I have a client that wants to restrict all web sites except what is on a whitelist. Is there a limit to the number of sites in a whitelist for Enterpriseguard?

You can do a whitelist via URL Group or via Custom Category.

Custom Category via external db I think has a limit of ~1000 URLs.  I saw somewhere that the limit for all custom categories combined is ~200,000.

URL Group I am not sure about, but probably in the 1000s as well.  Large enough to become a problem keeping track of in the UI before you hit system limits.

You may also want to refer to:

https://community.sophos.com/kb/en-us/127270

You can do a whitelist via URL Group or via Custom Category.

Custom Category via external db I think has a limit of ~1000 URLs.  I saw somewhere that the limit for all custom categories combined is ~200,000.

URL Group I am not sure about, but probably in the 1000s as well.  Large enough to become a problem keeping track of in the UI before you hit system limits.

You may also want to refer to:

https://community.sophos.com/kb/en-us/127270