No, and that’s deliberate. The tool looks for no hidden addresses or configuration files, and attempts no intrusion. It opens your homepage like a browser, with and without the padlock, and reads what your server volunteers.

Your server attaches them to every page, in invisible lines called headers. They tell the browser which scripts to run, whether your site may appear inside another page, whether to refuse an unencrypted connection. Without them, it uses its permissive defaults.

Checks grouped into categories, scored out of 100. The encrypted connection and its certificate, browser instructions, cookies, what the page loads, what the server says about itself. A check with nothing to examine, a site without cookies for instance, leaves the calculation instead of penalizing you.

No. This check looks at the facade. It says nothing about the strength of your code, your passwords, your backups or your admin access. A site perfectly configured on the surface can have a flaw in a form.

Almost everything is fixed in the server configuration or at your host, often in a few lines. The one exception is the allowed-scripts list (CSP): it means listing what your pages load, and goes up in stages so nothing breaks.