Expired messages already stop being readable the moment their expiry date passes - the link then reports the message is no longer available. The cleanup task additionally removes the expired rows from the database, so no expired ciphertext lingers on your server.

Enabling the task

1. Go to System > Manage > Plugins, search for Secure Messages - Cleanup, and enable the plugin. It ships disabled so that enabling scheduled cleanup is a conscious decision.
2. Go to System > Manage > Scheduled Tasks and click New.
3. Choose the task type Secure Messages - Remove expired messages.
4. Give the task a schedule. Once a day is usually plenty; hourly if you use short expiry times a lot.

Make sure your site actually runs scheduled tasks: either through Joomla's built-in "lazy" scheduler (System - Schedule Tasks plugin) or, more reliably, through a real cron job or webcron. See the Joomla documentation on the Task Scheduler for the options.

What it does - and what it doesn't

• Removes every message whose expiry date has passed, and records each removal as an automatic deletion in the User Actions Log.
• Messages with burn-after-reading remove themselves when opened; the cleanup task only catches the ones that were never opened and then expired.
• Messages set to Never expire are never touched - delete those manually from the backend list when you no longer need them.