All settings live in one place: open Components > Secure Messages and click the Options button in the toolbar. The options screen has five tabs.

Secure Messages Settings

• Default expiry - the lifetime applied when the sender cannot choose one (see Field modes below). 1, 3, 7 or 30 days, or Never.
• Burn after reading by default - whether messages self-destruct on first opening when the sender cannot choose.
• Require a password by default / Default password - applied together when a field mode uses the admin default with password protection enabled. Note that the recipient must receive this password through another channel.

Recipients

The recipient list powers the public send form. One recipient per line, in either of two formats:

info@example.com
Support|support@example.com

A bare e-mail address, or Name|email to show a friendly name. With one recipient the form shows a fixed "This message will be sent to ..." line; with more than one, visitors get a dropdown. Lines without a valid e-mail address are silently skipped, and duplicate addresses are merged (the first name wins). The public form only works when at least one valid recipient is configured - without it, visitors see a notice that sending is unavailable.

Field modes

For each of Expiry, Burn after reading and Password protection you decide what the public form offers:

• Sender chooses - the visitor sees the control and decides.
• Use default (shown) - the admin default applies; the form shows a short fixed notice instead of a control.
• Use default (hidden) - the admin default applies silently; the form shows nothing.

These modes are enforced on the server: a manipulated form submission cannot override an admin-enforced default.

Anti-spam

Require a captcha on the public form uses whichever captcha plugin is selected under System > Global Configuration > Site > Default Captcha. If no captcha plugin is configured there, this setting has no effect and the form simply works without one.

Advanced

Custom CSS - stylesheet rules injected on the public pages (both the send form and the message page). Useful to align the form with your template without an override.

The notification e-mail

The e-mail that delivers the secure link is a regular Joomla mail template. Edit its subject and body under System > Templates > Mail Templates > com_securemessages.link. Two placeholders are available: {SENDER_NAME} (the sender's name, or the site name for guests) and {SECURE_MESSAGE_LINK} (the one-time link). Your edits survive updates.