Hi @chengjianping, thanks for your question!
The issue could be as simple as making sure .user.ini has the correct permissions and owner to be written to by your site directly. If not, supposing that your host allows the changes Wordfence requires, we have documentation that covers the process in more detail: https://www.wordfence.com/help/firewall/optimizing-the-firewall/
There are further advanced troubleshooting methods here in case your setup requires them: https://www.wordfence.com/help/firewall/optimizing-the-firewall/troubleshooting/
In most cases, .user.ini or .htaccess will need to contain the auto_prepend_file directive explained in our documentation that points to the wordfence-waf.php file. Some setups will deal with a different file or with php.ini directly.
Let us know how you get on,
Peter.
