October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk12 min

How to Deploy a Composer-Based WordPress Site

A practical guide to deploying Composer-managed WordPress: commit the lock file, install dependencies on every release, serve the web directory, protect secrets and uploads, and handle managed-host path differences.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Deploy a Composer-based WordPress site by committing composer.json and composer.lock, installing dependencies with composer install --no-dev --optimize-autoloader on every release, keeping .env and uploads outside version control, and pointing the web server at the project’s web/ directory. This layout is used by Roots Bedrock and similar Composer-managed projects; the exact host setup determines whether you can use it directly or need a path-mapping workaround.

What a Composer-based WordPress deployment contains

A conventional WordPress installation puts core, plugins, themes and configuration in one web-accessible directory. A Composer-based project separates those concerns. Composer records PHP packages in composer.json, locks exact versions in composer.lock, and installs them into vendor/. In a Bedrock-style project, WordPress core is installed below web/wp/, while application content is under web/app/. The web server exposes only web/, not the repository root.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The arrangement matters for security and repeatability. Files such as composer.json and the lock file describe the release and belong in Git. Generated dependencies, uploaded media and credentials do not. A deployment creates those generated or environment-specific items on the server, then activates the release.

Path or file Commit to Git? Purpose in production
composer.json Yes Declares WordPress, plugins, themes and PHP packages.
composer.lock Yes Locks the versions that each release must install.
vendor/ No Composer’s generated dependency tree, rebuilt during deployment.
web/wp/ No Composer-installed WordPress core.
web/app/uploads/ No Media uploaded by editors; keep it in persistent shared storage.
.env No Server-specific database credentials, salts and environment settings.
web/ Web root The only project directory that should be publicly served.

For the project model and installation assumptions, see the Bedrock project page and its installation documentation.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Check requirements before choosing a host

Current Bedrock documentation lists PHP 8.3 or newer and Composer as requirements. Older tutorials mention lower PHP versions, but those figures are stale for a current setup; verify the version requirement in the current project README before creating a server. You also need a database supported by the WordPress version in your lock file and a way to run deployment commands through SSH, CI, or the host’s release tooling.

  • PHP: Confirm that the production runtime meets the current Bedrock requirement (8.3+ at the time of writing) and that the command-line PHP used by Composer is the same major version as the web runtime.
  • Composer: The server or build runner must have Composer available. A host that offers only a file manager and does not allow Composer or an equivalent build step cannot perform a normal Bedrock deployment.
  • Document-root control: You need to set the virtual host’s root to web/. Shared hosting that forces the project root as the public directory requires a documented rewrite workaround and deserves extra security testing.
  • Persistent storage: Database credentials, the environment file and uploads must survive a release switch. Plan shared locations before automating deployments.
  • Private packages: Commercial plugins or themes may require authenticated private Composer repositories or a package-management service. Obtain those credentials without committing them to the repository.

Do not infer host compatibility from the word “WordPress” in a hosting plan. Ask specifically whether PHP 8.3, Composer execution, a custom document root and persistent shared directories are supported.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Prepare the repository for a reproducible release

Commit the manifests and lock file

Run Composer locally while developing, review the dependency changes, and commit both composer.json and composer.lock. The lock file is what lets a deployment reproduce the tested dependency set rather than resolving newer versions unexpectedly.

Ignore generated and secret data

Your ignore rules should exclude at least vendor/, web/wp/, uploads and .env. Keep the rule for uploads aligned with the actual path used by your project; some projects place the persistent media directory elsewhere. If a secret has ever been committed, removing it from the latest commit is not enough: rotate it and purge it from repository history.

Make the application environment explicit

Bedrock-style projects read settings from environment variables. Keep the production .env outside the release checkout, with permissions that prevent other users from reading it. Values normally include the database connection, site URL, authentication salts and environment mode. Never substitute a production file into Git during deployment.

Build front-end assets when required

If the active theme contains a JavaScript or CSS build, run its documented build command before activating the release. A common project-specific command is npm run build from the theme directory, but use the scripts declared by that theme rather than assuming this exact command. Install Node dependencies in the build environment, not in the public web directory, and ensure the generated assets are either committed intentionally or produced as part of the release.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Choose a deployment layout

Release directories with a current symlink

A release layout makes rollback and atomic activation straightforward. A typical server tree is:

/srv/site/
  releases/
    2026-10-14-1200/
    2026-10-15-0900/
  shared/
    .env
    uploads/
  current -> releases/2026-10-15-0900/

Each deployment checks out the repository into a new directory, installs dependencies there, links shared/.env into the release, links the persistent uploads directory to the path expected by WordPress, runs checks, and changes current to the new release. The web server’s document root is /srv/site/current/web. Keep at least one known-good release until the new one has passed smoke tests.

