In order to clear the security check "Check all public / private paths", I added the lines from https://docs.moodle.org/311/en/Apache#Handling_40x_errors to my virtual host settings. This worked insofar as the status is now OK.
But for most files/folder, it says: Returned a 403, ideally should be 404. Furthermore, there is no theming by Moodle as suggested. Trying to open mod/README.txt for example, rather Apache's normal 403 Forbidden page comes up.
So my question would be: How can I get errors to be 404 and themed by Moodle? – Thanks in advance for your help!