I was under the impression that enabling/enforcing from the cloudflare side would suffice. Could you elaborate ?