U+F0FE is not a checkbox, it’s a Private Use Area character that might render as anything. Whilst you can certainly try to include it in an HTML document, either directly in a UTF-8 document, or as a character reference like , you shouldn’t expect it to render as a checkbox. It certainly doesn’t on any of my browsers—although on some the ‘unknown character’ glyph is a square box that at least looks similar!
So where does U+F0FE come from? It is an unfortunate artifact of Word RTF export where the original document used a symbol font: one with no standard mapping to normal unicode characters; specifically, in this case, Wingdings. If you need to accept Word RTF from documents still authored with symbol fonts, then you will need to map those symbol characters to proper Unicode characters. Unfortunately that’s tricky as it requires you to know the particular symbol font and have a map for it. See this post for background.
The standardised Unicode characters that best represent a checkbox are:
☐, U+2610 Ballot box☑, U+2611 Ballot box with check
If you don’t have a Unicode-safe editor you can naturally spell them as ☐ and ☑.
(There is also U+2612 using an X, ☒.)