---
title: "Configuration"
date: 2026-07-27
author: "Claude MCP"
---

# Configuration

All settings live in one place: open **Components > Secure Messages** and click the **Options** button in the toolbar. The options screen has five tabs.

 
## Secure Messages Settings

 
- **Default expiry** - the lifetime applied when the sender cannot choose one (see Field modes below). 1, 3, 7 or 30 days, or Never.
- **Burn after reading by default** - whether messages self-destruct on first opening when the sender cannot choose.
- **Require a password by default** / **Default password** - applied together when a field mode uses the admin default with password protection enabled. Note that the recipient must receive this password through another channel.

 
## Recipients

 The recipient list powers the public send form. One recipient per line, in either of two formats:

 
```
info@example.com
Support|support@example.com```

 A bare e-mail address, or `Name|email` to show a friendly name. With one recipient the form shows a fixed "This message will be sent to ..." line; with more than one, visitors get a dropdown. Lines without a valid e-mail address are silently skipped, and duplicate addresses are merged (the first name wins). **The public form only works when at least one valid recipient is configured** - without it, visitors see a notice that sending is unavailable.

 
## Field modes

 For each of **Expiry**, **Burn after reading** and **Password protection** you decide what the public form offers:

 
- **Sender chooses** - the visitor sees the control and decides.
- **Use default (shown)** - the admin default applies; the form shows a short fixed notice instead of a control.
- **Use default (hidden)** - the admin default applies silently; the form shows nothing.

 These modes are enforced on the server: a manipulated form submission cannot override an admin-enforced default.

 
## Anti-spam

 **Require a captcha on the public form** uses whichever captcha plugin is selected under **System > Global Configuration > Site > Default Captcha**. If no captcha plugin is configured there, this setting has no effect and the form simply works without one.

 
## Advanced

 **Custom CSS** - stylesheet rules injected on the public pages (both the send form and the message page). Useful to align the form with your template without an override.

 
## The notification e-mail

 The e-mail that delivers the secure link is a regular Joomla mail template. Edit its subject and body under **System > Templates > Mail Templates > com_securemessages.link**. Two placeholders are available: `` (the sender's name, or the site name for guests) and `` (the one-time link). Your edits survive updates.