(I made an account to post this, so hope it helps)
After digging with debugger for a few hours. I found the issue in a new part of WP.
In: wp-includes/class-reuqests.php
Lines: 593-597
if ($options['idn'] !== false) {
$iri = new Requests_IRI($url);
$iri->host = Requests_IDNAEncoder::encode($iri->ihost);
$url = $iri->uri;
}
In class Request_IRI, $this->uri seems to be never set.
Dirty fix:
if ($options['idn'] !== false) {
$iri = new Requests_IRI($url);
$iri->host = Requests_IDNAEncoder::encode($iri->ihost);
// $url = $iri->uri;
}
And wordfence works.
So it’s either not a wordfence bug. Or somehow the idn option needs to be false for the 4.6.x version.
Either way, i’ll look into it better later and make a bug report.