Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The reliable way to install Composer on a Linux VPS is to install a compatible PHP CLI runtime, download the installer from getcomposer.org, verify its SHA-384 signature, run it, and put the resulting executable in a directory on your PATH. A system-wide installation normally uses /usr/local/bin/composer; a rootless installation can use ~/.local/bin/composer.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
After installation, confirm it with composer --version. In a directory containing your application’s composer.json, run composer install. If composer.lock is present, Composer installs the exact versions recorded there, which is the behavior you want on deployment servers.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What Composer is and what a VPS needs
Composer is PHP’s command-line dependency manager. It is distributed as a PHAR archive, a PHP executable archive, so the VPS needs a working PHP command-line interpreter rather than only a web-server PHP module. Composer reads a project’s composer.json, resolves packages and their dependencies, and installs them into a vendor directory.
The current Composer documentation states that the latest Composer release requires PHP 7.2.5 or newer. Composer 2.2 LTS is the legacy branch for environments that must support PHP 5.3.2 or later. The official download page listed Composer 2.10.3 when this guide was prepared in 2026, but release numbers and installer checksums change, so use the live Composer download page rather than hard-coding a version in a permanent script.
#1 Best Overall
| Requirement or tool | Why it matters | What to check |
|---|---|---|
| PHP CLI | Runs the Composer PHAR and the installer. | php -v must report PHP 7.2.5 or newer for the current branch. |
| unzip or 7z | Lets Composer extract many package archives efficiently. | Install one with your distribution package manager if absent. |
| Git | Allows Composer to fetch packages whose source is hosted in Git repositories. | git --version |
| Other archive/VCS helpers | Some dependencies may need gzip, tar, unrar, xz, Mercurial, Fossil, Perforce or Subversion. | Install only what your project’s dependencies require. |
| SSH access and sudo (optional) | SSH is needed to administer the VPS; sudo is needed for a system-wide install. | Use a non-root account with sudo where possible. |
Package names and repository versions differ between distributions and releases. The commands below explicitly identify Ubuntu/Debian examples; they are not universal commands for every Linux VPS.
Choose where Composer should be installed
Composer can be available only to one user or to every user on the VPS. Decide this before running the installer because the destination controls permissions, upgrades and which shell sessions can find the command.
| Placement | Best for | Advantages | Trade-offs |
|---|---|---|---|
| Project directory | A one-off build or an isolated project | No system changes; easy to keep separate versions. | You must call it by a path, and other projects cannot use it automatically. |
~/.local/bin/composer |
A developer or deploy user without root privileges | Owned by that user; upgrades do not require sudo. | Every login shell must include ~/.local/bin in PATH. |
/usr/local/bin/composer |
A shared VPS used by several administrators or deploy jobs | One command works for all users whose PATH includes /usr/local/bin. |
Writing and upgrading the file requires administrative privileges. |
For the Composer release line, use the latest branch when the VPS runs a supported PHP version. Choose Composer 2.2 LTS only when an application or an unavoidable legacy PHP runtime requires its older compatibility range; do not downgrade a modern server without a compatibility reason.
Connect over SSH and prepare PHP
1. Log in and inspect the CLI runtime
- Connect to the VPS with SSH using your normal administrative or deployment account.
- Run
php -v. This checks the CLI binary that Composer will actually use; a PHP version shown by a web control panel does not guarantee that the shell uses the same binary. - Check the executable location with
command -v phpif several PHP versions are installed.
If php -v reports “command not found,” install the CLI package through the VPS distribution’s package manager. On Ubuntu or Debian, a typical example is:
sudo apt update
sudo apt install php-cli unzip git curlThe package may be versioned or split differently on your release. Confirm the result with php -v, unzip -v and git --version. On another distribution, use its documented package manager and package names; do not paste the Ubuntu command unchanged into a Red Hat, Alpine or Arch system.
