Installing Composer and Using It to Manage PHP Libraries: A Comprehensive Guide

Composer is the dependency manager for PHP: you list the libraries your project needs, and Composer downloads the right versions, their own dependencies and an autoloader that loads them for you. This guide installs Composer 2 on your computer or your own VPS, covers the everyday commands, and shows how to deploy a Composer project to shared hosting, where Composer isn't pre-installed but can be run over jailed SSH.

1. What Composer does

Three files and folders do all the work:

Version constraints use ^ most of the time: "guzzlehttp/guzzle": "^7.9" allows any 7.x from 7.9 up, but never 8.0, which may break your code.

2. Install Composer

You need PHP on the command line (php -v) with the openssl and zip extensions; git and unzip help too.

• Windows: download and run Composer-Setup.exe from getcomposer.org. It finds your PHP and adds composer to your PATH.
• macOS: brew install composer.
• Linux or your VPS: use the official installer and check its signature before running it:

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
EXPECTED="$(curl -fsSL https://composer.github.io/installer.sig)"
ACTUAL="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
[ "$EXPECTED" = "$ACTUAL" ] && echo "Installer verified" || { echo "Installer corrupt"; rm composer-setup.php; exit 1; }
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
rm composer-setup.php
composer --version

Distribution packages (apt install composer, dnf install composer) also work but are often a version behind; composer self-update keeps the installer version current. Don't run Composer as root on a project; use your normal user.

3. Everyday commands

composer init                               # create composer.json interactively
composer require guzzlehttp/guzzle          # add a library
composer require --dev phpunit/phpunit      # add a development-only tool
composer install                            # install exactly what composer.lock says
composer update vendor/package              # update one library within its constraint
composer remove vendor/package              # remove a library
composer outdated --direct                  # what has newer versions
composer audit                              # known security advisories in your dependencies

Then load everything with one line at the top of your entry script:

<?php
require __DIR__ . '/vendor/autoload.php';

Use install for deployments and update only when you mean to change versions, then test and commit the new composer.lock. Running update blindly on a live project is how sites break.

Your own classes can use the same autoloader. Add a PSR-4 mapping to composer.json and run composer dump-autoload:

{
    "autoload": {
        "psr-4": { "App\\": "src/" }
    }
}

4. Deploy a Composer project to shared hosting

The simplest route is to build the vendor/ folder on your computer. The one thing to get right is the PHP version.

Jailed SSH access is available on every shared hosting plan (cPanel, DirectAdmin, Webuzo). It is off by default; ask support to enable it for your account. On our cPanel servers git is available inside the jail, so you can pull your code with Git and build vendor/ there: download Composer with curl -sS -o composer.phar https://getcomposer.org/download/latest-stable/composer.phar and run php composer.phar install --no-dev --optimize-autoloader. If it stops with a proc_open message, run it again with --no-scripts and run the commands under scripts in composer.json yourself with php. For a full framework example, see Deploying Laravel on cPanel.

5. Libraries worth knowing

Sending mail with PHPMailer on cPanel: SMTP fails on our cPanel servers because the socket functions it needs are disabled. PHPMailer's isMail() mode with Sender is no fix either: PHPMailer passes the envelope sender (-f) only when escapeshellcmd is available, and it is disabled there, so Sender is silently ignored and the Return-Path becomes the server's address. Instead, let PHPMailer build the message with preSend(), then send it yourself with PHP mail() and -f:

$from = '[email protected]';           // a mailbox on your own domain
$mail->isMail();
$mail->setFrom($from, 'Your Site');
$mail->addAddress($to);
// ... Subject, Body, attachments ...
$mail->preSend();                           // build the message, don't send it

// Split headers from body, take out To and Subject, then send with -f.
[$head, $body] = preg_split("/\r?\n\r?\n/", $mail->getSentMIMEMessage(), 2);
$head = preg_replace("/\r?\n[ \t]+/", ' ', $head);
$headers = [];
$subject = '';
foreach (preg_split("/\r?\n/", $head) as $line) {
    if (stripos($line, 'To:') === 0) { continue; }
    if (stripos($line, 'Subject:') === 0) { $subject = trim(substr($line, 8)); continue; }
    $headers[] = $line;
}
mail($to, $subject, $body, implode("\r\n", $headers), '-f' . $from);

The complete handler, with validation and error handling, is in How to use PHPMailer for contact forms.

On DirectAdmin we haven't measured the socket functions, so test SMTP on your plan. See PHP sendmail settings.

Keep debugging tools such as filp/whoops in require-dev only; an error page that shows code and settings must never reach a live site.

6. Troubleshooting

7. Where Domain India fits

Shared hosting runs Composer-built PHP projects well once you upload vendor/.

A VPS gives you root access, so you can install Composer on the server, run it in your deployment script and use any PHP extension. It is self-managed.

Prices on the cards are live and exclude 18% GST. The App Platform detects Node.js apps automatically; a PHP app there needs its own Dockerfile.

Ready to deploy your PHP project? Read PHP disabled functions on shared hosting, compare cPanel hosting and VPS plans, or open a ticket if you are not sure which fits your project.