Which of the following statements about WAF data risk control feature is NOT true?

this feature can only used for single page, can't be used to protect the whole domain

name

WAF need to inject JavaScript piece into all pages under the same protected domain

name to decide if the client side is worth to trust

direct access URL protected by this feature will have slider verification pop out

this feature is not suitable for scenario needs to call API directly