Y Combinator

The most prestigious startup accelerator in Silicon Valley runs their homepage on a WordPress installation so vanilla it makes GoDaddy's templates look innovative. Y Combinator's ycombinator.com loads with the graceful elegance of a 2009 university department site, complete with wp-content paths visible in their source and enough plugin bloat to choke a bandwidth monitor. Their hero section features a carousel.js implementation that would get you laughed out of a junior developer interview, while their "Apply" CTA button uses inline styles like it's 1999. For a firm that's launched Stripe, Airbnb, and Dropbox – companies that redefined web experiences – YC's own digital presence feels like it was assembled by someone who learned HTML from a library book.

Diving into their technical stack reveals the kind of performance nightmares that would make their portfolio companies weep. The site loads 2.3MB of unoptimized assets on initial paint, including a jQuery dependency that's older than some of their batch companies. Their LCP clocks in at a devastating 4.2 seconds, while their bundle includes three different icon libraries because apparently nobody audited their dependencies since Obama was president. The kicker? Their blog runs on a separate subdomain with completely different styling, suggesting their "engineering team" consists of whoever Paul Graham could convince to help with "just a quick WordPress thing." Meanwhile, their batch application portal – the actual money-maker – runs on entirely different infrastructure, because nothing says "we have our shit together" like maintaining three separate codebases for one business.

The real comedy emerges when you examine their tracking implementation versus their public statements about privacy-focused startups. YC's site loads seventeen third-party scripts, including HubSpot, Mixpanel, Google Analytics (both Universal AND GA4, naturally), and something called "yc-analytics.js" that appears to be homebrew event tracking written by someone who definitely didn't read the GDPR documentation. Their CSP header is completely absent, their robots.txt file is a single line allowing everything, and their sitemap.xml returns a 404. This is the same organization that regularly funds privacy-focused startups and lectures founders about user experience. The irony is so thick you could fund a Series A with it.

Perhaps most damning is their mobile experience, which feels like it was tested exclusively on Paul Graham's iPhone 6. The responsive breakpoints break at exactly the wrong viewport widths, their touch targets violate every iOS guideline ever written, and their batch company directory becomes completely unusable below 768px. For context, this is a firm managing over $600 million in assets, advising companies on digital transformation, and positioning themselves as the arbiters of what makes a successful web-first business. Their own site's accessibility score would fail a community college web design course, complete with missing alt tags, broken heading hierarchy, and enough WCAG violations to inspire a separate review. The message is clear: do as we say, not as we deploy.