How to Install Composer on Shared Hosting
Install Composer on shared hosting as a local PHAR outside the public web root, using permitted SSH or cPanel Terminal access. Verify the installer against its official signature before running it, then call the PHAR with the account’s PHP binary. Preserve the lock file and check the actual deployment platform rather than bypassing requirements.
For PHP application owners using a shared account, with a verified local installation and deployment checks that do not assume root access or unlimited resources.
knowledge
- Read time
- 4 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
Install Composer inside the project folder
Install Composer as a local PHAR outside the public document root, after verifying the installer against the official signature. Use the account’s supported CLI PHP binary and do not request root privileges.
Follow the current official Composer download instructions. This shell sequence fetches the current signature instead of permanently embedding a checksum that will become stale:
mkdir -p "$HOME/.local/share/composer"
cd "$HOME/.local/share/composer"
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
EXPECTED="$(php -r "copy('https://composer.github.io/installer.sig', 'php://stdout');")"
ACTUAL="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
if [ -z "$EXPECTED" ] || [ "$EXPECTED" != "$ACTUAL" ]; then exit 1; fi
php composer-setup.php --filename=composer.phar
php -r "unlink('composer-setup.php');"
php composer.phar --versionStop on download or checksum failure. Check php -v first: the CLI binary may differ from the domain’s PHP version. From the project directory, call this PHAR through its full path, not an assumed executable in public_html.
Run install and update for your project
With composer.phar in place, the two commands you need are install and update. Install reads composer.lock and reproduces it; update resolves new versions and rewrites the lock.
- Production install:
php composer.phar install --no-dev --optimize-autoloader. This skips test packages and builds a faster autoloader. - Add a package:
php composer.phar require vendor/package, then commit both composer.json and composer.lock. - Update deliberately:
php composer.phar update vendor/package. Update everything only in development. - Verify: the vendor folder exists, and the site loads without a missing class error.
If the plan has no shell at all, run Composer on your own machine and upload the vendor folder with the lock file. That is slower to iterate, but it is the same output.
Run php composer.phar check-platform-reqs --no-dev using the actual deployed PHAR path and runtime. This checks the real platform rather than trusting the emulated config.platform value. The Laravel cPanel guide covers the application deployment separately.
Make composer callable without the path
A Composer shortcut must point to the installed PHAR and the intended PHP binary. For scripts and scheduled jobs, a full path is simpler than an interactive-shell alias.
php "$HOME/.local/share/composer/composer.phar" --versionAn alias depends on shell startup files and normally does not apply to cron. A wrapper can work, but cron still needs the correct executable paths and environment. Installing in a user-writable bin directory does not require a system-wide root installation.
Match Composer's PHP version to the site
The most common shared-hosting Composer failure is a platform mismatch: Composer resolves packages for the CLI PHP version while the site runs another. The install succeeds and the site throws a fatal error.
- In cPanel open MultiPHP Manager and note the PHP version assigned to the domain.
- In Terminal run
php -vand compare. If they differ, either switch the CLI or pin the platform. - If config.platform is used during development, set it to the intended deployment target. It emulates resolution requirements, not the actual extensions or runtime installed on the server.
- Resolve dependency changes deliberately in development against the intended platform, then deploy the reviewed lock file. Updating lock metadata alone is not a guarantee that packages are compatible.
Avoid --ignore-platform-reqs to get past a failing extension. It hides the missing extension until the site calls it in production.
Common Composer failures and fixes
These six cover almost every shared-hosting install that stalls.
| Symptom | Cause | Fix |
|---|---|---|
| composer: command not found | There is no global binary on a shared plan | Call php composer.phar, or add the alias or wrapper |
| ext-zip or ext-json missing | The PHP build lacks an extension Composer needs | Enable it under Select PHP Version, then re-run the install |
| Allowed memory size exhausted | Dependency resolution needs more than the CLI limit | Review CLI memory and host quotas; use a permitted bounded value or build elsewhere, rather than bypassing account limits |
| Could not resolve host: repo.packagist.org | Outbound HTTPS or DNS is blocked from the account | Ask the host to allow it, or build vendor locally and upload it |
| Your requirements could not be resolved | The lock file or platform.php does not match the installed PHP | Set platform.php to the site version, then update the lock |
| Permission denied writing vendor | Files were created by another user, often root | Inspect ownership and ask the host to correct it; do not delete a live vendor tree without a deployment and rollback plan |
When to build dependencies elsewhere
Build dependencies elsewhere when the shared account’s permitted memory, runtime, shell or network access cannot support the job. There is no universal package-count threshold separating shared hosting from VPS use.
Build against the destination platform, preserve composer.lock, upload the application and vendor files, and verify actual PHP extensions. Consult the cPanel hosting scope before assuming Terminal is included, or consider VPS hosting when server-level control is necessary.
Frequently asked questions
Can I install Composer globally on shared hosting?
Usually not. A global binary needs write access to a system path. Install composer.phar in your project or home directory and call it with php, or add a wrapper in ~/bin.
Do I need SSH to install Composer?
You need a shell. cPanel Terminal is enough on plans that include it. Without any shell, run Composer locally and upload vendor together with composer.lock.
Which PHP version does Composer 2 need?
Check the requirements of the Composer release you install and use a supported PHP branch compatible with the application. The CLI and web runtime may differ. A platform override influences dependency resolution but does not install missing extensions or validate the production runtime.
Why does composer install fail with a memory error?
The dependency operation may exceed the CLI memory allocation or account resource limits. Inspect the actual error and permitted configuration. A Composer memory setting cannot override host-enforced limits; build on a matching development or CI environment when the shared account cannot run the job safely.
Is it safe to upload the vendor folder instead?
Yes, if you also upload composer.lock and build with the same PHP version and platform settings. The vendor folder is plain files, and no Composer run is needed on the server.
Where should composer.phar live?
In your home directory or the project root, not inside a public web folder. A PHAR reachable by URL is an unnecessary download and a small information leak.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.