Nowadays, it’s quite common to have multiple business email addresses. So, forwarding emails to a single account makes email management easier. Most Webmail clients, such as RoundCube, Horde, and SquirrelMail, support email forwarding. But, users may often confuse with this option. That’s why we often get requests from our customers to set “Webmail forwarding” as part of our Server Management Services.

This article has been updated to reflect current server configurations, modern mail setups, and accurate forwarding methods in 2026.

Email forwarding helps redirect incoming messages from one address to another. Many users try to configure forwarding inside Roundcube and get confused about how it actually works.

Today, our experts explain how forwarding works with Roundcube and how to fix a 403 error after an upgrade.

What Roundcube Actually Does

Roundcube is a web-based IMAP email client written in PHP. It provides a browser interface to access email stored on a mail server.

Roundcube does not handle mail delivery. It does not control mailbox storage. It does not create server-level forwarders on its own.

Mail delivery and forwarding are handled by:

• Mail servers such as Postfix
• IMAP servers such as Dovecot
• Hosting control panels like cPanel or Plesk

Roundcube only provides an interface. Forwarding is configured through the mail server or via Sieve filters.

How Email Forwarding Works

Email forwarding can be configured in three common ways.

1. Server-Level Forwarding

Configured directly on the mail server.

Examples:

• Postfix virtual_alias_maps
• Exim forwarders
• Control panel forwarder settings

This method forwards mail before it reaches the mailbox.

2. Sieve-Based Forwarding

Modern setups use Sieve filtering through Dovecot.

If the managesieve plugin is enabled in Roundcube, users can create forwarding rules from the web interface.

In this case:

• The rule is stored on the mail server
• Dovecot processes the forwarding
• Roundcube only manages the rule

This is the most common setup today.

3. Control Panel Forwarders

In shared hosting environments, forwarding is often created inside cPanel or Plesk.

Roundcube will not show a “Forwarders” tab in a standard installation. That option exists in the hosting panel, not in the default Roundcube.

How to Set Up Forwarding Correctly

The correct method depends on your environment.

If Using cPanel

1. Log in to cPanel
2. Open Email → Forwarders
3. Click Add Forwarder
4. Enter destination address
5. Save changes

Roundcube will reflect forwarded messages automatically.

If Using Dovecot Sieve

1. Enable managesieve in Roundcube.
2. Go to Settings → Filters.
3. Create a new filter rule.
4. Choose redirect action.
5. Enter destination address.
6. Save.

The mail server now handles forwarding.

403 Error After Roundcube Upgrade

A 403 error after an upgrade is usually caused by web server security rules.

The most common cause is ModSecurity blocking requests.

ModSecurity is a web application firewall for Apache and NGINX. It blocks suspicious HTTP requests. During upgrades, new URLs or POST requests may trigger security rules.

How to Diagnose the 403 Error

1. Check Apache or NGINX error logs
   • /var/log/httpd/error_log
   • /var/log/apache2/error.log
2. Check ModSecurity audit log
   • /var/log/modsec_audit.log

Look for the rule ID triggered by the request.

An example log entry may show:

ModSecurity: Access denied with code 403 (phase 2). Matched rule id 950004.

Fix Option 1: Disable Specific Rule

Here is the recommended approach:

Identify the rule ID from the logs. Then add:

SecRuleRemoveById 950004

Reload Apache after making changes. This removes only the blocking rule.

Fix Option 2: Disable ModSecurity for Webmail Path

If rule removal is not practical, create an exclusion for the Roundcube directory instead of disabling protection for the entire domain.

Avoid turning off ModSecurity globally. That weakens protection.

Security Considerations

Email forwarding can affect SPF, DKIM, and DMARC validation. Improper forwarding may cause delivery failures.

Modern mail servers often use the Sender Rewriting Scheme to prevent SPF failures during forwarding. Always test forwarding after configuration.

Conclusion

Roundcube is an email client. It does not create server-level forwarders directly. Forwarding is handled by the mail server or hosting panel. Roundcube can manage Sieve rules when properly configured.

A 403 error after upgrade is usually related to ModSecurity rules. Identifying and removing the specific rule is the safest fix.