I've been googling and not found a clear answer.
I set up a new D8.9 site
Then upgraded to PHP7.3 (to play with D9).
Then realised I needed to add a Module to the D8 site. Redirect on Login.
Composer failed - allow_url_fopen was OFF.
I went to WHM and changed it to ON, and installed the new module.
(I looked at my PHP7.0 set up, and allow_url_fopen was ON, hence no problems previously).
However my googling made it is clear that allow_url_fopen ON is considered a security risk.
QUESTION