How to use Google to search inside LinkedIn, GitHub, and Google Scholar for candidates, free, with copy-paste patterns and the mistakes that silently return nobody.
X-ray search means using a public search engine to look inside another
site. Instead of paying for LinkedIn Recruiter filters, you ask Google to
show you public profiles directly with the site: operator.
www. site:www.linkedin.com/in/ restricts results to public member profiles, skipping company pages and job ads. The www matters more than it looks — here is why.Want the strings written for you? The free Boolean generator builds LinkedIn, X-ray, and GitHub strings from a role and skill list in one click.
Everything else is a combination of these. You can learn them in ten minutes and spend a career getting better at combining them.
| Operator | What it does | In practice |
|---|---|---|
site: | Restrict to one host or path | site:www.linkedin.com/in/ — profiles only, not company pages |
" " | Exact phrase | "controls engineer" — not every page containing both words |
OR | Any of several terms. Must be uppercase | ("GNC" OR "guidance navigation") |
- | Exclude | -recruiter -"looking for" — drops recruiters and job posts |
intitle: | Word must be in the page title | intitle:resume "verilog" |
inurl: | Word must be in the URL | inurl:member-directory — finds association rosters |
filetype: | One document type | filetype:pdf "resume" "RF design" |
site:linkedin.com wastes half your resultsNearly every X-ray guide online — including the ones published by well-funded sourcing tools — tells you to search site:linkedin.com/in/. That instruction quietly costs you a large share of every result page you look at.
Google's site: operator matches a domain and every subdomain under it. LinkedIn serves the same profile from roughly forty country hosts: in.linkedin.com, uk.linkedin.com, ca.linkedin.com, de.linkedin.com and so on. Those are localized copies of profiles that already exist on www. Ask for site:linkedin.com/in/ and you invite all of them.
You see the same person three times under three hosts, you burn result slots you paid attention for, and if you are working a US-only search you spend a chunk of every page on profiles served from the wrong locale.
One word. It is the highest-value change in this entire guide, and it takes two seconds.
Be honest about what this does and does not do. Pinning to www is not a location filter — a London engineer's canonical profile is on www too. It removes duplicate foreign-locale copies, not foreign people. Geography still comes from the location terms in your query. And gl=us or Google's region setting only biases ranking; neither can exclude a host.
LinkedIn is the obvious one and the most contested. The strings below reach people who barely maintain a LinkedIn presence — which, in deep technical fields, is a lot of the best ones.
GitHub profile pages carry a location field and a bio. The people who fill both in are the ones reachable.
A citation profile names an employer and a specialty with no marketing language in between. For senior technical roles it is often a better read than a resume.
Patents name the people who actually did the work, and they list them by employer. This is the single most underused sourcing surface in hardware.
Anyone who agreed to stand up and explain their work is senior, articulate, and has already demonstrated they are willing to be visible.
Certification bodies and professional societies publish rosters. inurl: finds them because the directory is almost always in the path.
Generic guides demonstrate on "Software Engineer" "San Francisco" "Python", which was never the hard part. These are the searches that actually stall — written by someone who fills them.
"EMC" substring-matches Dell EMC, EMC Corporation and Emcore. Anchor on a standard number instead — MIL-STD-461 appears on the profile of someone who has run the test and essentially nowhere else.
People state their own clearance publicly; that is different from you inferring it. Pair it with a program-heavy metro, because cleared work concentrates geographically.
"ASIC Design Engineer" spans four unrelated jobs. The tool and node names separate them; the titles do not.
Nobody's profile literally contains "8-20 years experience in electronics or mechanical commodities". Quote short phrases people actually write, and OR the variants.
orGoogle reads or as a word and OR as an operator. One character, and the whole query means something else.
Titles are invented by employers and drift constantly. Tools, standards and part numbers do not. "MIL-STD-461" beats "EMC Engineer" every time.
Covered above, and worth repeating because every guide gets it wrong: site:www.linkedin.com/in/, not site:linkedin.com/in/.
Page one is the same for everyone, which is exactly why it is worked over. Read page two and three, then rewrite the query using the words the good profiles actually used. The second string is always better than the first.
An X-ray search uses a public search engine's site: operator to look inside another website. For example site:www.linkedin.com/in/ "EMC Engineer" returns public LinkedIn profiles without needing a LinkedIn Recruiter license.
Almost always because a quoted phrase is too long. Nobody's profile literally contains "8-20 years experience in electronics or mechanical commodities". Quote short real phrases and OR the variants instead. The second most common cause is a lowercase or, which Google reads as a word rather than an operator.
Always site:www.linkedin.com/in/. Google's site: operator matches a domain and every subdomain under it, and LinkedIn serves the same profiles from about forty country hosts such as in.linkedin.com, uk.linkedin.com and ca.linkedin.com. Those are localized copies of profiles that already exist on www, so leaving the host unpinned fills your results with duplicates. Pinning to www is not a location filter - a London engineer's canonical profile is also on www - it removes duplicate locale copies, not foreign people.
GitHub for engineers who ship code, Google Scholar and ResearchGate for researchers, Google Patents for named inventors in hardware, conference speaker pages for senior talent in any field, professional association member directories via inurl:, and Dribbble or Behance for designers.
X-ray search reads pages a search engine has already indexed and that the person chose to make public. It is not scraping and it does not bypass a login. Data-protection rules such as GDPR and CCPA still govern what you do next: how you store what you find, and how you contact someone. The search is the easy part; the obligations attach to the outreach and the record-keeping.
Yes, for two reasons. Platform search only shows you what that platform indexes and ranks, so everyone using it converges on the same candidates. And an AI sourcing tool is only as good as the queries underneath it - understanding the operators is what lets you tell whether a tool's results are thin because the talent is scarce or because the query was lazy.
Boolean search is the logic - AND, OR, NOT, quotes, parentheses - and works inside any search box including a platform's own. X-ray search is Boolean logic aimed through a general search engine at a specific site using the site: operator. In practice you use Boolean logic to build the query and X-ray to decide where it points.
Yes, but with a caveat worth understanding: you are matching text on a profile, not a verified location. Include the metro and its neighbouring cities as an OR group rather than one city name, because people write their location inconsistently - someone in Irvine may write Irvine, Orange County, Greater Los Angeles, or nothing at all.
Paste a job description and it builds the searches, scores every profile it finds, verifies emails, and drafts the outreach, with receipts for every score.
Paste a JD free →