is this plugin works with free Clodflare account?

According to Cloudflare support they will pass through the CSP headers https://support.cloudflare.com/hc/en-us/articles/216537517-What-is-Content-Security-Policy-CSP-and-how-can-I-use-it-with-Cloudflare-

If the headers are not there then try running https://securityheaders.io against your site directly (bypassing Cloudflare) and see if they’re there. It might be the page cached by Cloudflare is before CSP was turned on – can you clear caches in Cloudflare?

As I was replying I saw your tags mentioning HSTS. CSP is only one header the plugin will now send and doesn’t affect HSTS. There are other headers the plugin will send – if you meant one of the other headers let me know or look up the header on Cloudflare support.