Please use the “Print” function at the bottom of the page to create a PDF.
PHP Composer is a package manager for PHP. It helps you integrate external code modules (libraries) into your own projects. Composer automatically ensures that all the background programs required by these modules (known as dependencies) are downloaded in the correct version.
In this article, you will learn how to download, install, and run Composer for the first time in your webspace at IONOS.
Requirement
- IONOS Hosting Plan with SSH access
If your plan does not support SSH access, you can switch to another hosting contract.
Important information about command execution
To be able to use Composer in your web space, you must run PHP scripts via the command line (PHP CLI). Before copying the commands from these instructions, note these two points:
1. Your active PHP version (IMPORTANT)
The following code examples use X.X. You must replace X.X in all commands that contain the expression phpX.X with the PHP version you use for your specific web project (e.g., php8.3 or php8.4).
Please Note
If you use an incorrect version here, Composer may download incompatible code blocks that, in the worst case, could cause errors on your website.
2. The command suffix (-cli)
To ensure correct execution in your webspace, you need to add the suffix -cli (example for PHP 8.4: php8.4-cli).
Note
Do not use the simple command php without a version number, as otherwise the script will run with an outdated PHP version. You can find a complete list of all available PHP versions in the following article: PHP CLI: Running PHP scripts via the command line.
Step-by-step instructions
Step 1) Establish an SSH connection
Start your SSH client and connect to your webspace. You can find instructions for different operating systems in the following linked Help Center category: SSH Setup and Administration.
Tip
Once the connection has been established, you will see your terminal’s input window. To avoid typing errors, we recommend copying the commands from the code boxes below and pasting them into your terminal. Then press the Enter key after each command to execute it.
Step 2) Prepare the installation directory
Your home directory (~) is also the htdocs directory. This functions as the “Document Root”, meaning the main directory of your website. This means that, as a general rule, anyone can access the files in this directory via the Internet.
For security reasons, you should create a separate subdirectory for Composer, and protect it from external access using an .htaccess file. The following commands create the folder and block public access.
Create a new directory called composer:
mkdir ~/composer
Create and write to an .htaccess file inside the new composer directory:
echo "Require all denied" > ~/composer/.htaccess
Change into the newly created directory:
cd ~/composer
Please Note
Without the .htaccess file, composer.phar could be accessible through the browser. Make sure that the .htaccess file is present in the directory.
Step 3) Download the Composer installation file
Download the installation file from the official Composer website by running the following command:
phpX.X-cli -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
Step 4) Verify the checksum (security check)
Compare the checksum (also called a “fingerprint”) of the downloaded file. This ensures that the file has not been damaged or altered during transfer, and that it is the original file. Since the checksum changes with each update, we retrieve the current “hash” automatically from the Composer infrastructure.
Run the following two commands, one after the other.
Fetch the official checksum for the Composer installer and store it in a variable:
EXPECTED_CHECKSUM="$(phpX.X-cli -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
Check whether the downloaded composer-setup.php file is authentic and hasn't been tampered with:
phpX.X-cli -r "if (hash_file('sha384', 'composer-setup.php') === '$EXPECTED_CHECKSUM') { echo 'Installer Verified'; } else { echo 'Installer Corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
Note
If “Installer Verified” is displayed in the terminal, the file is safe and you can proceed with the installation. If it says “Installer Corrupt”, the file was automatically deleted because it was faulty or compromised. In that case, download the file again.
Step 5) Install the Composer tool
Run the installation file.
phpX.X-cli composer-setup.php
After installation, the composer.phar file is located in the directory you switched to in step 2. The .phar extension stands for “PHP Archive”, which you can think of as an executable program file for PHP.
Step 6) Remove the installation file (cleanup)
The composer-setup.php file is no longer needed. To keep your webspace clean, you should delete it.
phpX.X-cli -r "unlink('composer-setup.php');"
Step 7) Check the installation
Verify the installation by running Composer directly. Make sure you are in the directory where composer.phar is located (see step 2).
phpX.X-cli composer.phar
As a result, a summary of all available Composer commands is displayed.
Step 8) Set up an alias (short command) - optional
To avoid having to always access Composer using the long full file path, you can create an alias. This is a user-defined shortcut for the command line.
Use the following command to permanently add the abbreviation "composer" to your personal configuration file (.bash_profile):
echo "alias composer='phpX.X-cli ~/composer/composer.phar'" >> ~/.bash_profile
This alias will take effect automatically at your next SSH login. To activate it immediately in the current session, reload the configuration with this command:
source ~/.bash_profile
The command composer will then be sufficient to start the tool from any directory.
Check the result
The installation has been completed successfully if, after running Composer, a list of available commands and the installed Composer version is displayed.
To keep Composer up to date, use the self-update command. If you have configured the alias from step 8, you can use composer self-update. Otherwise, run the command directly in the installation directory:
phpX.X-cli composer.phar self-update
Troubleshooting
The terminal displays the error message “command not found”
You probably copied the command literally, including the placeholder (e.g., phpX.X-cli). Please replace the X.X in the command with the actual PHP version of your web project (e.g., php8.2-cli or php8.4-cli) and run the command again.The command “composer” is not found
The shortcut composer is only available if you configured the alias in step 8. Use the command cat ~/.bash_profile to check whether the alias was added correctly. Then either log in again via SSH or run source ~/.bash_profile to load the changes. Access Composer without the alias directly via the PHP CLI command and composer.phar (see step 8).Checksum mismatch (“Installer Corrupt”)
The downloaded file was either corrupted or compromised, so it has been automatically deleted. Please repeat step 3 (download) and step 4 (verification).PHP error messages when running Composer
Make sure you have not accidentally used the wrong PHP version in the command. You must specify exactly the PHP version used by your web project (see section “Important notes on command execution”).