X-Ray Google Search for Recruiters: 4 Operators That Find Hidden Candidates

Most recruiters search inside platforms. LinkedIn’s search box, Indeed’s filters, GitHub’s user filter. There’s a parallel layer of sourcing that almost nobody uses: searching across all of those platforms at once, from the outside, using Google itself. The technique is called X-ray search, and it’s been around longer than LinkedIn has.

USITRecruitment’s tutorial covers the four core operators that make X-ray search useful for recruiters: site:, intitle:, inurl:, and filetype:. Each operator narrows Google to a specific scope. A particular website, words in the page title, words in the URL, or files of a specific type. Combined, they turn Google into a meta-search engine across LinkedIn, GitHub, Dice, personal portfolios, and any other public profile site.

This post covers what each operator does and how to combine them. The four operators and the basic Java developer / Indian IT companies examples are from USITRecruitment’s tutorial. The combined seven-role search strings later in the post are our compilations rather than verbatim claims from the source. For LinkedIn-internal boolean strings, see our LinkedIn boolean search strings for 15 common roles.

What X-Ray Search Actually Is

In short: X-ray search uses Google’s advanced operators to search inside a specific website without using that website’s own search interface. The name comes from “scanning through the inner pages” of a target site. For recruiters, it works because LinkedIn, GitHub, AngelList, and most resume hosts have public profile pages that Google has indexed. Google’s search is more flexible than any of those platforms’ internal search.

The mechanic is simple. Google has indexed billions of public web pages, including most public LinkedIn profiles, GitHub user pages, personal portfolios, and resume PDFs hosted on company websites. By telling Google to restrict its search to a specific site (or page title, URL, or file type), you can run a search that the target platform itself doesn’t expose.

A LinkedIn search inside LinkedIn requires a paid Recruiter seat to access advanced filters. The same data is searchable for free through Google with a four-operator query. The results aren’t identical (Google indexes the public version of profiles, not the data behind the LinkedIn login wall), but for many sourcing tasks, the public version is enough.

The Four Operators

In short: USITRecruitment’s tutorial covers four operators: site: (search within a specific website), intitle: (find words in page titles), inurl: (find words in URLs), and filetype: (restrict to specific file types like PDF or DOCX). Each operator alone is useful; combined, they produce highly targeted results.

1. site:

The most-used X-ray operator. It restricts Google to a specific domain or subdomain.

site:linkedin.com/in for LinkedIn personal profiles only.

site:github.com for GitHub pages.

site:angel.co for AngelList (now Wellfound) pages.

The /in suffix on LinkedIn matters. site:linkedin.com includes company pages, group pages, jobs, and other content. site:linkedin.com/in restricts to personal profile URLs only, which is exactly what a recruiter wants.

Example query for Java developers on LinkedIn:

site:linkedin.com/in "Java developer"

The double quotes force exact-phrase matching. Without them, Google might return profiles that mention “Java” and “developer” separately in different contexts.

2. intitle:

The intitle: operator searches for words in the title of a web page. LinkedIn profile titles include the person’s name and headline. GitHub user page titles include username and (often) bio. Personal portfolios often title themselves with name plus role.

Example: find resumes with “Java developer” in the page title:

intitle:resume "Java developer"

This is one of the most powerful sourcing moves on Google. People who post their resume online often include “Resume” or “CV” in the page title. The intitle: operator narrows to those pages directly.

3. inurl:

The inurl: operator searches for words in the URL of a web page. Personal sites often structure their URLs with descriptive paths like /resume, /cv, /portfolio, or /about.

Example: find DevOps engineer resumes:

inurl:resume "devops engineer"

This catches personal websites that host the resume at a /resume path, plus job board pages with “resume” in the URL structure.

4. filetype:

The filetype: operator restricts results to specific file types. Most useful values for recruiters:

• filetype:pdf for PDF resumes and CVs.
• filetype:doc and filetype:docx for Word resumes.
• filetype:xlsx for Excel files (useful for finding company lists, not candidate resumes).

Example: Java developer resumes in PDF:

"Java developer" resume filetype:pdf

USITRecruitment’s example: finding lists of IT companies in India in Excel format:

"IT companies in India" filetype:xlsx

This is a different use case (sourcing target-company lists rather than individual candidates), but the same operator.

Combining Operators

In short: Single operators are useful; combinations are where X-ray search becomes a serious sourcing tool. A query like site:linkedin.com/in intitle:"Java developer" "New York" returns LinkedIn profiles with “Java developer” in the title (i.e., headline) located in New York. The combination is what filters out the noise.

Layered queries work because each operator narrows the result set further:

Layer	Effect
site:linkedin.com/in	Restrict to LinkedIn profiles
intitle:"Java developer"	Profile must have “Java developer” in title (headline)
"New York"	Page must contain “New York”

Add specific skills to narrow further:

site:linkedin.com/in intitle:"Java developer" "New York" "Spring Boot" "PostgreSQL"

This returns LinkedIn profiles for Java developers in New York with Spring Boot and PostgreSQL experience. A search you’d struggle to replicate inside LinkedIn without a paid Recruiter seat.

Practical Examples Beyond the Tutorial

In short: Below are X-ray search strings for common recruiting roles. These are our compilations, built on top of the four operators USITRecruitment covers, rather than verbatim examples from the tutorial. Use them as templates. Copy, paste into Google, and refine the location and skills as needed.

1. Backend Developer (Python)

site:linkedin.com/in intitle:"backend developer" Python ("Django" OR "Flask" OR "FastAPI") "San Francisco"

Returns LinkedIn profiles with “backend developer” in the headline, Python experience, one of the major Python web frameworks, in San Francisco.

