Google Dorks for Recruiters: Source Candidates Faster

By the getdork team — Published June 12, 2026

Google indexes public professional profiles on LinkedIn, GitHub, Dribbble, Stack Overflow, and personal portfolio sites. By combining the site: operator with job titles, skills, and locations, recruiters can build targeted candidate shortlists across multiple platforms in minutes — without a paid recruiter seat or access to an ATS. The technique works for active candidates (those who signal availability) and passive ones (skilled professionals with public profiles who are not actively applying).
On this page

Why Google sourcing works for recruiting

LinkedIn's own search is powerful but limited: free accounts have a weekly commercial-use search cap, and the cheapest Recruiter Lite plan restricts InMail and advanced filters. Google has no such limits for search — and because Google has indexed millions of LinkedIn profiles, GitHub accounts, and personal sites, a well-constructed dork query reaches those profiles directly.

This technique — sometimes called "X-Ray searching" — has been standard in the recruiting industry for over a decade. The operators involved (site:, exact-phrase quotes, keyword combinations) are the same ones used in B2B sales prospecting. For a full operator reference, see the Google search operators cheat sheet.

Platforms and what to search on each

Platform site: value Best for
LinkedIn Profiles site:linkedin.com/in Most roles — by far the widest professional profile database
GitHub site:github.com Software engineers, data scientists, open-source contributors
Stack Overflow site:stackoverflow.com/users Developers active in Q&A for specific technologies
Dribbble site:dribbble.com UI/UX designers, graphic designers, visual identity designers
Behance site:behance.net Creative professionals — broader than Dribbble
Medium / Substack site:medium.com / site:substack.com Writers, product managers, thought leaders in a domain
Personal sites No site: filter + skill + "portfolio" Senior/specialist roles where candidates maintain independent sites

Step-by-step: build a candidate shortlist

  1. Extract the core requirements. From the job description, identify the non-negotiable elements that appear on a candidate's public profile: job title, one or two defining skills, and geography. Keep the initial search to 2–3 parameters or results will be too narrow.
  2. Choose the right platform first. For most white-collar roles: start with site:linkedin.com/in. For engineering roles: also search site:github.com. For design roles: add site:dribbble.com.
  3. Run the base query. Format: site:linkedin.com/in "[job title]" "[city or region]". Example: site:linkedin.com/in "data engineer" "Austin, Texas". Scan the first two pages of results to gauge result quality before refining.
  4. Add a skill or employer. If results are too broad, add a required skill in quotes: site:linkedin.com/in "data engineer" "Austin" "dbt". To find candidates from a specific company, add: intext:"Acme Corp".
  5. Filter for active candidates if needed. Adding "open to work" or "open to opportunities" to the query surfaces candidates who have signaled availability on their public profile.
  6. Shortlist and personalize. For each candidate worth contacting, visit the actual profile and read it before reaching out. Reference something specific — a recent role change, a project they describe, a skill combination — in your opening message. Personalization significantly improves response rates.

Copy-paste query examples by role type

Software engineers and developers

# Senior Python engineer, open to work, San Francisco
site:linkedin.com/in "Python engineer" "San Francisco" "open to work"

# React frontend developer in the Southeast US
site:linkedin.com/in "frontend engineer" "React" "Atlanta" OR "Nashville" OR "Charlotte"

# GitHub: engineers with Rust contributions in Texas
site:github.com "Rust" "Texas" "open to opportunities"

Data and analytics

# Data scientist with SQL and Python, New York
site:linkedin.com/in "data scientist" "New York" "Python" "SQL"

# Analytics engineer with dbt experience
site:linkedin.com/in "analytics engineer" "dbt" "Snowflake"

Design

# UX designer on Dribbble
site:dribbble.com "UX" "mobile" "2026"

# Product designer with Figma experience, remote-friendly
site:linkedin.com/in "product designer" "Figma" "remote"

Sales and marketing

# SDR/BDR with SaaS experience in Chicago
site:linkedin.com/in "sales development representative" "SaaS" "Chicago"

# Content marketing manager with SEO background
site:linkedin.com/in "content marketing manager" "SEO" "Boston"

Healthcare roles (clinical and administrative)

# Nurse practitioner in Memphis — NPI-registered providers are also findable
site:linkedin.com/in "nurse practitioner" "Memphis"

# Medical coder with CPC certification
site:linkedin.com/in "medical coder" "CPC" "remote"

Finding active vs. passive candidates

Active candidates signal availability explicitly. On LinkedIn, the #OpenToWork badge appears in some indexed profiles as the text "open to work" or "open to new opportunities." Adding this phrase to your query surfaces candidates who are actively looking.

Passive candidates have public profiles but are not actively signaling availability. Most candidates in any search result are passive. The approach: identify the fit, visit the profile for context, and send a brief, specific message about the role. Response rates for passive candidates via this channel are lower than for active candidates, but the quality of the eventual hire is often higher because you are selecting from the full employed pool rather than only those who have applied.

For passive candidates, avoid messages that read like mail merge. One sentence about why this specific person caught your attention (their particular project, employer, or skill combination) converts far better than template language.

getdork builds these queries for you.
Enter the job title, location, and required skills — getdork assembles the operator string for LinkedIn, GitHub, or any other platform. Free to generate; Pro to run in-app and export results.

Start free at getdork.com →
Responsible use in recruiting

Sourcing candidates via Google searches on public professional profiles is standard industry practice and legally straightforward. A few specific considerations for recruiting:

Frequently asked questions

Can Google dorks replace LinkedIn Recruiter?

For targeted searches of publicly visible profiles, Google dork searches are a strong free alternative. LinkedIn Recruiter provides access to all profiles (including those not indexed by Google), InMail credits, and filters that dork searches cannot match (years of experience, company headcount, etc.). For volume sourcing or tight specialty pools, Recruiter has clear advantages. For targeted searches on a budget, or for reaching candidates on platforms beyond LinkedIn, dork searches are effective.

Why does LinkedIn limit profile visibility in Google?

LinkedIn members control whether their profile appears in external search engines. Members who have opted out of indexing, or profiles set to a non-public visibility level, will not appear in Google results. LinkedIn also periodically restricts how much of the profile text Google can index. The publicly visible, indexing-enabled subset is still large enough to be highly useful for sourcing.

What is the Boolean search method and how does it differ from dork searches?

Boolean search in recruiting uses AND, OR, NOT inside LinkedIn's own search or an ATS. Google dork searches use Google's operator syntax — site:, quotes, minus — applied across Google's entire index, which includes LinkedIn and many other platforms. The two are complementary: use Boolean inside LinkedIn for depth; use dork searches for breadth across multiple platforms simultaneously.

How do I find passive candidates who aren't actively job hunting?

Search site:linkedin.com/in for job titles and skills without adding "open to work" — this surfaces all publicly visible profiles matching the role, regardless of current intent. GitHub contributions, conference talk bios, and published articles identify skilled professionals who may be open to the right conversation even without an active job search.

Can I find candidates on platforms other than LinkedIn?

Yes. site:github.com finds developers with public code and stated location. site:dribbble.com finds designers. site:stackoverflow.com/users finds developers who have answered questions in a specific technology. site:medium.com or site:substack.com finds writers, product thinkers, and domain experts who publish professional content. Each platform rewards a slightly different query structure.

Related guides