[Kupietz]If anyone in the future ever encounters the same problem I did, I whipped up a wordpress plugin (apache 2.4+ only) that adds an .htaccess directive to inject User Agent headers into any incoming webmention that is lacking them, so you can leave WordFence's heavier-duty "block IPs that send POSTs without User Agent or Referrer" protection on, and it still will now let webmentions through.