X-ray search (sourcing)
Using a search engine (usually Google) with the site: operator to search a specific website's public pages for candidate profiles, bypassing that site's own search interface and filters.
Michal Juhas · Last reviewed June 27, 2026
What is X-ray search?
X-ray search is the practice of using a general search engine, most often Google, to search the public pages of a specific website using the site: operator. Instead of using LinkedIn's own search or GitHub's filter interface, you type a query like site:linkedin.com/in "data engineer" "Berlin" directly into Google and get indexed results that the platform's own search might hide behind paywalls, tier limits, or anti-bot signals.
The term "X-ray" comes from the idea of seeing through a website's outer shell to the pages underneath.
In practice
- A sourcer who hits their LinkedIn InMail limit will paste
site:linkedin.com/in "machine learning engineer" "PyTorch" "Amsterdam"into Google Incognito to see public profiles that still appear in search without consuming a licence slot. - Recruiting teams doing competitor talent mapping use
site:acme.com/teamto pull employee names and titles from a rival's team page, then cross-reference on LinkedIn. - In team chat you will hear someone say "I X-rayed GitHub and found twelve contributors to that open-source repo, three of them are in our target geography."
Quick read, then how hiring teams use it
This is for recruiters, sourcers, TA, and HR partners who need the same vocabulary in debriefs, vendor calls, and policy reviews. Skim the first section when you need a fast shared picture. Use the second when you are deciding how it shows up in tools and compliance reviews.
Plain-language summary
- What it means for you: X-ray search is asking Google to search one website for you, which lets you find candidate profiles that the site hides behind its own login wall or tier limits.
- How you would use it: You type
site:linkedin.com/inplus the job title, skill, and location into Google Incognito and browse the results like any search page. - How to get started: Copy a working Boolean search string you already trust, add
site:linkedin.com/inat the front, and compare result counts to your Recruiter search for the same role. - When it is a good time: When native platform search shows suspiciously few results, when you have no Recruiter licence, or when you want to search a site that has no useful filter interface of its own (competitor team pages, GitHub, Behance).
When you are running live reqs and tools
- What it means for you: X-ray surfaces public profile pages via Google's index. The data is real but can be weeks stale, so validate before outreach. It complements licensed database search rather than replacing it.
- When it is a good time: Market mapping and initial list building, especially for niche roles where specialist platforms outperform LinkedIn. GitHub X-ray is standard for open-source-adjacent engineering roles.
- How to use it: Build strings with
site:plus Boolean logic, test in Incognito, log strings with result counts and the date in a shared doc. Pair with talent data aggregators for contact enrichment after you have names. - How to get started: Run one X-ray alongside your normal search for the same req, compare list quality, document the winner. Raise the GDPR question with your legal team before you pipe results into an ATS or bulk enrichment tool.
- What to watch for: Google personalisation skewing results (always use Incognito), LinkedIn blocking indexing of certain profile sections over time, result staleness for recently changed profiles, and compliance obligations that trigger the moment you record a name in your CRM.
Where we talk about this
On AI with Michal live sessions, X-ray search appears in the sourcing automation track alongside Boolean search and candidate data enrichment. The focus is on building strings you can explain to legal, combining platform searches with AI-drafted outreach, and knowing when automation crosses a platform's terms. Bring a real req and a target platform to Sourcing Lab to stress-test your strings with the group.
Around the web (opinions and rabbit holes)
Third-party creators move fast. Treat these as starting points, not endorsements, and double-check anything before you wire candidate data.
YouTube
- X-Ray Searching for Recruiters by Boolean Strings walks through the site: operator with live LinkedIn examples.
- How to Use Google to Find Candidates: X-Ray Search Tutorial covers the core pattern most sourcing courses build on.
- Advanced Boolean Search Techniques for Recruiters places X-ray inside a broader Boolean skills session, useful for context on OR ladders and exclusion clauses.
- X-Ray search on LinkedIn using Google in r/recruiting is a thread where sourcers share working strings and debate staleness tradeoffs.
- Is boolean search still big? in r/recruiting also covers X-ray as part of whether manual search skills matter in an AI era.
- What's your go-to Boolean trick when LinkedIn search feels too crowded? includes X-ray strings people actually use for hard-to-find roles.
Quora
- What is X-ray search in recruiting? collects practitioner definitions and examples (quality varies; read critically).