2. Check for project-specific PHP constraints
Composer itself has a PHP minimum, but your application can require a newer version or additional PHP extensions. Inspect the project’s composer.json before deployment and make sure the CLI PHP version satisfies its require section. Installing Composer successfully does not make an incompatible application run.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Download and verify the official installer
Run the installer from a temporary working directory, such as your home directory or a dedicated temporary folder. The following is the official four-stage pattern: download, obtain the current SHA-384 signature, compare it, then execute and remove the installer.
Rank #2
- Change to a writable temporary directory, for example
cd /tmpor a private directory under your home directory. - Download the installer:
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"- Fetch the current expected signature and compare it with the downloaded file:
EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
php -r "if (hash_file('sha384', 'composer-setup.php') === '$EXPECTED_CHECKSUM') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); exit(1); }"The comparison must print Installer verified. If it prints Installer corrupt, the script deletes the installer and exits with a failure status. Do not run a file that fails this check. Investigate a truncated download, a proxy or an interrupted connection, then download a fresh copy and compare it with the signature endpoint again.
- Run the verified installer:
php composer-setup.phpBy default, this creates composer.phar in the current directory. The installer checks several PHP settings and reports problems before downloading the PHAR. Remove the installer when finished:
php -r "unlink('composer-setup.php');"The signature is intentionally fetched at install time. Composer’s programmatic-install guidance notes that the checksum changes whenever installer code changes, so a long-lived automation script should retrieve https://composer.github.io/installer.sig each time instead of embedding a stale value.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install Composer globally or without root
System-wide installation in /usr/local/bin
After the default installer command, move the PHAR to a directory normally included in every user’s executable path:
sudo mv composer.phar /usr/local/bin/composer
sudo chmod 0755 /usr/local/bin/composer/usr/local/bin is intended for locally administered programs and avoids overwriting a distribution-managed binary in /usr/bin. The file is named composer so the shell can invoke it without the .phar suffix.
You can also choose the destination during installation. Create a controlled directory and install the generated file with explicit permissions:
mkdir -p /tmp/composer-bin
php composer-setup.php --install-dir=/tmp/composer-bin --filename=composer
sudo install -m 0755 /tmp/composer-bin/composer /usr/local/bin/composerWhen you have decided to write directly to the system directory, the installer can be run with administrative privileges:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorssudo php composer-setup.php --install-dir=/usr/local/bin --filename=composerUse one approach, not all three. The temporary-directory method makes it easier to inspect the resulting file before placing it on the shared PATH.
Rootless installation in ~/.local/bin
If you do not have sudo or do not want a shared executable, install Composer into a directory owned by the current user:
mkdir -p "$HOME/.local/bin"
php composer-setup.php --install-dir="$HOME/.local/bin" --filename=composer
chmod 0755 "$HOME/.local/bin/composer"Make sure the directory is on your PATH for future sessions. For shells that read ~/.profile, add:
echo 'export PATH="$HOME/.local/bin:$PATH"' >> "$HOME/.profile"
. "$HOME/.profile"If your account uses a different shell startup file, place the same export in the file that shell reads for login sessions. A command that works in the current SSH window but disappears after reconnecting is usually a PATH configuration issue, not a failed Composer installation.
Verify the installation
Start with the version command:
composer --versionIt should print Composer’s version and the PHP runtime it is using. Confirm which executable the shell selected:
command -v composer
ls -l "$(command -v composer)"For environment diagnosis, Composer provides an installer check that does not install a second copy:
curl -sS https://getcomposer.org/installer | php -- --checkRun this as the same user and from the same kind of shell used by your deployment process. If composer --version works interactively but a scheduled job cannot find it, use the absolute path (for example /usr/local/bin/composer) or set PATH explicitly in the job.
Run Composer in a PHP project
1. Change to the directory containing composer.json
cd /path/to/your/project
ls composer.jsonThe file must be in the current directory or Composer will not know which application definition to process.
2. Install the declared dependencies
composer installComposer creates or updates the project’s vendor directory and generates its autoloader. On a server, run the command as the account that owns the application files so that the resulting files have usable ownership and permissions.
