Detailed answer
GET suits retrieval actions such as search, with values commonly appearing in the URL.
POST suits submissions that change state or send a request body. POST is not encryption, so use HTTPS for transport protection. The receiving application still needs authorization, validation, and appropriate request protections.
Example
<form action="/search" method="get"><label for="q">Search</label><input id="q" name="q"><button>Search</button></form>
Understanding the behavior
GET places submitted values in the URL and suits retrieval operations such as a search. POST sends values in the request body and suits operations that change server state. POST alone does not encrypt data or replace HTTPS and server-side validation.
Practical implementation notes
Try a harmless sample submission and inspect the network request. Avoid placing secrets in query strings, which can appear in history, logs and copied links. Protect state-changing server endpoints against unauthorized requests.
How to check it
Submit a harmless search and inspect the address bar and network request.
Expected result
GET includes named search values in the URL; POST alone does not encrypt anything.
Watch out: Never put private tokens or passwords in GET query strings.
Read the reference ↗