As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or not?
The Heartbleed bug involves asking the server to return a block of memory that is larger than the actual information being returned. A vulnerable server will return whatever is in memory beyond the data structure it's returning. So, if you ask a server to return the extra memory and it does, then the server is vulnerable.
You can examine the code diffs for the patch here. There's a lot of duplication in the code but the basic change is to add this:
if (1 + 2 + payload + 16 > s->s3->rrec.length) return 0; /* silently discard */
So you can see how it now fails if you request a buffer larger than the actual size.