Please use the “Print” function at the bottom of the page to create a PDF.
PHP Composer is a package manager for PHP. It helps you to integrate external code modules (libraries) into your own projects. Composer automatically ensures that all background programs that require these modules (the dependencies) are downloaded as the correct version.
This guide will show you how to download, install and start Composer for the first time on your IONOS webspace.
Requirement
- A IONOS Web Hosting package with SSH access
If your package does not support SSH access, you can switch to another web hosting contract.
Important notes on the execution of commands
To be able to use Composer with your webspace, you must execute PHP scripts via command line (PHP CLI). Before copying the commands in these instructions, please note these two points:
1. Your active PHP version (IMPORTANT)
The following code examples use X.X. You must replace X.X in all commands containing the expression phpX.X with the PHP version you are using for your specific web project (e.g. php8.3 or php8.4).
Please Note
If you use the wrong version here, Composer may download incompatible code blocks, which in the worst case could lead to failures on your website.
2. Your contract date
The exact structure of the command also depends on when you ordered your web hosting contract. All commands in these instructions are therefore given in two variants:
- Contracts up to September 14, 2025: You need the addition -cli (example for PHP 8.4: php8.4-cli).
- Contracts from September 15, 2025: The -cli addition is omitted (example for PHP 8.4: php8.4).
Note
Do not use the simple php command without a version number, otherwise the script will be executed with an outdated PHP version. A complete list of all available PHP versions can be found in the article PHP-CLI: Executing PHP files from the command line.
Step-by-step instructions
Step 1: Establish SSH connection
Start your SSH client and connect to your web space. You can find instructions for various operating systems in the SSH Setup and Administration category in the Help Centre.
Tip
As soon as the connection is established, you will see the input window of your terminal. To avoid typing errors, it is best to copy the commands from the following code boxes and paste them into your terminal. Then press the Enter key after each command to execute it.
Step 2: Prepare the installation directory
The directory in which Composer is installed depends on your contract.
Contracts up to September 14, 2025:
For older contracts, your home directory (~) is also the htdocs directory. This serves as the document root, i.e. the main directory of your website. This means that files in this directory can in principle be accessed by anyone via the Internet.
For security reasons, you should therefore create a separate subdirectory for Composer and protect it from external access using an .htaccess file. The following commands create the folder and blocks public access.
Create a new directory called composer:
mkdir ~/composer
Create and write to an .htaccess file inside the new composer directory:
echo "Require all denied" > ~/composer/.htaccess
Change into the newly created directory:
cd ~/composer
Please Note
Without the .htaccess file, composer.phar would potentially be accessible via the browser. Make sure that the .htaccess file is present in the directory.
Contracts from September 15, 2025:
For newer contracts, the home directory is not publicly accessible. Change to your home directory:
cd ~
Step 3: Download the Composer installation file
Download the installation file from the official Composer website.
Contracts up to September 14, 2025:
phpX.X-cli -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
Contracts from September 15, 2025:
phpX.X -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
Step 4: Compare the checksum (security check)
Compare the checksum (also known as the "digital fingerprint") of the downloaded file. This ensures that the file has not been damaged or manipulated during transfer and that it is the original file. As the checksum changes with every update, we automatically retrieve the current hash from the Composer infrastructure.
Execute the two commands, one after the other:
Contracts up to September 14, 2025:
Fetch the official checksum for the Composer installer and store it in a variable:
EXPECTED_CHECKSUM="$(phpX.X-cli -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
Check whether the downloaded composer-setup.php file is authentic and hasn't been tampered with:
phpX.X-cli -r "if (hash_file('sha384', 'composer-setup.php') === '$EXPECTED_CHECKSUM') { echo 'Installer Verified'; } else { echo 'Installer Corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
Contracts from September 15, 2025:
Fetch the official checksum for the Composer installer and store it in a variable:
EXPECTED_CHECKSUM="$(phpX.X -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
Check whether the downloaded composer-setup.php file is authentic and hasn't been tampered with:
phpX.X -r "if (hash_file('sha384', 'composer-setup.php') === '$EXPECTED_CHECKSUM') { echo 'Installer Verified'; } else { echo 'Installer Corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
Note
If “Installer Verified” is displayed in the terminal, the file is safe and you can proceed with the installation. If it says “Installer Corrupt”, the file was automatically deleted because it was faulty or compromised. In that case, download the file again.
Step 5: Install Composer
Execute the installation file.
Contracts up to September 14, 2025:
phpX.X-cli composer-setup.php
Contracts from September 15, 2025:
phpX.X composer-setup.php
After installation, the composer.phar file is located in the directory you changed to in step 2. The extension .phar stands for PHP Archive - you can think of it as an executable program file for PHP.
Step 6: Remove the installation file (clean up)
The composer-setup.php file is now no longer required. To keep your web space clean, you should delete it.
Contracts up to September 14, 2025:
phpX.X-cli -r "unlink('composer-setup.php');"
Contracts from September 15, 2025:
phpX.X -r "unlink('composer-setup.php');"
Step 7: Check the installation
Test the installation by running Composer directly. Make sure that you are in the directory where composer.phar is located (see step 2).
Contracts up to September 14, 2025:
phpX.X-cli composer.phar
Contracts from September 15, 2025:
phpX.X composer.phar
As a result, an overview of all available Composer commands is displayed.
Step 8: Set up alias (short command) (optional)
To avoid always having to call Composer with the full, long file path, you can create an alias. This is a user-defined shortcut for the command line.
Use the following command to enter the abbreviation composer permanently in your personal configuration file (.bash_profile):
Contracts up to September 14, 2025:
echo "alias composer='phpX.X-cli ~/composer/composer.phar'" >> ~/.bash_profile
Contracts from September 15, 2025:
echo "alias composer='phpX.X ~/composer.phar'" >> ~/.bash_profile
This alias will automatically take effect at your next SSH login. To activate it immediately in the current window, reload the configuration with this command:
source ~/.bash_profile
The composer command is then sufficient to start Composer from any directory.
Check results
The installation was successful if, after running Composer, a list of available commands and the installed Composer version are displayed.
To keep Composer up to date, use the self-update command. If you have set up the alias from step 8, you can use composer self-update. Otherwise, execute the command directly in the installation directory:
Contracts up to September 14, 2025:
phpX.X-cli composer.phar self-update
Contracts from September 15, 2025:
phpX.X composer.phar self-update
Troubleshooting
The terminal displays the error message “Command not found”
You have probably copied the command verbatim including the placeholder (e.g. phpX.X-cli). Please replace the X.X in the command with the actual PHP version of your web project (e.g. php8.2-cli or php8.4-cli) and execute the command again.The command "composer" is not found
The short command composer is only available if you have set up the alias from step 8. Use the command cat ~/.bash_profile to check whether the alias is entered correctly. Then log in again via SSH or execute source ~/.bash_profile so that the changes are loaded. Without an alias, call Composer directly via the PHP CLI command and composer.phar (see step 8).The checksum does not match ("Installer Corrupt")
The downloaded file was corrupt or compromised and was automatically deleted. Please simply carry out step 3 (download) and step 4 (check) again.PHP error messages when running Composer
Make sure that you have not accidentally used the wrong PHP version in the command. You must specify the exact PHP version that your web project uses (see section "Important notes on executing commands"). Also check that you are using the correct PHP CLI command for your contract date (-cli for older contracts).