The DeployHQ Bedrock guide describes this style of deployment. You can implement the same sequence with a CI runner and SSH commands or with another release tool; the important properties are an immutable release directory, shared secrets and an atomic symlink switch.

In-place deployment

A small site can update a fixed checkout in place, but it has a larger failure window: visitors may request files while Composer is replacing them, and a failed build can leave a mixed release. If you use this approach, put the site in maintenance mode when appropriate, run the complete install and asset build before touching the active code, and keep a backup that can be restored.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Deploy step by step

  1. Provision the runtime. Create the database and a system user, install the required PHP version and Composer, and configure the virtual host to serve the future current/web directory. Do not point the host at the repository root.
  2. Prepare persistent directories. Create a shared directory for the production .env and another for uploads. Set ownership and permissions so the deployment user can update releases while the web process can read application files and write only where WordPress requires it.
  3. Fetch a specific revision. Clone or export the approved Git commit into a new release directory. A deployment should identify the commit or tag it installed so you can correlate the running site with source control.
  4. Install PHP dependencies. From the release root, run composer install --no-dev --optimize-autoloader. Use install, not update, so Composer honors the committed lock file. This command must run for every deploy because vendor/ is intentionally not committed.
  5. Link environment and uploads. Create a symlink from the shared .env to the release root. Link the persistent uploads directory to the location expected under web/app/. Verify the links resolve to the intended release-independent paths.
  6. Build theme assets. If the theme has a build process, install its Node dependencies in the build environment and run the theme’s production build script. Confirm that the resulting CSS and JavaScript files exist in the release.
  7. Check configuration. Confirm the database host, name and user; site URL; salts; environment mode; and any private package credentials. Validate that no secret is inside the release directory or visible through the web root.
  8. Run application checks. Test the CLI PHP version, Composer autoloading, database connectivity and the homepage before activation. Check that a representative admin request, a static asset and an existing uploaded image work.
  9. Activate atomically. Change the current symlink to the prepared release, then reload the web server only if its configuration changed. Avoid copying a release over the directory currently serving traffic.
  10. Smoke-test and retain rollback. Check front-end pages, login, forms, scheduled tasks and media. If the release fails, point current back to the previous directory and investigate without deleting that known-good copy.

Roots’ server guidance emphasizes the same fundamentals: install dependencies during deployment and serve the web directory. See Server Configuration for Bedrock.

Configure Nginx or Apache correctly

Nginx

Set the virtual host’s root to the active release’s web directory, for example /srv/site/current/web. Pass PHP requests to the configured PHP-FPM socket and use the WordPress front-controller fallback so non-file URLs reach index.php. Deny direct access to sensitive dot files and project metadata. Upload directories should serve media files but must not execute uploaded PHP; apply a location rule that disables PHP handling there.

Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Apache

Set DocumentRoot to /srv/site/current/web, enable the rewrite module required by the project’s rules, and ensure the virtual host permits the .htaccess directives used by the application. As with Nginx, prevent PHP execution in uploads and deny access to .env, composer.json, composer.lock and other non-public files.

Hosts without document-root control

Some shared hosts expose the project root as the only public directory. The Bedrock server documentation describes an .htaccess-based workaround that forwards requests to web/. Treat this as a compromise: test that the repository root, vendor/, .env and release tooling cannot be downloaded. If the host cannot provide a safe configuration, move the deployment to a host that supports a real web/ document root.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Managed hosting and path-mapping exceptions

Managed WordPress platforms may impose a directory structure that differs from Bedrock’s. For example, WP Engine’s guide for Composer-based sites requires mapping Bedrock’s web/app/ directory to the platform’s wp-content/ location rather than uploading the tree unchanged. Follow the platform’s current deployment instructions and verify which directory it treats as the public root: Deploying a Composer-Based WordPress Site (Including Bedrock) to WP Engine.

This mapping is not a reason to commit vendor/ or WordPress core. It is a host-specific translation layer. Document the mapping in your deployment script, test plugin and theme discovery after each platform change, and keep a rollback copy in the platform’s supported way.

Production behavior and update policy

Bedrock’s production defaults are designed to prevent administrators from editing core and plugin files from the WordPress dashboard. Treat Git and Composer as the change path: update dependencies in development, test them, commit the changed manifests and lock file, then deploy a new release. Do not enable dashboard file modifications merely to work around a failed deployment.