3. Understand the lock-file behavior
If composer.lock exists, composer install uses the exact package versions recorded in that file instead of resolving new versions. This is what makes repeated deployments reproducible. Commit the lock file with the application and copy it to the server with composer.json.
If no lock file exists, Composer resolves the dependency constraints and creates one. That resolution is appropriate when establishing or deliberately updating a project, but it can introduce newer packages than a previous deployment. Do not delete or casually regenerate composer.lock on a deployment server; update dependencies in a controlled development workflow, review the resulting changes, and deploy the committed lock file.
Deployment practices for a VPS
- Install Composer once for the deployment user or in
/usr/local/bin; do not download an unverified PHAR inside every release script. - Keep
composer.jsonandcomposer.locktogether in version control. - Run
composer installfrom the release directory so the generatedvendortree belongs to the release being activated. - Use the same PHP CLI binary in deployment that the application and its extensions require; check it with
command -v phpandphp -v. - Ensure the deployment account can read package credentials and write the project’s release directory, while avoiding unnecessary root execution.
- When a dependency requires Git or a particular archive utility, install that helper through the operating system rather than assuming Composer can provide it.
A global Composer executable does not make package dependencies global. Every application still has its own composer.json, lock file and vendor directory.
Troubleshoot common installation failures
“php: command not found”
The PHP CLI package is missing or not on PATH. Install the distribution’s CLI package, open a new shell if the package changed profile files, and rerun php -v. If multiple versions exist, correct the shell’s PATH or call the intended PHP binary explicitly.
PHP version is too old
The current Composer branch requires PHP 7.2.5 or newer. Upgrade the CLI runtime, or use Composer 2.2 LTS only when the application must remain on a legacy PHP version supported by that branch. Also check the application’s own PHP constraint; satisfying Composer’s minimum alone may not satisfy the project.
Checksum verification fails
Do not bypass the SHA-384 comparison. Delete any partial file, fetch a new installer and fetch a new value from the official signature endpoint. A changing signature is expected when the installer is updated; a mismatch means the bytes you downloaded are not the bytes currently signed.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute“Permission denied” while moving or installing
Writing to /usr/local/bin requires administrative permission. Either use sudo for the move or install into ~/.local/bin. Do not make the entire directory world-writable. Check the destination with ls -ld /usr/local/bin "$HOME/.local/bin".
“composer: command not found” after installation
Check the file exists and is executable:
ls -l /usr/local/bin/composer
ls -l "$HOME/.local/bin/composer"Then inspect echo "$PATH". Add the correct directory to the shell startup file and start a new session. If the shell cached an earlier lookup, run hash -r in shells that support it.
Composer cannot extract or fetch a package
Install the helper named in the error, commonly unzip or git, and verify outbound network and DNS access from the VPS. Some projects use other VCS clients or archive tools; install only those their dependency graph needs.
The application behaves differently after deployment
Check whether the server received composer.lock. Running composer install without the lock file resolves dependencies afresh and can produce a different vendor tree. Compare the PHP CLI version, enabled extensions, file ownership and the lock file between the working environment and the VPS.
Recommended Free Tools
Keeping Composer secure and maintainable
Use the official installer URL and verify its SHA-384 signature every time you download it. Remove composer-setup.php after use. In automation, retrieve the current signature from https://composer.github.io/installer.sig, compare it to hash_file('sha384', ...), and fail closed if they differ. A script that stores one checksum forever will eventually reject a legitimate installer update or, worse, encourage someone to disable verification.
Keep the Composer executable writable only by the account that administers it. For a shared installation, upgrades should be deliberate: download and verify the new installer, replace the executable atomically where practical, then rerun composer --version. For a rootless installation, the user-owned location avoids sudo but still needs normal file permissions and a controlled update process.
The essential workflow is therefore: verify the PHP CLI prerequisite, verify the installer, install Composer in an intentional scope, confirm the command, and deploy dependencies with the project’s committed lock file.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
