Drupal and Composer

Drupal 8 recommends using Composer to manage Drupal sites. From initiating projects, installing Drupal core, contributed modules and themes; to updating and managing them, Composer is recommended (but not required).

The latest version 8.8.0 has incorporated native Composer support and thus Drupal will no longer rely on third-party projects to set up Drupal with its dependencies.

As of Drupal 8.8.0, Composer project templates (similar to drupal-composer/drupal-project - this template has now been deprecated in favour of the new template in 8.8.0) are now available as part of Drupal core. These project templates serve as a starting point for creating a Composer-managed Drupal site. Once you have selected a template project and created your own site, you will take ownership of your new project files. Thereafter, future updates will be done with Composer.

The recommended template


The recommended-project template creates a new Drupal site with a "relocated document root". This means that the files "index.php" and the "core" directory and so on are placed inside a subfolder named "web" rather than being placed next to "composer.json" and the "vendor" directory at the project root. This layout is recommended because it allows you to configure your webserver to only provide access to files inside the "web" directory. Keeping the vendor directory outside of the web server's document root is better for security.

By default this recommended template will create your new project with vendor folder in your project root and it will create a "web" folder for Drupal core, the scaffold files like index.php, update.php, ... and other folders of your site.

If you are installing on Cpanel, you already have "public_html" as your web root so using this template to make a default install will generate a "web" folder that is supposed to be your new web root so you will now have to reconfigure your account to use "web" instead of "public_html" as your web root.

Well, lots of our clients use Cpanel so how we use this template is we make a modified install like so:

1. Run composer create-project drupal/recommended-project my_site_name_dir --no-interaction --no-install from the root of your Cpanel account.

Update: Drupal 9 is available now so this by default will initiate a Drupal 9 project, to initiate Drupal 8 instead run composer create-project drupal/recommended-project:^8 my_site_name_dir --no-interaction --no-install

The --no-install flag will stop the installation of Drupal upon project initiation.

The template would generate "composer.json" and "composer.lock" files inside my_site_name_dir (a folder you can call whatever you like).

2. Move the two files (composer.json and composer.lock) to the root of your Cpanel account.

3. Edit composer.json to change the web-root and installer-paths from "web/" to "public_html/" as illustrated below:

Installing Drupal with Composer on Cpanel
Change this...
Installing Drupal with Composer on Cpanel
...to this.

4. Delete the empty directory my_site_name_dir, it is of no use anymore.

5. Run composer install from the root of your Cpanel account to download Drupal and all its dependencies.

That's it! You got Drupal 8 (or Drupal 9) installed on your Cpanel account.

This new template does not install Drush nor Drupal Console automatically like the deprecated drupal-composer/drupal-project, so you should install Drush by yourself. I recommend you install Drush, it will make your Drupal experience better. To install Drush has now become as easy as composer require drush/drush after which you will call it from vendor/bin/drush.


It is not recommended practice to install and update code on live server, it is recommended to do this in your development environment and then push to production. More so Composer requires a lot of memory to do its thing so if you are on a shared host environment, you may not even have enough memory to install and update code with Composer right on live server. This means you will use composer require and composer update locally in your development environment while you use composer install --no-dev to migrate your installed code to your Cpanel account. The --no-dev switch skips the installation of packages not intended for use in production. You can duplicate Cpanel's folder structure in local so moving to live will be seamless.

Managing your site with Composer is optional so you can start and manage your site manually, but your life will be made easier if you can learn to use Composer. Sometimes in Drupal, it can also be inevitable not to use Composer, so if you want to work extensively with Drupal you should learn to use Composer.

Last updated: July 14, 2020