Does it send a HEAD request or a GET?
A GET, with the body read and thrown away. HEAD is unreliable for this: many servers answer 405, and others omit Content-Length and Content-Encoding on HEAD, which would misreport the payload headers
Why does it not flag every missing header as a problem?
Because absence is not always a fault. A plain GET has no reason to carry preflight CORS headers, and a response that no cross-origin site should read is correct to send no Access-Control-Allow-Origin at all. Only headers whose absence is itself the problem are marked missing
Are the grades a security score?
No. They count issues in each area, one letter worse per issue, and stop at D. They are a way to see where to look first, not an assessment of how secure a service is
Can it check a URL behind authentication?
Not here — the request is sent with no credentials. Sending a request with headers and auth you control is what the REST API Client is for
Can it check a localhost or internal URL?
No. The request is sent by Postman rather than by your browser, so it can only reach publicly resolvable hosts