on free accounts, it is usually done manually by turning on a setting. it has helped me several times in the past. though i have seen ddos attacks in recent days which were apparently mitigated by cloudflare automatically and they send me a mail with details on what rules they applied. but they do not seem to offer any feature on free account where i'm under attack
can be configured to automatically enable when the site is under distress due to an attack or something. though i suppose it should be possible using their api?