"Waf" is always off in the zone settings api, how to turn it ON?

Hello,

Looking at https://api.cloudflare.com/client/v4/zones/<zone_id>/settings there is a “waf” field that is set to off.

{
  "id": "waf",
  "value": "off",
  "modified_on": null,
  "editable": true
}

I didn´t find a way in the User Interface to set it to ON.
Can anybody point me the path in the User Interface where i can turn it ON ? Should i need to upgrade the License ?

(I´m using the free plan now)

Thanks