How to Use Composer on cPanel Hosting for PHP Libraries

Composer is how modern PHP projects pull in libraries such as Dompdf, PHPMailer or Guzzle. On Domain India cPanel hosting Composer isn't pre-installed, but with jailed SSH (on request) you can download composer.phar and run it with PHP; its scripts need a disabled function, so you may need --no-scripts. The other method is to run Composer on your own computer and upload the finished vendor folder. This guide shows both and gives current, working examples for the most-used libraries.

1. Running Composer on the server

Composer isn't pre-installed, but with jailed SSH you can download it into your account and run it with PHP:

curl -sS -o composer.phar https://getcomposer.org/download/latest-stable/composer.phar
php composer.phar install --no-dev --optimize-autoloader

This downloads and installs normal libraries. Composer scripts (the scripts section of composer.json, such as Laravel's package:discover) need PHP's proc_open to start other programs, and on our cPanel servers proc_open, popen, exec and similar functions are disabled for every account, for the web server and the command line alike. A project with scripts stops with an error like:

The Process class relies on proc_open, which is not available on your PHP installation.

This protects every account on the server from a compromised neighbour, and it cannot be switched on for one account. Run the command again with --no-scripts, then run the commands listed under scripts in composer.json yourself with php (for Laravel, php artisan package:discover). Or move the Composer step to your computer, as the next sections show; the code Composer downloads runs fine on the server either way. The full list of disabled functions, and what else they affect, is in PHP disabled functions on shared hosting.

2. Install Composer on your computer

• Windows: download and run Composer-Setup.exe from getcomposer.org. It finds your PHP installation and adds composer to your PATH.
• macOS: brew install composer.
• Linux: follow the command-line installer on getcomposer.org, which checks the installer's signature before running it, then move composer.phar to a folder on your PATH such as ~/.local/bin/composer.

Check it works:

composer --version
php --version

You need PHP on your computer too. Use the same major and minor version as your hosting account if you can.

3. Match your server's PHP version

Libraries publish different releases for different PHP versions. If your computer runs a newer PHP than the server, Composer may pick releases the server cannot run. Tell Composer which version the server has:

1. In cPanel, open MultiPHP Manager and note the version your domain uses.
2. Add it to composer.json:

{
    "config": {
        "platform": {
            "php": "8.3.0"
        }
    }
}

Replace 8.3.0 with your server's version. Composer now chooses releases that work there, even if your laptop has a newer PHP.

4. Build and upload your project

To update a library later, run composer update vendor/package on your computer, rebuild, and upload vendor/ and composer.lock again.

5. Load libraries in your code

Every example below starts by loading Composer's autoloader once:

<?php
require __DIR__ . '/vendor/autoload.php';

If vendor/ sits outside public_html, adjust the path, for example require __DIR__ . '/../myapp/vendor/autoload.php';.

6. Popular libraries that work on shared hosting

A few current examples:

Dompdf: create a PDF

use Dompdf\Dompdf;

$dompdf = new Dompdf();
$dompdf->loadHtml('<h1>Invoice 1001</h1>');
$dompdf->setPaper('A4', 'portrait');
$dompdf->render();
$dompdf->stream('invoice-1001.pdf');

PHPMailer: build the message, send it with mail() and -f

On our cPanel servers, PHPMailer's own isMail() mode sends, but it silently ignores Sender: PHPMailer passes the envelope sender (-f) only when the PHP function escapeshellcmd is available, and it is disabled there. Without -f, the Return-Path is the server's address and SPF no longer lines up with your domain. So let PHPMailer build the message with preSend(), then send it yourself with PHP mail() and -f:

use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;

$from = '[email protected]';            // a mailbox on your own domain
$to   = '[email protected]';

$mail = new PHPMailer(true);
try {
    $mail->isMail();
    $mail->CharSet = 'UTF-8';
    $mail->setFrom($from, 'Your Shop');
    $mail->addAddress($to);
    $mail->Subject = 'Your order';
    $mail->Body    = 'Thank you for your order.';
    $mail->preSend();                     // build the message, don't send it

    // Split the built message into headers and body; mail() adds To and Subject itself.
    [$head, $body] = preg_split("/\r?\n\r?\n/", $mail->getSentMIMEMessage(), 2);
    $head = preg_replace("/\r?\n[ \t]+/", ' ', $head);   // unfold long headers
    $headers = [];
    $subject = '';
    foreach (preg_split("/\r?\n/", $head) as $line) {
        if (stripos($line, 'To:') === 0) { continue; }
        if (stripos($line, 'Subject:') === 0) { $subject = trim(substr($line, 8)); continue; }
        $headers[] = $line;
    }

    if (!mail($to, $subject, $body, implode("\r\n", $headers), '-f' . $from)) {
        error_log('Mail failed: mail() returned false');
    }
} catch (Exception $e) {
    error_log('Mail failed: ' . $mail->ErrorInfo);
}

Use a sender address on your own domain, and set up SPF and DKIM for it. For a complete contact-form handler with validation and Reply-To, see How to use PHPMailer for contact forms; for SPF, DKIM and DMARC, see PHP sendmail settings.

Guzzle: call an API

use GuzzleHttp\Client;

$client = new Client(['timeout' => 10]);
$response = $client->get('https://api.example.com/status');
echo $response->getBody();

Always set a timeout. A request that hangs holds a PHP worker until it finishes.

Intervention Image (version 3): resize a photo

use Intervention\Image\ImageManager;

$manager = ImageManager::gd();
$image = $manager->read('uploads/photo.jpg');
$image->scale(width: 800);
$image->save('uploads/photo-800.jpg');

The old Image::make() syntax belongs to version 2. If a tutorial uses it, it is out of date.

7. Frameworks and Laravel

Frameworks such as Laravel and Slim work the same way: build locally and upload with vendor/, or run Composer over SSH with --no-scripts and then the framework's script commands with php. Framework setup commands that run PHP from the command line (for example generating an application key) also run on your computer before you upload. For the full Laravel route, including .env, the document root and the database, see Deploying Laravel on cPanel or How to install Laravel using Softaculous.

8. Running this on Domain India

Jailed SSH access is available on every shared hosting plan (cPanel, DirectAdmin, Webuzo). It is off by default; ask support to enable it for your account. Login is by SSH key. SSH is useful for unzipping uploads, reading logs and running php composer.phar as described in section 1; the same disabled functions apply on the command line, which is why Composer scripts may need --no-scripts. See jailed SSH on Domain India hosting.

If your project really needs Composer scripts, background workers or programs started from PHP on the server, use a server you control:

• a VPS, self-managed with full root access, where Composer runs normally;
• the App Platform, where PHP apps run from a Dockerfile you provide, so composer install can run as a step in your own build.

For ordinary PHP sites that use libraries, cPanel hosting is enough. The card shows the live price, excluding 18% GST:

Ready to build your project? Read PHP disabled functions on shared hosting first, then compare cPanel hosting, VPS and App Platform plans.