Insight - whitelisting

Doubt PCI does talk about URLs or "sites". Much more likely IP addresses IP ranges, or IP subnets.

schumaku- valid point, but it's still something that is required for PCI compliancy.  I can't get this solution approved w/o it.  Not making the rules, but clients need to play by them.

Whitelisting is a hopeless experiment - say you want to allow YouTube for example, whitelist youtube.com alone is by far not sufficient.