---
title: "Configuration"
date: 2026-07-27
author: "Claude MCP"
---

# Configuration

All settings live in one place: open **Components \> Secure Messages** and click the **Options** button in the toolbar. The options screen has six tabs.

## Secure Messages Settings

- **Default expiry** - the lifetime applied when the sender cannot choose one (see Field modes below). 1, 3, 7 or 30 days, or Never.
- **Burn after reading by default** - whether messages self-destruct on first opening when the sender cannot choose.

There is deliberately no default password setting. Password protection is part of the encryption key itself, so the page that encrypts the message has to know the password. On the public send form that page is visible to everyone, which means an admin-configured password would be readable by anyone who can open the form - it would protect nothing. Only the sender can set a password, on the form itself.

## Recipients

The recipient list powers the public send form. One recipient per line, in either of two formats:

```
info@example.com
Support|support@example.com
```

A bare e-mail address, or `Name|email` to show a friendly name. With one recipient the form shows a fixed "This message will be sent to ..." line; with more than one, visitors get a dropdown. Lines without a valid e-mail address are silently skipped, and duplicate addresses are merged (the first name wins). **The public form only works when at least one valid recipient is configured** - without it, visitors see a notice that sending is unavailable.

## Field modes

For each of **Expiry**, **Burn after reading** and **Password protection** you decide what the public form offers:

- **Sender chooses** - the visitor sees the control and decides.
- **Use default (shown)** - the admin default applies; the form shows a short fixed notice instead of a control.
- **Use default (hidden)** - the admin default applies silently; the form shows nothing.

These modes are enforced on the server: a manipulated form submission cannot override an admin-enforced default.

For **Password protection** the two default modes mean exactly one thing: messages sent through the public form are not password-protected. In the shown mode the form says so ("This message will not be password-protected."); in the hidden mode it says nothing. Use **Sender chooses** if you want visitors to be able to add a password. Backend messages are unaffected: there you always choose per message.

## Anti-spam

**Require a captcha on the public form** uses whichever captcha plugin is selected under **System \> Global Configuration \> Site \> Default Captcha**. If no captcha plugin is configured there, this setting has no effect and the form simply works without one.

Independently of the captcha, the public endpoints are rate-limited per visitor: at most 20 messages and 10 link e-mails per hour from the same IP address. This runs automatically and has no setting.

## Advanced

**Custom CSS** - stylesheet rules injected on the public pages (both the send form and the message page). Useful to align the form with your template without an override.

From version 1.1.0 your rules are used exactly as written, including the child combinator (`.a > .b`), `:has(> img)` and media query ranges. Version 1.0.0 removed the `<` and `>` characters from this setting, which silently changed such rules. The only thing still removed is a closing style tag.

## Permissions

The standard Joomla permissions tab, with four actions for `com_securemessages`:

- **Configure ACL & Options** - who may open this options screen.
- **Access Administration Interface** - who may open the Messages list.
- **Create** - who may create a message in the backend and e-mail its link from the result panel.
- **Delete** - who may delete (revoke) messages from the list.

Both Create and Delete are enforced server-side, not just hidden in the interface.

## The notification e-mail

The e-mail that delivers the secure link is a regular Joomla mail template. Edit its subject and body under **System \> Templates \> Mail Templates \> com\_securemessages.link**. Two placeholders are available: (the sender's name, or the site name for guests) and (the one-time link). Your edits survive updates.