Thomas O. on "[Plugin: Wordfence Security] User-Agents are not being blocked?"

It would be easier to use regex and mod_rewrite in your .htaccess file:

RewriteCond %{HTTP_USER_AGENT} ^.{0,9}$
RewriteRule ^ - [F]

So if there are only 9 characters or less in the User Agent string they will get a 403 Forbidden. Make sure to check your server logs so that no legit bots like Google are getting blocked.