Cloudflare doesn't offer a WAF in the free plan, only a DDoS attack mitigation service. This means it doesn't go into the application level (i.e. no SQL Injection protection or XSS). They do, however, offer a filtering capability. You can see more in the Cloudflare page [1], they explain well what it is. None of the features they talk about come in the free version.

[1] https://www.cloudflare.com/learning/ddos/glossary/web-applic...