Need Composer for a PHP application, but your hosting account does not give you root access? You can still install and run Composer in your own account. The key is to use SSH and a local Composer executable rather than trying to put Composer in a server-wide directory.
This guide walks through the process: check your command-line PHP setup, download Composer, run it for your project, and handle common errors. Root access is not required because Composer can be installed in a directory you own and invoked with PHP. VeeroTech’s shared hosting plans include SSH access; if SSH is not enabled on your account, see the SSH access guide.
Important: The PHP version used by SSH may differ from the version your website uses. Check both before installing dependencies.
What Composer does and what “without root” means
Composer is a dependency manager for PHP. It reads your project’s composer.json file, downloads the libraries your application needs, and typically places them in a vendor directory.
A system-wide Composer installation usually goes in a protected location such as /usr/local/bin. Writing there often requires root or administrator privileges. A local installation keeps the Composer executable in a directory your hosting account can access. You run it with PHP, for example:
php composer.phar install
That distinction matters: Composer itself can be installed locally, while your project dependencies are installed wherever the project is located.
Before you begin
You’ll need:
- A hosting account with SSH or cPanel Terminal access.
- The path to your PHP project.
- A compatible command-line PHP version.
- Permission to write to the directory where Composer and your dependencies will go.
VeeroTech’s SSH guide explains how to request SSH access and connect. The SSH port is provided by support, so don’t assume it is port 22.
Check PHP from the command line
Connect over SSH and run:
php -v
This shows the PHP version available to the shell. You can also inspect the PHP executable and loaded configuration:
which php
php --ini
If the PHP version does not match your application’s requirements, check the account’s PHP Selector in cPanel. VeeroTech’s PHP Version Selector guide covers changing the PHP version for an account. Then run php -v again: the command-line PHP version is the one Composer will use.
Composer’s requirements can change Composer installation instructions over time, and your project may have its own PHP requirement. Check the current and your project’s composer.json before proceeding. Composer also checks for required PHP extensions when resolving packages.
How to install Composer on shared hosting without root access
1. Choose a private location for Composer
You can install Composer inside a project directory or a private bin folder in your account. A private location is a good choice when you manage multiple projects.
Create the folder if needed, then move into it:
mkdir -p ~/bin
cd ~/bin
If your account doesn’t support the ~ shortcut, use your home-directory path instead. You can find the current directory with:
pwd
Avoid placing the Composer executable in a publicly accessible folder if you can. Composer is a command-line tool; visitors do not need access to its PHAR file.
2. Download the official installer
Use the official Composer installer over HTTPS:
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
Before running an installer, follow Composer’s current download and verification instructions. They explain how to verify the installer’s checksum. This helps confirm that the downloaded file matches the official installer.
If the download command fails, check whether your PHP configuration allows URL access or whether your hosting account provides curl or wget. Contact support if the server blocks outbound HTTPS requests.
3. Run the installer locally
Run the installer and give the PHAR a clear filename:
php composer-setup.php --filename=composer.phar
When it finishes, remove the setup script:
rm composer-setup.php
You now have a local Composer executable. No system directory or root permission is needed. The official Composer documentation describes local installation and running Composer through PHP.
4. Confirm that Composer works
Check its version:
php ~/bin/composer.phar --version
If you installed it in the current directory instead, run:
php composer.phar --version
A version number confirms that PHP can run the PHAR. If you see a PHP error, check that you’re using the intended PHP CLI executable and that it meets Composer’s current requirements.
5. Install your project’s dependencies
Change to the directory containing composer.json:
cd ~/path-to-your-project
Then install the dependencies:
php ~/bin/composer.phar install
If composer.lock is present, install uses the locked versions, helping keep deployments consistent. Composer’s basic usage guide explains how install, update, and the lock file work.
For a production deployment, you may use:
php ~/bin/composer.phar install --no-dev --optimize-autoloader
Use this only when you intend to omit development packages from the production environment. Keep the project’s composer.lock file with the code so deployments use the versions the project expects.
