Are you sure you use mod_php? See here how to determine.
Just add it to the end of the file. Just be careful to not put it in between any # …. # blocks because this is code added by a plugin or WordPress which can be changed or removed.
And make sure you run apache2 with mod_php before adding this!
I had similar problems running apache2 with mod_php. Using a custom php.ini with the SetEnv PHPRC directive in .htaccess didn’t work.
The wordfence-waf.php file was created (after changing the permissions) so I just added:
php_value auto_prepend_file "/path_to_file/wordfence-waf.php"
in my .htaccess and the firewall is loaded.
Is this solution viable?