Can i enable WAF (0range cloud in dns record) for my subdomain api.domain.com ? I'd love to have my API protected with cloudflare ddos protection, and WAF and other bot detection. Do i need to have a certain plan to do it? pro? business? Entreprise ?