I have a form that is on a secure (HTTPS) page, which posts to another page. In the form action, the protocol is not specified but I would assume uses the same protocol as the page that it came from, please see below:
<form id="dummy_form" action="do_action.php" method="POST">
<input type="hidden" name="some_field" id="some_field">
</form>
The way I have believed this worked is that the relative URL would use the same protocol as the page it is sat on, therefore all traffic is encrypted.
However, I recently had someone contact me saying that the form is insecure and that the information is being transmitted in plaintext. I assume they have just inspected the network traffic using their browsers dev tools (they sent me a screenshot of their data in the network tab of the Google console), but I thought it would be better that I ask the wider community and check?
Better safe than sorry!