Are there any?

Kind regards,
QNo

While I can read my email remotely, I cannot send.
I see AUTH error on my server.
I suspect that something changed when I updated to V1.6.17.
This is the first time I have used roundcube to send for several months but it used to work for me.

I get the confusion. Creating folders is separate from moving emails into them. That requires server-side filtering, like Sieve rules via the managesieve plugin.