Preconditions
Composer is installed on the production server.
Installation
As part of my automatic deployment shell script, I run the following SSH command to install the PHP dependencies, using Composer, on the production server:
ssh host 'cd /path/to/site-root && composer install --optimize-autoloader --no-dev --no-progress'
Adjust host to the actual SSH host and the path to the site on the server.
Notice this command also includes --no-dev to make sure we only install the dependencies that are required for the production environment (specified in require and not in require-dev).
This installation approach allows us to version control (include in the project’s Git repository) only the composer.json and composer.lock files while the actual dependencies are not included there (/vendor/ directory is listed in .gitignore).