You can make requests to external servers, but the headers on that server must be configured correctly, and that server must be HTTPS.
To learn more about the header requirements see this page: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
If you're using a service that specializing in providing leaderboards then I'm assuming they'll have a simple way to set it up. Note that our HTML5 games do not go through the itch.io domain, they are in an iframe.