Suggested in-article image: A simple three-step diagram showing SSH → local composer.phar → project vendor directory.
Alt text: “Composer installation flow from SSH to PHP project dependencies”
Local Composer vs. system-wide Composer
| Setup | Root access needed? | How you run it | Best for |
| Local PHAR in your account | No | php ~/bin/composer.phar |
Shared hosting and individual projects |
| System-wide executable | Usually yes | composer |
Server administrators managing many accounts |
| Dependencies installed on your computer | No server Composer required | Upload the project’s files | Hosts without SSH or suitable CLI PHP |
For shared hosting, a local PHAR is usually the most direct option when SSH is available. If you build dependencies locally, make sure your development environment matches the hosting server’s PHP version and extensions.
Common Composer problems on shared hosting
“Permission denied”
Install Composer under your account’s home directory, not in a protected system folder. If dependency installation fails, check that your account can write to the project directory. Avoid changing permissions broadly; ask support if you’re unsure which folders should be writable.
“Could not open input file” or “command not found”
Use the path to the PHAR explicitly:
php ~/bin/composer.phar --version
If PHP itself is not found, ask your host which PHP CLI command or path to use. The PHP CLI is intended for running PHP scripts from the shell, as described in the PHP command-line manual.
PHP version or missing extension errors
Composer checks the PHP version and extensions available to the command-line process. Compare php -v and php -m with your application’s requirements. A PHP version selected for the website may not automatically change the version used in SSH, so ask your provider for the correct CLI path if they differ.
Composer runs out of memory or hits a timeout
Shared hosting may apply resource limits to shell processes. Try installing only the production dependencies with --no-dev, and avoid running unnecessary update operations on the live site. If the command still stops, ask your hosting provider whether a longer-running Composer task is supported.
Practical tips for production deployments
- Prefer
installfor deployments that already have a lock file; reserveupdatefor planned dependency changes. - Keep phar outside the public web root when practical.
- Don’t expose credentials in shell history or public files when configuring private package repositories.
- Review package requirements before installing them on a live site.
- Remember that every dependency file adds to the project’s storage and inode usage. Large vendor folders contain many files, so they can contribute to your account’s file count. Remove obsolete dependencies and backups carefully; don’t delete files simply to lower inode usage if the application still needs them.
If you’d like a VeeroTech-specific walkthrough, the existing Composer on shared servers guide covers the account setup. Because server settings can vary, confirm the right CLI PHP path with support when your shell and website use different PHP versions.
Install Composer on hosting that supports your workflow
With SSH access and a compatible PHP CLI, you can manage PHP dependencies on shared hosting without root access. Keep Composer local, verify the PHP environment, and use the project’s lock file for predictable deployments.
VeeroTech shared hosting includes SSH access and PHP features for development workflows. Explore VeeroTech shared hosting or contact the support team if you need help identifying the right PHP CLI command for your account.
Frequently Asked Questions
Can I install Composer on shared hosting without root access?
Yes. Install the Composer PHAR in a directory your hosting account owns, then run it with PHP. Root access is generally only needed to install Composer system-wide in a protected server directory.
Do I need SSH to use Composer?
SSH is the usual way to run Composer directly on shared hosting. If SSH is unavailable, you can install dependencies on a local computer and upload the application, provided the PHP version and extensions are compatible.
Should I run composer install or composer update?
Use install to install the versions recorded in composer.lock. Use update when you intentionally want Composer to resolve newer versions within the constraints in composer.json and update the lock file.
Where should I put composer.phar?
A private directory in your hosting account, such as ~/bin, is a convenient location. Keep it outside the public web root where possible, and run it by its full path.
Why does Composer report a different PHP version from my website?
The website and SSH session may use different PHP executables or configurations. Check php -v in SSH and compare it with your website’s PHP Selector setting. Ask your provider for the correct command-line PHP path if they don’t match.
If you have any web hosting questions please feel free to reach out to us. We're happy to help.