What Is PHP Composer?

PHP Composer is a dependency manager for PHP. It lets a project list the libraries it relies on, such as a framework, a payment provider’s toolkit or a PDF generator, and then downloads, installs and updates them, together with the libraries those depend on in turn. Almost every modern PHP project, including every Laravel application, is built with Composer. On WordPress sites it is less common, because plugins and themes are usually installed from the admin area.

What a dependency is, and why it needs managing

Very little software is written from nothing. An online bike shop might use Laravel for its structure, the payment provider’s official PHP library to take payments, another package to send text messages when an order ships and another to create invoices as PDFs. Each of these is a dependency, and each has dependencies of its own.

Keeping track of all of them by hand would mean downloading files, checking which versions work together and copying them into the right folders on every server. Composer does that job. As the Composer introduction explains, it works per project: packages are installed into a folder inside the project, usually called vendor, and not across the whole server.

How Composer works: composer.json and composer.lock

Every project has a composer.json file that lists what it needs, with the acceptable versions:

{
    "require": {
        "php": "^8.3",
        "laravel/framework": "^13.0"
    }
}

This says the project needs PHP 8.3 or newer within version 8, and Laravel 13 with any later minor or patch release. Adding a package is one command, for example installing Laravel’s AI SDK:

composer require laravel/ai

When Composer resolves the versions, it writes the exact one it chose for every package into a second file, composer.lock. The basic usage guide recommends committing that lock file to the project’s repository, and the reason matters to a business:

• composer install reads the lock file and installs exactly the versions recorded there. This is what runs on the live server, so it gets the same code that was tested.
• composer update looks for the newest versions allowed by composer.json, installs them and rewrites the lock file. This is a deliberate step, done by a developer and tested before release.

Composer also generates an autoloader, a single file the application includes so that every installed package is available in the code without extra setup.

Most packages come from Packagist, the main public repository for Composer packages. Private packages, such as a module shared between a company’s own projects, can be installed from a private repository in the same way.

Why Composer matters for a business website

Predictable releases. With the lock file in the repository, the developer’s machine, the test copy and the live site all run identical versions. A package update cannot slip onto the live site unnoticed between two releases.

Security checks. The composer audit command, described in the Composer command reference, checks the installed packages against published security advisories and also flags abandoned packages. composer outdated lists the packages that have newer versions available. Running both regularly is a simple part of maintaining any PHP site.

Faster development. Using well-maintained packages for common jobs, from payments to image handling, means the budget goes on your own features.

Fewer surprises at handover. A clean composer.json shows another developer exactly what the project depends on. A site where libraries were copied in by hand, with no Composer files, is much harder to update, check for vulnerabilities or move to a new server in a website migration.

Every package added is also code you rely on but did not write. Before adding one, a developer should check that it is maintained, widely used and released under a licence that suits a commercial project.

How we work with Composer

Every Laravel application is installed and updated through Composer, including the ones we build in our Laravel website development work, so package updates and security checks are part of looking after the site after launch. You own the code, content and accounts, and we provide documentation.

FAQ