How to block Wordfence Central

# In the server block. 403 rather than 444: a closed connection tells the
# operator nothing, and an agent that gets a status code can log it.
if ($http_user_agent ~* "(Wordfence Central)") {
    return 403;
}

BrowserMatchNoCase "Wordfence Central" bad_bot

<RequireAll>
    Require all granted
    Require not env bad_bot
</RequireAll>

# Security → WAF → Custom rules, action: Block
(http.user_agent contains "Wordfence Central")

// functions.php of a child theme, or a small plugin. Runs before WordPress
// builds the page, so a blocked agent costs one PHP process and no queries.
add_action('init', function () {
    $agent = $_SERVER['HTTP_USER_AGENT'] ?? '';

    foreach (['Wordfence Central'] as $needle) {
        if (stripos($agent, $needle) !== false) {
            status_header(403);
            exit('Blocked: Wordfence Central');
        }
    }
});