By default WAF enabled in Cloudflare or not ? If enabled how to check in portal?
In case WAF is separate service how do we enable? Is there any cost involvement here?
3 How to confirm whether a server is actually protected by Cloudflare WAF?
Cloudflare’s WAF is generally available on the paid plans. Free has some rules for specific vulnerabilities enabled, but these cannot be controlled or customized.
If you are on a paid plan, you can see if the WAF is enabled as @saul described