Can a zero knowledge proof be faked through http?
Yes, you are missing something. :)

The trick is that the prover commits to the number in each square individually.

The verifier doesn't always get a row, column or block. The verifier choses to see one of those or the permutation of the original puzzle.

If the verifier choses the permutation he can check if the revealed number are indeed a permutation of the original puzzle, if he choses a row or column he checks if all the numbers from one to nine are in it.

Since the prover does not know what is requested he has to commit to a valid filled Sudoku field to make sure that the numbers in each row, column and block are the numbers from one to nine. Since the permutation could be selected it must also be a solution to the initial problem.

Note that you have to repeat this process many times to get security because the prover could guess what the verifier will ask for. In every iteration a new puzzle must be chosen and the verifier must select which part to query independently at random.