LinkedIn xray search: the operators, the blind spots, and how to scale it

What a LinkedIn xray search is, and what it really returns

A LinkedIn X-ray search, also written LinkedIn xray, is a Google query that searches LinkedIn profiles from outside LinkedIn, using the site: operator to restrict results to linkedin.com and ordinary Google operators to filter them. You are not searching LinkedIn. You are searching Google's copy of the public part of LinkedIn profiles, which is why an X-ray behaves like a search engine and not like a recruiter database.

That distinction decides everything that follows. Google only holds what LinkedIn lets it crawl: the headline, the current company, the location line, the public summary and the visible experience blocks. It does not hold the fields LinkedIn keeps behind a login, and it does not refresh the day a candidate changes job. A LinkedIn X-ray search gives you a free, unlimited-looking window into a profile index that is partial and slightly out of date, which is a perfectly good trade when you know it.

Sourcers reach for it for three reasons that have not changed in years. It costs nothing, so it survives a hiring freeze that killed the Recruiter seat. It ignores LinkedIn's commercial search limit, the cap that throttles a free account once it has run a lot of searches in a month. LinkedIn does not publish the number, and it varies by account, so nobody outside LinkedIn can quote it honestly. And it lets you use Google operators that LinkedIn's own search does not offer, which is how you find the people whose titles do not match any of LinkedIn's neat job function buckets.

What it does not give you is a contactable list. An X-ray returns profile URLs and a snippet, and turning one of those URLs into a named profile costs 1 credit on Derrick's free plan of 100 credits a month, while the email behind it costs 5 credits and the mobile 150, both on the paid tiers.

Turning ten pages of results into named people with a mailbox and a mobile is a separate job, covered in section 07, and it is where most sourcing plans quietly break. The wider method sits in our recruitment sourcing plan; this page stays on the query itself.

The LinkedIn xray search syntax, operator by operator

Every LinkedIn xray search is built from the same five operators: site: to pick the index, quotes for an exact phrase, capitalised OR for alternatives, a minus sign to exclude, and intitle: to require a term in the page title. Learn those five and you can write any string without copying a template.

The path matters more than people expect. site:linkedin.com/in returns profiles. site:linkedin.com/in/ with the trailing slash behaves the same on Google but not on every engine. Country subdomains hold the local versions of the same profiles, so site:fr.linkedin.com/in narrows to profiles served in French, which is a crude but effective geography filter when the location line is unreliable.

A complete string for a senior data hire in Berlin looks like this:

site:linkedin.com/in ("data engineer" OR "analytics engineer") ("Berlin" OR "Germany") -intern -student -recruiter -"open to work"

Read it left to right: the index you are searching, the titles you accept, the geography you accept, the noise you refuse. Every LinkedIn X-ray search you will ever write is that shape.

Clear up one confusion now, because the two techniques are constantly mixed up. Boolean search is what you type inside LinkedIn or Sales Navigator, where AND, OR and NOT are the operators and the search runs against LinkedIn's own live index. An X-ray is what you type into Google, where the operators are site:, quotes and the minus sign, and the search runs against Google's crawled copy. The logic rhymes; the syntax, the freshness and the ceiling do not. Nothing on this page applies inside the LinkedIn search box.

What Google's index cannot see about a profile

Google's index holds only the public layer of a LinkedIn profile, crawled on Google's own schedule, which means an X-ray cannot see private profiles, cannot see structured fields such as years of experience, and shows you a snapshot that is days to weeks old. Those limits belong to the index itself, not to your query, so none of them are fixable with a cleverer string. A fourth, below, comes not from the index but from how much traffic Google tolerates. This is the section that saves you a wasted afternoon.

