X-ray Search Builder

What an X-ray search actually is

An X-ray search points a general search engine at a network’s public pages instead of searching inside the network. Google documents its site: operator as accepting a domain, a URL or a URL prefix, so site:linkedin.com/in/ narrows results to public profiles and nothing else. Every keyword you add then filters that set. No Recruiter seat, no commercial-use limit.

The path prefix is doing most of the work. Because company pages, job posts, articles and the public directory all live on other paths, constraining to /in/ excludes them without a single exclusion term. That matters more than it sounds: on Bing, every wasted term counts against a documented ten-term cap.

Four queries, not one

A single query is rarely the right one. Precise applies every criterion and returns the fewest people. Broad drops the keyword filters, for when precise returns nothing. The headline query matches the title inside the page title, which on a public profile is the person’s headline, so nearly every result is on target and the misses are people who word their headline differently. Company-targeted maps everyone at one employer. The tool builds all four and names what each one gives up.

The country trick, and why it works

LinkedIn documents that members in certain countries receive a public profile URL beginning with a two-letter country code, so a candidate in the Netherlands may sit on nl.linkedin.com rather than www. Searching a country host surfaces people a plain linkedin.com query can miss. Every one of the 37 hosts offered here was confirmed to resolve to LinkedIn’s own country-domain infrastructure.

The engines are not interchangeable

• Google documents site:, quoted phrases, the minus exclusion, filetype: and date operators. It does not document intitle:, inurl: or OR, which still work but are undocumented behaviour rather than a promise.
• Bing documents AND, OR, NOT and parentheses, and requires NOT and OR in capitals. It processes only the first ten terms of a query, so a long string is silently truncated, and it has no inurl: operator, so this tool writes path exclusions as -site: instead.
• DuckDuckGo documents site:, intitle: and inurl:, but describes its minus sign as returning fewer results rather than excluding, and documents no OR keyword. Use Google for anything with nested OR groups.

Eleven networks, and two honest warnings

LinkedIn is the obvious one, but a profile lives at a different kind of URL on every network, which is why each option here carries its own path and its own exclusions. GitHub profiles sit at the domain root, so they need exclusions rather than a prefix. Google Scholar explicitly allows crawlers to index author profiles, which makes it unusually reliable for research hiring. Wellfound profiles live under/p/, not the older /u/ path, which its own robots file disallows.

Two networks are getting worse and the tool says so rather than quietly returning less. Stack Exchange now tells every crawler not to index the network, so Stack Overflow results will thin out as search indexes age. Xing redirects logged-out visitors from profile pages to a login wall, so a result may not open for you at all.

What it will not do

You are searching an index, not the network. Anything private, or published since the page was last crawled, is invisible. Google states plainly that a site: query does not necessarily return every indexed URL and is not always exhaustive, so a result count is never a candidate-pool size. And you end with a page of links: no contact details, no ranking against your role, and the work of opening each one still ahead of you.

Widen a query that returns too little with the Synonym Expander, build one from a plain-English brief with the Boolean Search String Builder, and check the syntax of anything you paste with the Boolean Search Checker.