Thanks you for a question, just get an A+ after reconfiguring my server
Based on this forum you have to comment alias and configure DocumentRoot only: Security Scan: __Host-Prefix
If you have config for nextcloud directory only, you have to disable it and configure as virtual host. E.g.:
# cat /etc/apache2/sites-enabled/nextcloud.conf
Alias /nextcloud /var/www/nextcloud/
Alias /javascript /usr/share/javascript/
<Directory /var/www/nextcloud/>
Options +FollowSymlinks
AllowOverride All
<IfModule mod_dav.c>
Dav off
</IfModule>
SetEnv HOME /var/www/nextcloud
SetEnv HTTP_HOME /var/www/nextcloud
</Directory>
Run a2dissite nextcloud.conf
to disable this particular config and reload apache2 should be enough to take new config: service apache2 reload