• It only sees public profiles. A candidate who has set their profile to private, or who joined recently enough that Google has not crawled them, does not exist in your results. Estimates of how much of LinkedIn is indexed vary and nobody outside LinkedIn can measure it, so treat any number you read on this subject with suspicion, including ours. What can be said is that the index is incomplete and that you cannot know by how much.
• It is out of date by design. Google recrawls a profile on its own schedule. A person who changed jobs six weeks ago may still show their previous employer in your snippet. This matters enormously for sourcing, where the whole point is often to catch someone shortly after a move. Our candidate data decay report covers how fast a sourced list goes stale and what re-verification cadence keeps it usable.
• It cannot filter on fields it does not hold. Years of experience, skills endorsements, languages, open-to-work status: none of that is reliably in the indexed text, so no operator will filter on it. If your string looks like it worked, check a few profiles by hand before you trust the pattern.
• Google throttles you. Run fifteen or so X-ray searches in quick succession from a browser and you will meet a CAPTCHA. Google publishes no threshold and the trigger varies by network and by account, so treat this as a practical observation rather than a rule. It is the ceiling on the method all the same, and the reason section 07 exists.

Build your LinkedIn xray search string

A working string has four parts in a fixed order: the index you are searching, the title variants you accept, the geography you accept, and the exclusion block that removes recruiters and job seekers. The builder below assembles those four parts for you, so you can see the shape before you start writing your own. Change one part at a time afterwards: a string that stops working usually broke because two changes were made at once.

Compared with Sales Navigator, Recruiter and plain LinkedIn search

An X-ray is the free, text-only option among four ways of building a candidate list: it beats the paid tools on cost and on unusual job titles, and loses to all of them on freshness and on structured filters. The comparison below makes no attempt to pretend the free method wins every row.

The pattern most small teams land on is a LinkedIn X-ray search for discovery and a cheap enrichment layer for contact data, rather than a seat that costs more per month than the whole rest of the stack. Which tools fit where is laid out in our comparison of sourcing automation tools.

One nuance, plainly: an X-ray beats Sales Navigator at exactly one thing, and that is finding people whose title does not exist in any dropdown. A "Growth Engineer", a "Forward Deployed Engineer", a "Chief of Staff to the CTO": these people fall between LinkedIn's job function buckets, and a text search on the headline finds them when a structured filter cannot.

Eight sourcing strings to keep on file

Eight string patterns cover most sourcing briefs: people at a named company, recent leavers, a named skill, a certification, company pages, a language, a second language, and the exclusion block every string should end with. These are patterns, not magic. Each one solves a specific sourcing problem that a plain title search does not.

• People at a named company. site:linkedin.com/in "Acme Corp" ("software engineer" OR "engineering manager"). Useful when you want to map a team before you approach it, and the company page's employee list is behind a login.
• People who recently left a company. site:linkedin.com/in "ex-Acme" OR "formerly at Acme". Catches the people who wrote it in their headline, which is a small but high-intent slice.
• A specific skill in the summary. site:linkedin.com/in "data engineer" ("dbt" OR "Airflow" OR "Snowflake"). The skills section is patchy in the index, but tools named in the summary text are usually there.
• A certification. site:linkedin.com/in ("AWS Certified Solutions Architect") "London". Certifications appear in the visible experience block often enough to be worth a try.
• Company pages instead of people. site:linkedin.com/company "marketing agency" "Manchester". A different index, useful for account mapping rather than candidate sourcing.
• Profiles in a specific language. site:fr.linkedin.com/in "ingenieur data". The country subdomain is a better language filter than a location term.
• Second-language speakers. site:linkedin.com/in "customer success" ("native German" OR "muttersprache"). Language claims live in the summary, so they are searchable.
• Exclude the job seekers you do not want. Every string above should end with -"open to work" -"seeking opportunities" -recruiter -"talent acquisition" unless those are exactly who you want. Recruiters rank well on recruiting terms, and they will fill your first page if you let them.

From a list of profile URLs to people you can actually contact

An X-ray hands you profile URLs; a sourcing pipeline needs names, current titles, work emails and sometimes mobile numbers, and getting from one to the other takes three separate steps, of which only the middle one runs on the free plan. This is the gap nobody mentions in the tutorials, and it is where most people give up. Each step below has a cost worth knowing before you start.

Step one, collect the URLs. Copying them by hand out of ten Google result pages is the part that makes people give up. You can run the search itself as a data operation instead.

Derrick's Search First Page Organic SERP Results on Google takes a query in a spreadsheet cell and returns the whole first page of organic results, at 5 credits per line. It is a Premium feature, so it sits on the paid tiers rather than the free plan. Put fifty X-ray strings in a column, get fifty pages of results back, and the CAPTCHA never appears because you are not the one hammering the search box.

