Wordfence contacts its cloud servers through the WordPress HTTP API. The request travels via cURL. If cURL cannot verify the remote certificate, the request stops.
The verification step compares the certificate chain to a trusted root store. When the server lacks a current CA bundle or the bundle path is wrong, cURL returns error 60. An old cURL build or missing OpenSSL support also triggers the failure.
A self‑signed site certificate or an incomplete chain from a reverse proxy produces the same result. The same error appears when a firewall blocks outbound HTTPS traffic, forcing cURL to abort the handshake.
WordPress Site Health shows the problem in its cURL diagnostics. Wordfence displays a red warning, stops scans, and does not send email alerts because the API call never completes.