Cover image for Installing Composer Packages in WordPress Without SSH

jean-smaug

Cross-posted from the Loopress docs
Loopress is a toolset to make WordPress reproducible and reviewable via Git. Versioned snippets, Composer without SSH, and more coming...

Check Loopress

You need to add a PHP dependency to a WordPress site. Maybe a PDF generation library, a CSV parser, an image manipulation package. Something available on Packagist.

Here's what the standard workflow looks like.

The current workflow

If you're on managed hosting (most clients are):

  1. Check if SSH is available (often it isn't, or it requires upgrading the hosting plan)
  2. If SSH is available: connect, check if Composer is installed, install it if not
  3. Navigate to the WordPress root
  4. Initialize composer.json if it doesn't exist
  5. Run composer require vendor/package
  6. Hope the server's PHP version matches your local environment
  7. Hope the vendor/ directory ends up in the right place
  8. Repeat for every site, every environment

This is assuming nothing goes wrong. In practice, you'll hit permission issues, PHP version mismatches, or a host that simply blocks Composer from running.

The workaround people actually use:

Run Composer locally, then upload the vendor/ directory to the server via FTP or rsync. This works but means you're manually syncing binary files, and the next developer who needs to add a dependency starts from scratch figuring out where everything lives.

Neither option is good.

What Loopress does differently

Loopress Full adds a Dependency Management panel to your WordPress admin. It talks to Packagist, runs Composer server-side through a sandboxed process, and handles the install without you needing a terminal or SSH access.

This is Loopress Full specifically, not Loopress Light (the free edition on wordpress.org). wordpress.org's plugin guidelines don't allow a plugin to install executable code from a third-party registry like Packagist, so this feature ships separately, from loopress.dev, rather than the official directory. Here's why, if you're curious.

Download Loopress Full

Installing a package

Here's what that looks like from the admin, in under a minute:

Your browser doesn't support HTML5 video. Download the video instead.

  1. Navigate to WordPress Admin → Loopress → Dependencies.
  2. Search for a package by name (guzzlehttp/guzzle, or whatever you need). Loopress queries Packagist directly and shows you available versions.
  3. Select the version, click Install. Loopress runs composer require on the server and installs the package into a managed vendor/ directory inside the plugin's scope.

Using it in a snippet

Require the autoloader once, then use the package like any other Composer dependency. Here it is fetching and displaying data from an API in a code snippet:

Your browser doesn't support HTML5 video. Download the video instead.

require_once WP_CONTENT_DIR . '/loopress/vendor/autoload.php';

use GuzzleHttp\Client;

add_filter('the_content', function ($content) {
    if (!in_the_loop() || !is_main_query()) {
        return $content;
    }

    $client = new Client();
    $response = $client->get('https://jsonplaceholder.typicode.com/posts', ['query' => ['_limit' => 5]]);
    $posts = json_decode($response->getBody()->getContents(), true);

    $list = '<ul>';
    foreach ($posts as $post) {
        $list .= '<li style="color: red">' . esc_html($post['title']) . '</li>';
    }
    $list .= '</ul>';

    return $content . $list;
});

Enter fullscreen mode Exit fullscreen mode

Why this matters for agencies

If you manage multiple client sites, the usual Composer workflow means either:

  • Maintaining SSH access to every server
  • Teaching clients how to run terminal commands (not happening)
  • Keeping a pile of FTP credentials and manually uploading vendor/ directories

With Loopress, the dependency management surface moves into the WordPress admin. You can install, update, and remove packages from the same interface you use to manage everything else. No server access required.

Seeing what's installed

The Dependencies panel shows:

  • All installed packages with their current versions
  • Available updates from Packagist
  • A one-click update path

This is the equivalent of composer show and composer outdated, surfaced in the UI.

What Loopress doesn't replace

Loopress's dependency management is designed for adding libraries to a running WordPress site, pulling in packages that your snippets or custom code need. It's not a replacement for a full Bedrock/Composer setup where WordPress itself is a Composer dependency.

If you're building on Roots/Bedrock, you already have a proper Composer workflow and probably don't need this. Loopress fills the gap for the other 90% of WordPress sites that aren't running a full stack framework: sites on shared hosting, client sites where the server environment is opaque, or projects where "set up Bedrock" isn't a conversation you can have.

Loopress Full is a free download, installed like any other plugin zip (Plugins → Add New → Upload Plugin), no server configuration required. If you only need snippet sync, Loopress Light is the free edition submitted to the wordpress.org directory instead.