Step two, turn a URL into a profile. Enrich Leads reads a LinkedIn profile URL and writes the full profile back into your sheet: current company, title, location, experience. It costs 1 credit per profile and it is available on the free plan.

One condition comes with that price. Enrich Leads works through your own LinkedIn session via the Chrome extension, so the extension has to be installed and signed in for the column to return anything.

Step three, find the contact details. Email Finder returns a verified professional email at 5 credits per email found, and Phone Finder returns a mobile at 150 credits per number. Both are Premium features, so they are not available on the free plan. Of the three steps above, only step two runs on the free allowance: the 100 credits a month cover profile enrichment, while the search automation in step one and the contact lookup in step three both sit on the paid tiers. Email Finder bills per result found, so a miss costs nothing, which is the right shape for a sourced list where match rates are never one hundred percent.

Run two calculations before you start, because the arithmetic decides your method. Two hundred profiles enriched is 200 credits, which is two months of the free plan and its 100 credits a month.

Two hundred emails found, if every single one resolves, is 1000 credits. Add the enrichment and the whole contactable list is 1200 credits, plus 5 credits per line if you automate the searches in step one. That is a paid-tier exercise: the 9 euro tier carries 4000 credits a month, and those 200 enrichment credits come out of the same stock rather than staying free. Match rates are never one hundred percent, so budget on results found rather than on attempts.

Running X-ray searches from an AI assistant or an API

The same enrichment steps run in three places: the Google Sheets sidebar for a whole list, an AI assistant through MCP for a single lookup in a chat, and the REST API for anything scheduled or wired into an ATS. If you source continuously rather than in bursts, the spreadsheet is not always the right surface. The right one depends on where the work already lives.

Google Sheets. The sidebar is the default: a column of profile URLs in, enriched columns out, in bulk. This is the surface most sourcing teams use because the shortlist already lives in a sheet.

An AI assistant, through MCP. Derrick MCP connects the same data to Claude, ChatGPT or any MCP-compatible assistant, so you can ask for a profile in a chat and get the answer in the conversation rather than in a cell. It suits the hiring manager who wants one lookup, not a list. Both MCP and the API unlock from the Plus plan at 47.50 euros a month.

The REST API. For an ATS integration or a scheduled job, the API exposes the same features, and Derrick reaches 3000+ integrations through Zapier, Make and N8N. A weekly re-verification pass over an ageing talent pool is a natural fit: schedule it, and the pool stops rotting between searches.

Say the scale point plainly, because it is where free methods stop. A manual X-ray is excellent for twenty candidates and painful for two thousand. The enrichment layer behind it holds at both ends: twenty profiles or twenty thousand, it is the same column in the same sheet, the same call through the API. Running both is how a two-person talent team keeps up with a market whose reach and response rates we measure in our talent sourcing benchmarks.

The mistakes that make these searches fail

Six mistakes account for nearly every X-ray string that returns nothing useful, and five of them are a syntax detail or a snippet read too quickly. Here they are, in the order they tend to happen.

• Lowercase or. Google reads OR as an operator only when it is capitalised. Written in lowercase it becomes an ordinary search word and your string silently returns the wrong thing.
• A space after the minus. -intern excludes. - intern does not. This is the single most common broken string.
• Trusting the snippet. The text Google shows you is a cached fragment. Open the profile before you write to someone about a job they left last spring.
• Forgetting the recruiter exclusion. Search any job title and the first page fills with recruiters who optimise their profile for that exact title. Exclude them by default.
• Running twenty searches by hand. You will hit a CAPTCHA, conclude the method is broken, and abandon it. The method is fine; doing it manually is what does not scale.
• Treating the list as fresh. A sourced list starts decaying the day you build it. Our data on candidate decay puts a number on how fast, and the answer argues for re-verifying before outreach rather than after a bounce.

A last point: an X-ray is a discovery technique, not a database. It is at its best when you have an unusual brief, a small budget and the patience to read a few profiles properly. Pair it with an enrichment layer and it stops being a party trick and starts being a sourcing channel. Want the numbers behind the channel choice? Start with our recruitment sourcing hub, then build the plan.