Wordfence initiates an outbound HTTPS request to noc1.wordfence.com to start a scan. The plugin must open a socket on port 443. When the server blocks the request, the socket fails and the scan stops.
Typical reasons include firewall rules that deny outbound traffic, DNS resolution problems, IP blocks on the Wordfence side, or outdated cURL/OpenSSL settings that prevent a secure handshake.