Composer for PHP: install and manage packages on UnderHost

Composer installs the PHP libraries your project depends on. You list them in composer.json, Composer downloads them into the vendor/ folder, and composer.lock records the exact versions so every install is the same. Laravel, Symfony and most modern PHP applications rely on it.

Where you can run Composer

Install Composer

First check whether it is already there:

composer --version
php -v

On a VPS or dedicated server (as root), install it for all users with the official installer. Check the installer's hash against the one on getcomposer.org/download first:

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "echo hash_file('sha384', 'composer-setup.php'), PHP_EOL;"   # compare with getcomposer.org
php composer-setup.php --install-dir=/usr/local/bin --filename=composer
php -r "unlink('composer-setup.php');"
composer --version

In a hosting account with SSH (no root), install it in your home folder instead:

mkdir -p ~/bin
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php composer-setup.php --install-dir="$HOME/bin" --filename=composer
rm composer-setup.php
echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc

Everyday commands

Commit composer.json and composer.lock to Git. Do not commit vendor/; it is rebuilt from the lock file.

Shared hosting: build, then upload

Shared plans include PHP and let you choose the PHP version, but not SSH. Run Composer on your computer or in a CI job, then upload the result.

1. Match the server's PHP version

   Check the version set for your site in cPanel → Select PHP Version, then tell Composer to resolve packages for it, even if your computer runs a newer PHP:

# set the target PHP version once (use your site's version)
composer config platform.php 8.3

# build production dependencies
composer install --no-dev --optimize-autoloader

2. Upload the project

   Zip the project including vendor/, upload it with FTP or the cPanel File Manager, and extract it. Uploading one zip file is much faster than thousands of small files. See FTP vs SFTP.

3. Keep the web root clean

   Where your framework allows it, point the domain at the project's public/ folder so vendor/ and config files are not reachable from the web.

Production installs

composer install --no-dev --optimize-autoloader --no-interaction

• --no-dev skips development tools such as test frameworks.
• --optimize-autoloader makes class loading faster.
• Run Composer as the user that owns the site files, never as root inside a website folder.
• Automate it in your deploy. See Deploy from Git.

Troubleshooting

"Allowed memory size exhausted": Composer needs more memory than the PHP command-line limit. Run COMPOSER_MEMORY_LIMIT=-1 composer install. On shared hosting, build locally instead.

"Your requirements could not be resolved" or "requires php >=": a package needs a newer PHP than you have. Raise the site's PHP version, or set platform.php to the server's version and pick package versions that support it.

"the requested PHP extension ... is missing": enable the extension in Select PHP Version → Extensions on cPanel, or install it on your VPS. See PHP Selector.

Class not found after upload: vendor/ is missing or incomplete. Upload it again as one zip, or run composer dump-autoload -o.

Site works locally but not on the server: the server runs an older PHP than your computer. Set platform.php as shown above and rebuild.

FAQ

Related: Deploy Laravel | Deploy Symfony | Deploy from Git | PHP Selector in cPanel

Related articles