Run database migrations, cache warmups or search-index tasks only after the new code is available and make them repeatable. If a task is not safe to run twice, include an explicit lock or migration check. Keep scheduled jobs pointed at the active release or invoke them through a stable wrapper rather than embedding a timestamped release path.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Composer authentication and private plugins

Public packages can be installed from their declared repositories. Premium plugins often require a private Composer repository or a service such as SatisPress; the exact method depends on the vendor and license. Store tokens in the CI secret store or a server-side Composer authentication file with restricted permissions. Never put credentials in composer.json, shell history, deployment logs or a committed .env.

Before production, perform a clean install using only the credentials available to the deployment account. This catches the common mistake of a developer’s local Composer cache masking a missing repository token.

Common failures and recovery

“Composer command not found”

Install Composer for the deployment user or run the install in CI and transfer the resulting release artifact. Confirm that the command-line PATH and PHP binary used by the deployment are the intended ones; a control panel’s PHP version and SSH’s default PHP version may differ.

PHP version or platform requirement errors

Read the package error and compare it with both the web and CLI PHP versions. Upgrade the runtime to the current Bedrock requirement or adjust dependencies in development and commit a new lock file. Do not bypass platform checks on production without understanding which package would be incompatible.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Missing plugins, themes or core after deployment

Check that composer install ran from the directory containing composer.lock, that the release’s vendor/autoload.php exists, and that the web server points to current/web. A checkout of the wrong subdirectory or a stale symlink commonly produces an apparently empty WordPress installation.

“Error establishing a database connection”

Inspect the active release’s linked .env, not a local file. Verify database host, port, name, user and password, then test connectivity from the server. Ensure the web process can read the file while it remains outside the public directory.

Uploads return 404 or disappear after a release

Uploads must be shared, not stored inside a timestamped release. Recreate the upload symlink at the path configured by the application, check permissions, and confirm that the web server’s static-file root includes that path.

PHP downloads instead of executing

The virtual host is probably not connected to PHP-FPM or the Apache PHP handler, or the request is reaching the wrong document root. Correct the server’s PHP handler, then test a harmless PHP request and remove any diagnostic file immediately.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Uploaded PHP executes

Disable PHP handling in every uploads location and inspect the server configuration for a broader handler that overrides it. Treat unexpected executable files in uploads as a security incident and review access logs.

Theme looks unstyled

Confirm that the production asset build ran in the theme directory, that generated files are present in the active release, and that the site URL and cache layers are not serving stale asset paths. A successful Composer install does not run a JavaScript build automatically.

Dashboard updates are unavailable

That is expected in a production Bedrock workflow. Make the change in development, update Composer manifests and the lock file, test, and deploy. If a plugin requires a license key, configure it through the plugin’s supported environment or database setting rather than enabling arbitrary file edits.

Deployment checklist

  • Current PHP requirement verified on both CLI and web runtime.
  • Composer available to the build or deployment account.
  • composer.json and composer.lock committed at the approved revision.
  • vendor/, web/wp/, uploads and .env excluded from Git.
  • Private repository credentials supplied through a secret store.
  • composer install --no-dev --optimize-autoloader completed for this release.
  • Theme production assets built when the project requires them.
  • Shared .env and uploads linked into the release.
  • Nginx root or Apache DocumentRoot points to web/.
  • Dot files, Composer metadata and uploads are protected from inappropriate access or execution.
  • Homepage, login, database access, assets, forms, scheduled tasks and media tested after activation.
  • Previous release retained and rollback procedure verified.

How to evaluate a hosting option

Question Why it determines deployment success Evidence to request
Can it run Composer? Dependencies must be installed on every release or built reproducibly elsewhere. SSH/CI instructions and the supported Composer/PHP versions.
Can the document root be set to web/? Serving the repository root can expose secrets and generated files. Virtual-host or control-panel documentation showing a custom root.
Can uploads and environment files persist separately? Release directories are disposable; media and secrets are not. Supported shared storage, symlinks or persistent volumes.
Does the platform require path restructuring? Managed layouts may not match Bedrock’s web/app/ paths. An official Composer/Bedrock deployment guide for that platform.
What deployment mechanism is available? Atomic releases and rollback are safer than copying over live code. Documented Git, CI, release-tool or manual deployment workflow.

A host that fails the first two questions can still run a different WordPress architecture, but it is a poor fit for a Composer-based Bedrock deployment. Choose compatibility before migrating content or DNS.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Final deployment decision

The dependable pattern is simple: source control describes the release, Composer recreates dependencies, the server supplies secrets and persistent uploads, and the web server exposes only web/. Use a new release directory and a current symlink when you need low-downtime activation and rollback. Where a managed host requires a different path layout, apply its documented mapping rather than weakening the repository’s separation of code, dependencies and public files.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.