2. Frontend Developer (React)

site:linkedin.com/in intitle:"frontend developer" "React" "TypeScript" "London"

Substitute Vue or Angular for React, or “front-end developer” with the hyphen, to catch profile-title variations.

3. DevOps / SRE

site:linkedin.com/in ("DevOps engineer" OR "SRE" OR "site reliability") "Kubernetes" "Terraform" "Berlin"

Note: dropping intitle: here because DevOps practitioners frequently have job titles like “Platform Engineer” or “Infrastructure Engineer.” Restricting to title-level matching misses them.

4. Data Scientist

site:linkedin.com/in intitle:"data scientist" Python ("PyTorch" OR "TensorFlow") "Toronto"

For senior candidates, add "PhD" OR "machine learning research". For applied ML roles, add "production" OR "deployment".

5. Senior Engineer with Specific Stack

site:linkedin.com/in "senior engineer" "Go" "PostgreSQL" "distributed systems" "Berlin"

Drop intitle: for senior roles. Titles vary too much across companies. The skills layer does the qualifying.

6. Developers with Public Resumes (PDF)

"backend developer" resume filetype:pdf "New York"

Returns publicly hosted PDF resumes mentioning “backend developer” and “New York.” Useful for finding developers who’ve put their resume online; they’re typically actively or semi-actively job-hunting.

7. Developers with GitHub Portfolios

site:github.com "machine learning" "Python" location:Berlin

For more on evaluating GitHub profiles for technical hires, see our GitHub sourcing for technical recruiters guide.

What X-Ray Search Is Good At (And What It Isn’t)

In short: X-ray search is excellent for finding candidates with public profiles or portfolios. LinkedIn, GitHub, personal websites, public resume hosts. It’s poor for candidates without public web presence and won’t surface anyone who’s set their LinkedIn profile to “private to LinkedIn members only.” Treat it as one channel in a stack, not a replacement for platform searches.

Strengths:

• Free. No paid LinkedIn Recruiter seat required.
• Cross-platform. A single query can hit LinkedIn, GitHub, AngelList, personal sites simultaneously.
• Fast. Google’s search is faster than most platforms’ internal search.
• Surfaces non-LinkedIn candidates. PDF resumes hosted on personal sites won’t show up in a LinkedIn search at all.

Weaknesses:

• Public-only. Profiles set to “private to LinkedIn members only” are invisible to Google.
• Stale results. Google’s index lags behind real-time platform changes by days or weeks.
• No InMail integration. You find candidates, but contacting them requires a separate workflow (LinkedIn message, email finder, personal site contact form).
• Result depth. For broad searches, add more operators to narrow the result set rather than trying to scroll endlessly through Google’s results.

Combining X-Ray with Other Sourcing Layers

In short: X-ray search produces a list of names and profile URLs. The full sourcing workflow includes qualification (reviewing each profile), enrichment (finding contact info), outreach (sending the message), and tracking (recording the interaction). X-ray is step one. The other steps need their own tools.

A working multi-step workflow:

Step	Tool	Output
1. Search	Google X-ray	List of LinkedIn URLs
2. Qualify	Open profile, review fit	Shortlist
3. Enrich	Email finder Chrome extension	Email addresses
4. Outreach	Email sequencer	Messages sent
5. Track	Recruiting CRM	Replies captured, candidates scored

Each step compounds the previous one. Skipping qualification produces a long name list that wastes time at the enrichment step. Skipping enrichment produces a workflow that can’t follow up. Skipping tracking produces a workflow where every reply gets lost in your inbox.

For the email finder layer specifically, see our Chrome extensions to find candidate emails. For the broader Chrome extension toolkit, see the best Chrome extensions for recruiters in 2026.

Where Recrudoc Fits in This Workflow

X-ray search produces candidate URLs. Steps 2-5 in the workflow above need infrastructure. Recrudoc handles the second half:

• Smart CV Import lets you bulk-load up to 20 candidate profiles or resumes at once, with AI extraction and deduplication. Drop in a list of LinkedIn URLs from your X-ray search.
• AI Candidate Matching scores each candidate against the open JD using deterministic rules plus AI scorecards. About 5 seconds per candidate, around a small usage-based fee per scorecard.
• Visual Pipeline tracks every candidate through 7 stages from sourced to placed.
• AI Message Writer generates personalized first-touch messages from the candidate’s profile and the JD. Nine message types, three tones.
• Audit Trail logs every action so you don’t lose track of who you’ve already touched, when, and what they said.

The CRM is the layer that turns a Google X-ray query into a tracked, scored, contactable pipeline.

A Note on Search Volume

In short: Manual recruiter use of X-ray search is fine. Google doesn’t ban recruiters for using site: operators normally throughout the day. Heavy bursts of automated queries are different territory and can trigger CAPTCHAs or rate limits. Stick to manual or lightly assisted searches.

The recruiter-friendly pattern: build a saved set of 5-10 X-ray strings for your common roles, run them manually, paste results into your CRM. That’s a sustainable sourcing channel that doesn’t require any paid tools.

For the strategic context that sits above all these tactical sourcing moves (when to use X-ray, when to use platform-internal search, when to invest in relationships instead), see candidate sourcing strategies that top recruiters use in 2026.

Want a CRM that turns X-ray search results into a tracked pipeline without losing the thread? Try Recrudoc free — Smart CV Import, AI matching, and 7-stage visual pipeline built for recruiters who source across multiple platforms.

Sources

The four operators (site:, intitle:, inurl:, filetype:) and the basic Java developer / Indian IT companies examples in this article are from USITRecruitment’s tutorial. The combined seven-role search strings and the workflow integration discussion are our compilations on top of those operators.

• “X-Ray Google Search for Recruitment: Master site: intitle: inurl: filetype: to Find Candidates” — USITRecruitment, YouTube