X-ray search versus native platform search
| Dimension | X-ray (Google site:) | Native platform search |
|---|---|---|
| Cost | Free | Licence or credits |
| Freshness | Days to weeks stale | Real-time |
| Profile coverage | Public pages only | Tier-gated but fresher |
| Boolean flexibility | Full Google syntax | Platform-specific fields |
| Best for | Market mapping, niche sites | Live shortlisting, alerts |
Related on this site
- Glossary: Boolean search, Passive sourcing, Candidate data enrichment, AI candidate sourcing, Talent data aggregators, GDPR and first-touch candidate outreach
- Blog: AI sourcing tools for recruiters
- Guides: Sourcers
- Live cohort: Sourcing Lab
- Membership: Become a member
Frequently asked questions
What is X-ray search and why do sourcers use it?
X-ray search means telling Google or Bing to search inside one site using the site: operator, for example site:linkedin.com/in "software engineer" "Berlin" "Python". You bypass LinkedIn's own search, which only shows profiles your account has permission to see, and reach public pages the search engine has indexed. Sourcers use it because it is free, it ignores InMail credit limits, and it lets you combine Boolean logic with Google's ranking signal. The tradeoff is freshness: Google's index can lag by days or weeks, so recent profile changes may not appear. It also only surfaces public information already visible without logging in.
How do I build a reliable X-ray string without getting zero results?
Start with site:linkedin.com/in to target profile pages specifically, not the company or jobs sections. Add quoted phrases for title variations and skills, then use OR to cover synonyms. A working string looks like: site:linkedin.com/in "data engineer" OR "analytics engineer" "dbt" "Berlin" -intitle:"jobs at". Test in incognito mode to strip personalisation, check the result count before adding more filters, and log strings with the date in a shared doc. Common zero-result causes: too many AND clauses, a title that is called something else in your target market, or a location name that appears differently on profiles. Iterate one clause at a time and compare counts.
Which platforms are worth X-raying besides LinkedIn?
GitHub profiles (site:github.com) expose actual code contribution history and tech stack that LinkedIn self-reports miss. Stack Overflow (site:stackoverflow.com/users) surfaces active technical contributors. Behance and Dribbble work for design talent. Company team pages (site:acme.com/team) give you names and roles from direct competitors for market mapping. For academic hires, Google Scholar, ResearchGate, and institutional faculty directories are productive. Each platform has a different indexing density, so test before investing an hour. Combine with talent data aggregators for contact enrichment once you have names.
What are the legal and ethical limits of X-ray sourcing?
X-ray search retrieves publicly indexed pages, so the legal exposure depends on what you do next. GDPR applies the moment you record a natural person's data in your ATS or CRM, regardless of how you found them. You need a lawful basis (usually legitimate interest with a balancing test) and must tell the candidate you hold their data when you make first contact. LinkedIn's terms prohibit automated scraping, but manual Google searches of public pages sit in a grayer area. Do not pipe X-ray results directly into a scraper or bulk enrichment tool without legal sign-off. Read GDPR and first-touch candidate outreach before you build any automated workflow around the results.
How does X-ray search compare to Boolean search inside LinkedIn Recruiter?
Native LinkedIn Recruiter Boolean gives you real-time index freshness, saved searches with alerts, and InMail integration, but it sits behind a seat licence and shows only profiles your account tier can see. X-ray reaches public profiles across the full open web, costs nothing beyond a Google account, and lets you combine site: with any Boolean logic. The downside is staleness: Google indexes on its own schedule, not LinkedIn's. In practice, experienced sourcers use X-ray for initial market mapping and list building, then verify and outreach through Recruiter. For platforms with no native search API, like competitor company pages or niche community sites, X-ray is often the only practical option. See Boolean search for the underlying logic that applies to both.
Can AI tools improve X-ray search workflows?
Yes in a few specific ways. An LLM can draft synonym OR ladders for a given role ("staff engineer" OR "principal engineer" OR "senior staff") faster than a sourcer typing from memory. It can also help parse messy profile page text once you have results, converting fragments into structured fields for your CRM. Prompt chains can turn a hiring manager brief into a starter X-ray string, which a sourcer then validates against real result counts. What AI cannot do is run the searches for you without a browser automation layer, and automation against LinkedIn violates their terms. Keep humans running the actual queries and reviewing results before any profile enters an ATS stage. See AI candidate sourcing for the broader sourcing workflow context.
Where do X-ray search skills fit in sourcer development?
X-ray is typically covered in the same session as Boolean search because the underlying logic is identical: the site: operator is just another Boolean filter. Practitioners who understand Boolean strings transfer naturally to X-ray within an hour. The harder skill is knowing which platforms are worth indexing for a given role family and how to combine X-ray results with candidate data enrichment tools for contact details. Sourcing cohorts at AI with Michal cover this sequence, from Boolean foundations through X-ray to AI-assisted outreach, in the live sourcing automation track at Sourcing Lab.