one check
Before any JavaScript
The handshake happens before the page exists and cannot be changed from inside it. That is what makes this layer the useful one, and why it needs a service that accepts the connection itself rather than a server behind a load balancer.
What this one page cannot tell you
This is measured on a request made from the page, not on a navigation. The TLS parameters agree either way; the header order does not: a request from inside a page sends systematically different headers, and Sec- headers cannot be set from JavaScript at all.
The interesting part is usually not a single value but the disagreement between two. The full check reads all five layers and shows you where they contradict each other.