LinkedIn X-ray search, explained.

What X-ray search actually is.

X-ray search is the technique of using an outside search engine, almost always Google, to look inside a semi-closed site like LinkedIn. The name comes from the idea of seeing through the platform's own walls to the profiles underneath. Instead of searching on LinkedIn, where results are capped, paywalled and tied to your network, you point Google at LinkedIn's public pages and let it index them.

The whole thing rests on one operator, site:, which restricts Google to a single domain. Add a few keywords and you get a list of public LinkedIn profiles matching a role, a place and a skill, without spending a Sales Navigator seat or hitting LinkedIn's commercial-use limit. Recruiters have long leaned on this, and B2B sales teams use the same trick to source prospects.

It is genuinely useful for three things: finding people LinkedIn's search buries, sourcing without a paid seat, and building a fast list inside a narrow niche. It is not a substitute for a real prospecting workflow, and we will get to why.

The operators that matter.

You only need a handful. Everything in X-ray search is built from these.

Two details people get wrong

First, OR has to be capitalised or Google treats it as an ordinary word. Second, use site:linkedin.com/in rather than site:linkedin.com. The /in path is where individual profiles live, so it strips out company pages, job posts and articles in one move. Add -jobs and the name of common recruiting noise to clean the rest.

You can also target a country by its LinkedIn subdomain. site:uk.linkedin.com/in returns UK profiles, site:ca.linkedin.com/in Canadian ones. It is rough, since it keys off the profile's registered region rather than where the person works now, but for a first cut it narrows a list fast.

Copy-paste search strings.

Here are the most useful patterns. Swap the variables in green for your own targeting, paste into Google, and you have a list in seconds.

One honest note on a string you will see in other guides: searching for "@gmail.com" to surface emails. It occasionally works on profiles where someone pasted an address into a public field, but those are rare and getting rarer, and the results are mostly noise. Do not build a process on it.

Where X-ray search runs out.

X-ray search only sees what Google sees: the public, logged-out version of a profile, which can show less than the profile you see when you are signed in. So a keyword that sits deep in a job history or a summary may match nothing, because that text may not be in Google's copy of the page.

That shapes what X-ray search can do. It is good at finding a person by name, current title and rough location. It is much weaker at finding someone by a skill buried three roles deep, or by a phrase from their summary.

Accuracy is the other catch. The index lags reality, so you will hit stale titles, people who moved on, and duplicate or truncated entries. You are sourcing candidates to verify, not pulling a clean database.

X-ray search also gives you a name and a profile, nothing more. It does not tell you whether that company just raised, hired into the function you sell to, or did anything that makes this the right month to reach out. The list is static the instant you build it.

Where it fits in real outbound.

X-ray search earns its place as a quick, free first pass: a way to scope a niche, sanity-check a target market, or grab a short list when you do not have a paid seat. For that, it is excellent. Where it falls down is as the foundation of a campaign, because a name on a static list is not a prospect.

A list that converts is rebuilt around live buying signals, not scraped once and worked for a quarter. Here is how the X-ray output compares to a list assembled the way the meetings actually come from.

Once you have the right people, the result still comes down to how you reach them. A hand-written, relevant first message timed to a real reason beats anything templated.

This is the part we take off teams entirely. Real in-house setters source the list, time it to live signals, and write every message by hand on dedicated accounts branded as your business, so a clean prospect list turns into booked meetings rather than a spreadsheet that goes stale.